skills.rest
Dchuuuuuu
DchuuuuuuCOMMUNITY
Explore all skills by this author →
GitHub

security-patterns

Enforces secure coding patterns for secret management, input validation, and OWASP compliance in Kailash SDK workflows.

Updated Apr 2, 2026
Search Tags:#security#secret management#authentication#input validation#owasp#secure coding#injection prevention
One-click install
npx skills add https://github.com/Dchuuuuuu/disease-risk-classifier --skill security-patterns-dchuuuuuu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-patterns
Source: https://github.com/Dchuuuuuu/disease-risk-classifier/tree/main/.claude/skills/18-security-patterns
Command: npx skills add https://github.com/Dchuuuuuu/disease-risk-classifier --skill security-patterns-dchuuuuuu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI-generated code frequently introduces vulnerabilities like hardcoded credentials, SQL injection, insecure HTTP calls, and unsafe deserialization. This Skill encodes mandatory security patterns and red-team findings so generated Kailash SDK code avoids common exploit chains before review. ## Core Features & Use Cases - Secret Management: Enforces environment-variable-based credential handling and prohibits hardcoded API keys, passwords, and tokens. - Injection & Deserialization Prevention: Documents parameterized DataFlow queries, ast.literal_eval usage, and JSON-with-schema-validation instead of pickle.loads on external data. - Attack Chain Reference: Catalogs critical multi-step exploits found in red teaming (Redis pickle RCE, eval/import injection, auth timing attacks, PACT governance bypass) with prevention code. - Use Case: Before deploying a workflow that reads user input and calls external APIs, apply this Skill to verify HTTPS endpoints, validated inputs, fail-closed authentication, and a completed OWASP checklist. ## Quick Start Review my Kailash workflow code for security vulnerabilities and apply the mandatory security patterns before deployment.

Frequently Asked Questions about security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent hardcoded secrets in Python code?▼

Store all credentials in environment variables and read them with os.environ instead of literal strings. For production, use a secure secret vault, and never log sensitive values or include them in error messages.

How to prevent SQL injection in Kailash DataFlow workflows?▼

Use DataFlow's parameterized nodes instead of string-formatted queries. Pass user input as node parameters so DataFlow handles parameterization, and validate all external input before it reaches the workflow.

Why is pickle.loads dangerous with Redis data?▼

pickle.loads on data from an attacker-controlled Redis instance executes arbitrary code, enabling remote code execution. Use json.loads with schema validation instead, and validate Redis URL schemes before connecting.

What is fail-closed authentication and why does it matter?▼

Fail-closed means authentication errors deny access rather than falling back to insecure paths like plaintext comparison. Catching broad exceptions around crypto verification can enable timing attacks and auth bypass, so raise errors when cryptography libraries are unavailable.

When should I use ast.literal_eval instead of eval?▼

Use ast.literal_eval whenever evaluating user-supplied expressions, since it only permits literals like strings, numbers, lists, and dicts. eval with exposed __import__ in globals allows full arbitrary code execution.

Related Skills

Explore More Software Engineering Skills→
esperieesperie

frontend-integration

Integrate Kailash SDK workflows into React and Flutter frontend applications.

Community
Intermediate
michaelsvanbeekmichaelsvanbeek
1

security

Apply OWASP Top 10 security standards during code reviews and deployments.

Community
Advanced
terrene-foundationterrene-foundation
1

gold-standards

Enforce Kailash SDK development best practices for imports, testing, and error handling.

Official
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate