Agent Skills › nightly-labs/openbot › secure-code-guidance

secure-code-guidance

GitHub

提供Python、JS、TS和Go代码的安全审查与编写指导。专注于识别漏洞、给出修复建议及遵循安全默认值，适用于显式的安全咨询场景。

marketplace/production-catalog/skills/secure-code-guidance/SKILL.md nightly-labs/openbot

Trigger Scenarios

代码安全审查请求安全编码规范咨询漏洞修复建议获取

Install

npx skills add nightly-labs/openbot --skill secure-code-guidance -g -y

More Options

Non-standard path

npx skills add https://github.com/nightly-labs/openbot/tree/main/marketplace/production-catalog/skills/secure-code-guidance -g -y

Use without installing

npx skills use nightly-labs/openbot@secure-code-guidance

指定 Agent (Claude Code)

npx skills add nightly-labs/openbot --skill secure-code-guidance -a claude-code -g -y

安装 repo 全部 skill

npx skills add nightly-labs/openbot --all -g -y

预览 repo 内 skill

npx skills add nightly-labs/openbot --list

SKILL.md

Frontmatter

{
    "name": "secure-code-guidance",
    "description": "Review or write Python, JavaScript, TypeScript, or Go code using secure defaults. Use only for explicit security guidance, security reviews, or secure implementation requests, not ordinary code review."
}

Secure Code Guidance

Ground the work in the repository before giving security advice. Identify the languages, frameworks, exposed entry points, trust boundaries, and existing project rules that apply.

For a review, report only concrete issues supported by code evidence. Give each finding a severity, impact, location, and smallest practical remediation. Distinguish confirmed vulnerabilities from defense-in-depth suggestions, and do not inflate local-development choices into production findings.

For implementation, prefer secure defaults that preserve intended behavior. Pay particular attention to authorization at resource boundaries, validation of untrusted input, injection risks, secret handling, unsafe deserialization, path traversal, outbound request controls, and sensitive data exposure.

Before proposing a change, inspect callers and tests for compatibility constraints. Verify fixes with the narrowest relevant checks. If the requested stack falls outside Python, JavaScript, TypeScript, or Go, state that this skill has no stack-specific guidance and limit the response to well-established general principles.