skills.rest
Hamza-Haadi
Hamza-HaadiCOMMUNITY
Explore all skills by this author →
GitHub

security-patterns

Enforces secure coding patterns for secrets, input validation, authentication, and OWASP compliance in Kailash SDK workflows.

Updated Apr 2, 2026
Search Tags:#security#secret management#authentication#input validation#owasp#injection prevention#kailash sdk
One-click install
npx skills add https://github.com/Hamza-Haadi/disease-risk-classifier-hamza --skill security-patterns-hamza-haadi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-patterns
Source: https://github.com/Hamza-Haadi/disease-risk-classifier-hamza/tree/main/.claude/skills/18-security-patterns
Command: npx skills add https://github.com/Hamza-Haadi/disease-risk-classifier-hamza --skill security-patterns-hamza-haadi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI-generated code frequently introduces vulnerabilities like hardcoded credentials, SQL injection, insecure HTTP calls, and unsafe deserialization. This Skill encodes mandatory security patterns and red-team findings so generated Kailash SDK code avoids common vulnerabilities before they reach production. ## Core Features & Use Cases - Secret Management: Enforces environment-variable-based credential handling and prohibits hardcoded API keys, passwords, and tokens. - Injection & Input Validation: Provides parameterized query patterns via DataFlow nodes and safe evaluation with ast.literal_eval instead of eval/exec. - Attack Chain Prevention: Documents critical multi-step exploits found in red teaming (pickle RCE via Redis, auth timing attacks, PACT governance bypass) with concrete prevention code. - Use Case: Before deploying a workflow that calls external APIs and reads user input, apply this Skill's checklist to verify HTTPS usage, validated inputs, no hardcoded secrets, and OWASP Top 10 coverage. ## Quick Start Review my Kailash workflow code for security issues using the security-patterns checklist and fix any hardcoded secrets or injection risks.

Frequently Asked Questions about security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent hardcoded secrets in Python code?▼

Load credentials from environment variables using os.environ instead of embedding API keys or passwords in source code. For production, store secrets in a secure vault and configure environment variables at deployment time.

How to prevent SQL injection in Kailash SDK workflows?▼

Use DataFlow nodes with parameterized queries instead of string-formatted SQL. DataFlow handles parameterization automatically, so passing validated user input as node parameters prevents injection attacks.

Why is pickle.loads dangerous with Redis data?▼

pickle.loads on data from an attacker-controlled Redis instance executes arbitrary code, enabling remote code execution. Use json.loads with schema validation instead, and validate Redis URL schemes before connecting.

What is a safe alternative to eval() in Python?▼

Use ast.literal_eval, which only evaluates literals like strings, numbers, dicts, and lists. Never expose __import__ in eval or exec globals, as that grants full code execution capability.

How should password verification handle crypto library failures?▼

Fail closed by raising an authentication error when the cryptography library is unavailable, never fall back to plaintext comparison. Use hmac.compare_digest for constant-time hash comparison to prevent timing attacks.

Related Skills

Explore More Software Engineering Skills→
myeohVmzrka92myeohVmzrka92

core-sdk

Build Kailash Core SDK workflows with WorkflowBuilder, runtimes, and observability.

Community
Advanced
alo-expalo-exp
6

gsd-secure

Audit code, configuration, and infrastructure changes against OWASP security best practices.

Official
Advanced
William189189William189189

validation-patterns

Enforce gold-standard validation patterns for Kailash SDK workflows.

Community
Advanced
ylxaiylxai
2

RedTeam

Identify vulnerabilities in ideas, strategies, and plans via 32-agent adversarial analysis.

Community
Advanced