The Agent Skills Directory

[SAFE]: The skill provides defensive coding guidelines and security-conscious architectural patterns for Ruby on Rails applications.
[SAFE]: Authentication guidelines in references/auth.md correctly recommend using signed cookies with httponly and same_site: :lax flags to mitigate session hijacking and CSRF attacks.
[SAFE]: The skill explicitly addresses Insecure Direct Object Reference (IDOR) vulnerabilities by instructing developers to scope database lookups to the current user (e.g., Current.user.accessible_cards.find(params[:id])) rather than using unscoped global lookups.
[SAFE]: Webhook handling instructions in references/webhooks.md mandate HMAC signature verification using constant-time comparison to prevent timing attacks and unauthorized data injection.
[SAFE]: Guidelines for redirection in references/auth.md include a validation mechanism to prevent Open Redirect vulnerabilities.
[SAFE]: The skill discourages the use of unnecessary third-party gems, which reduces the potential supply chain attack surface of the resulting application.
[SAFE]: No malicious patterns, obfuscation, unauthorized network operations, or credential exfiltration attempts were detected across the analyzed files.

rails-dev