skills.rest
Turgunoff
TurgunoffCOMMUNITY
Explore all skills by this author →
GitHub

V3 Security Overhaul

Remediates critical CVEs and implements secure-by-default patterns for Codex-flow v3.

Updated May 11, 2026
Search Tags:#security#input validation#secure coding#npm audit#bcrypt#path traversal#cve remediation
One-click install
npx skills add https://github.com/Turgunoff/mebellar_app --skill v3-security-overhaul-turgunoff
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: V3 Security Overhaul
Source: https://github.com/Turgunoff/mebellar_app/tree/main/.agents/skills/v3-security-overhaul
Command: npx skills add https://github.com/Turgunoff/mebellar_app --skill v3-security-overhaul-turgunoff

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bcrypt, zod.

What problem does it solve? Codex-flow v3 ships with critical vulnerabilities including outdated dependencies, weak SHA-256 password hashing, and hardcoded credentials. This Skill orchestrates a comprehensive security overhaul that fixes these CVEs and establishes security-first development practices. ## Core Features & Use Cases - CVE Remediation: Updates vulnerable npm dependencies, replaces SHA-256 hashing with bcrypt (12 rounds), and generates cryptographically random credentials instead of hardcoded secrets. - Secure-by-Default Patterns: Provides ready-to-use implementations for Zod input validation, path traversal sanitization, and shell-free command execution via execFile. - Agent Orchestration: Coordinates specialized v3 security agents (v3-security-architect, security-auditor, test-architect) for threat modeling, auditing, and TDD-based security testing. - Use Case: When upgrading Codex-flow to v3, run this Skill to fix CVE-1, CVE-2, and CVE-3, then validate the result against a 90/100 security score with over 95% test coverage on security-critical code. ## Quick Start Ask the AI to run the V3 security overhaul to fix the critical CVEs and apply secure coding patterns across the Codex-flow v3 codebase.

Frequently Asked Questions about V3 Security Overhaul

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix critical CVEs in Codex-flow v3?▼

Run npm update for the vulnerable Anthropic SDK dependency, replace SHA-256 password hashing with bcrypt using 12 rounds, and generate credentials with crypto.randomBytes instead of hardcoding them. The Skill coordinates security agents to apply all three fixes.

How to replace SHA-256 password hashing with bcrypt in Node.js?▼

Import the bcrypt package and call bcrypt.hash(password, 12) to hash passwords with 12 salt rounds. This replaces insecure SHA-256 with hardcoded salts, which is vulnerable to rainbow table attacks.

How do I prevent path traversal attacks in Node.js?▼

Resolve the user-supplied path against an allowed prefix using path.resolve, then verify the result still starts with the allowed directory. Throw an error if the resolved path escapes the permitted boundary.

Does this Skill validate user input automatically?▼

Yes, it uses Zod schemas to validate inputs such as task IDs as UUIDs, content length limits, and enumerated agent types. Invalid input is rejected before reaching business logic.

Why is execFile safer than exec for running commands?▼

execFile runs the binary directly with shell set to false, so user input is passed as arguments without shell interpretation. This prevents command injection attacks that are possible with exec string concatenation.

Related Skills

Explore More Software Engineering Skills→
lengo0951lengo0951

ck:security-scan

Scan codebases for vulnerabilities, hardcoded secrets, and dependency issues.

Community
Advanced
LLM-Dev-OpsLLM-Dev-Ops
1

V3 Security Overhaul

Audit and harden claude-flow v3 security architecture across CI/CD stages.

Official
Advanced
pwarnockpwarnock
2

security-scanning

Automates security scanning for vulnerabilities, secrets, and misconfigurations in projects.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-demo

Simulate Endor Labs security scans and remediation workflows without real accounts.

Official
Basic