Secure Code Guardian

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention.

This is a coherent, instruction-only secure‑coding skill that provides useful patterns and example code. Before using it: (1) review example snippets—they reference environment variables and services (JWT_SECRET, SESSION_SECRET, Redis, DB, file I/O) but the skill doesn't declare them; supply and protect any secrets via your secret manager rather than pasting them into code or logs; (2) vet and test the provided templates in a safe environment before deploying to production; (3) verify any third-party libraries you install (bcrypt, jsonwebtoken, helmet, DOMPurify, etc.) for licensing and vulnerabilities and run dependency scans; (4) note the skill author/source is unknown—if you need stronger assurance, prefer guidance from a known maintainer or audit the content line-by-line before automation. Overall the skill appears consistent with its stated purpose, but exercise normal caution around secrets and operational configuration.

Type: OpenClaw Skill Name: secure-code-guardian Version: 0.1.0 The skill bundle is designed to instruct an AI agent on secure coding practices and OWASP Top 10 prevention. All files, including the SKILL.md and various reference markdown files, consistently provide guidance and code examples for implementing robust security controls. There is no evidence of prompt injection attempts, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The code snippets demonstrate secure handling of secrets (e.g., `process.env.JWT_SECRET`), proper input validation, and safe use of system resources (e.g., `execFile` for command injection prevention), aligning entirely with the stated purpose of a 'secure-code-guardian'.