Agent Skills › nightly-labs/openbot › secure-code-guidance

secure-code-guidance

GitHub

提供Python、JS/TS及Go代码的安全审查与实现指导，识别漏洞并给出修复建议，关注认证授权、输入验证及敏感数据处理。

marketplace/production-catalog/skills/secure-code-guidance/SKILL.md nightly-labs/openbot

Trigger Scenarios

需要安全代码审查请求安全编码指导询问特定语言的安全最佳实践

Install

npx skills add nightly-labs/openbot --skill secure-code-guidance -g -y

More Options

Non-standard path

npx skills add https://github.com/nightly-labs/openbot/tree/main/marketplace/production-catalog/skills/secure-code-guidance -g -y

Use without installing

npx skills use nightly-labs/openbot@secure-code-guidance

指定 Agent (Claude Code)

npx skills add nightly-labs/openbot --skill secure-code-guidance -a claude-code -g -y

安装 repo 全部 skill

npx skills add nightly-labs/openbot --all -g -y

预览 repo 内 skill

npx skills add nightly-labs/openbot --list

SKILL.md

Frontmatter

{
    "name": "secure-code-guidance",
    "description": "Review or write Python, JavaScript, TypeScript, or Go code using secure defaults. Use only for explicit security guidance, security reviews, or secure implementation requests, not ordinary code review."
}

Secure Code Guidance

Ground the work in the repository before giving security advice. Identify the languages, frameworks, exposed entry points, trust boundaries, and existing project rules that apply.

For a review, report only concrete issues supported by code evidence. Give each finding a severity, impact, location, and smallest practical remediation. Distinguish confirmed vulnerabilities from defense-in-depth suggestions, and do not inflate local-development choices into production findings.

For implementation, prefer secure defaults that preserve intended behavior. Pay particular attention to authorization at resource boundaries, validation of untrusted input, injection risks, secret handling, unsafe deserialization, path traversal, outbound request controls, and sensitive data exposure.

Before proposing a change, inspect callers and tests for compatibility constraints. Verify fixes with the narrowest relevant checks. If the requested stack falls outside Python, JavaScript, TypeScript, or Go, state that this skill has no stack-specific guidance and limit the response to well-established general principles.