skills/secure-code/SKILL.md

---
name: secure-code
description: Review or implement application security controls for authentication, authorization, secrets, untrusted input and data isolation.
---

# Secure Code

Use this skill only for its stated purpose. Follow the shared source-of-truth, permission and evidence rules in `../../references/workflow-contract.md`. Read `../../references/security-and-privacy.md` for detailed method when necessary.

## Procedure
1. Map entrypoints, actors, sensitive data, boundaries and the highest-risk side effects.
2. Verify authentication plus object/tenant authorization at access boundaries; inspect validation and redaction.
3. Identify grounded exploitable paths, not generic CWE lists; prioritize confidentiality/integrity/availability.
4. Propose or implement minimal verified controls and negative tests.
5. Report residual risks; never run exploitation against real external systems without explicit authorization.

## Handoff rule
State actual artifacts or grounded code findings and validation status. Never invent file paths, executed tests, tool access, or completed subagent work. Keep output proportionate to the user request.