What problem does it solve? AI-generated code edits can escape workspace boundaries, leak secrets, or run dangerous commands. This Skill provides a reusable security checklist to audit proposed file operations, shell commands, and preview iframe communication before they are approved. ## Core Features & Use Cases - Path Containment Auditing: Verifies every file read, write, and command target stays under the active project workspacePath after normalization and realpath resolution. - Secret and Command Guardrails: Blocks exposure of Hermes API keys, forbids NEXT_PUBLIC_HERMES_* variables, and rejects destructive or privilege-escalating commands. - Isolation and Iframe Checks: Distrusts browser-provided ports, process IDs, and session IDs, and requires preview communication to use approved channels with project id and nonce verification. - Use Case: Before completing a run that modifies a generated Next.js app, run this review to confirm no edit touches AppLoop source files, templates, or sibling project workspaces, and receive an approved, blocked, or needs-context decision. ## Quick Start Review the proposed changes for the current generated project and report any security violations with safe corrections.
