{"id":77022,"plugin_id":"plugins_6ab41ed5b8c4819199eb5bbf91ce25f5","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T00:12:19.267Z","digest":"f46904bf2ce338c0f511920a5288cb6f328621184b74d610ca4acabefef59444","against":null,"payload":{"description":"Review or implement application security controls for authentication, authorization, secrets, untrusted input and data isolation.","included_files":[],"name":"secure-code","skill_md_contents":"---\nname: secure-code\ndescription: Review or implement application security controls for authentication, authorization, secrets, untrusted input and data isolation.\n---\n\n# Secure Code\n\nUse this skill only for its stated purpose. Follow the shared source-of-truth, permission and evidence rules in `../../references/workflow-contract.md`. Read `../../references/security-and-privacy.md` for detailed method when necessary.\n\n## Procedure\n1. Map entrypoints, actors, sensitive data, boundaries and the highest-risk side effects.\n2. Verify authentication plus object/tenant authorization at access boundaries; inspect validation and redaction.\n3. Identify grounded exploitable paths, not generic CWE lists; prioritize confidentiality/integrity/availability.\n4. Propose or implement minimal verified controls and negative tests.\n5. Report residual risks; never run exploitation against real external systems without explicit authorization.\n\n## Handoff rule\nState actual artifacts or grounded code findings and validation status. Never invent file paths, executed tests, tool access, or completed subagent work. Keep output proportionate to the user request.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}