security-protocol
Installation
SKILL.md
Security Protocol
Every point where data enters your code from outside is a trust boundary: request bodies, headers, cookies, URLs, files, environment, message queues, third-party API responses, and model output. Data that crosses one is hostile until it has been validated for what it claims to be and encoded for where it is going. Validate on the way in, encode on the way out, authorise every action, and keep secrets out of code.
The Prime Directive
NO EXTERNAL DATA REACHES A SYSTEM CALL, QUERY OR OUTPUT WITHOUT VALIDATION
No exceptions. No workarounds. No shortcuts.
"System call" includes shell commands, file-system paths, outbound HTTP requests, deserialisers and eval-like functions. "Query" includes SQL, NoSQL, LDAP, XPath and search engines. "Output" includes HTML, JSON sent to browsers, logs, headers and prompts sent to a model.