How do I install the Verify Security skill?

Run npx skillmds@latest add me-cedric/verify-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Verify Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Verify Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Verify Security free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Verify Security?

me-cedric (@me-cedric) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Verify Security by me-cedric — Agent Skill

Name: Verify Security
Author: me-cedric

Verify Security

Security verification gate. Scans code for vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when the user mentions security scans, vulnerability detection, security audits, code security, OWASP, injection detection, or sensitive-data leaks. Auto-triggers for new modules, security-related changes, offensive/defensive tasks, and completed refactors.

me-cedric 7855b0a 2 files · 15.8 KB Updated Sep 17, 2026

File contents

⚖ Verification Gate · Security

Core principle

Security is the foundation; a breach sinks the release.
Security decisions must be traceable.
Critical/High findings must be fixed before delivery.

Automatic scan

Run the security scanner script (cross-platform):

# from the skill directory
node scripts/security_scanner.cjs <scan-path>
node scripts/security_scanner.cjs <scan-path> -v           # verbose mode
node scripts/security_scanner.cjs <scan-path> --json       # JSON output
node scripts/security_scanner.cjs <scan-path> --exclude vendor  # exclude a directory

Coverage

Vulnerability classes detected

Class	Checks	Severity
Injection	SQL injection, command injection, code injection	🔴 Critical
Secrets	Hardcoded keys, AWS keys, private keys	🔴 Critical
XSS	innerHTML, dangerouslySetInnerHTML	🟠 High
Deserialization	pickle.loads, yaml.load	🟠 High
Path traversal	Unvalidated file-path operations	🟠 High
SSRF	Unvalidated URL requests	🟠 High
XXE	Unsafe XML parsing	🟠 High
Weak crypto	MD5/SHA1 in security contexts	🟡 Medium
Insecure randomness	Non-crypto RNG in security contexts	🟡 Medium
Debug code	console.log, print, debugger	🔵 Low

Documentation-level checks

Security-relevant code must be recorded in DESIGN.md:

Threat model — which attacks are defended against
Security decisions — why this approach was chosen
Security boundaries — where the trust boundaries sit
Accepted risks — which risks were consciously accepted

Dangerous-pattern quick reference

Python

# 🔴 Dangerous
eval(), exec(), os.system()
subprocess(..., shell=True)
pickle.loads(), yaml.load()
cursor.execute(f"SELECT * FROM t WHERE id = {id}")

# ✅ Safe alternative
ast.literal_eval()
subprocess([...], shell=False)
yaml.safe_load()
cursor.execute("SELECT * FROM t WHERE id = %s", (id,))

JavaScript

// 🔴 Dangerous
eval(), innerHTML, document.write()
new Function(userInput)

// ✅ Safe alternative
JSON.parse(), textContent
template engines with auto-escaping

Go

// 🔴 Dangerous
exec.Command("sh", "-c", userInput)
template.HTML(userInput)

// ✅ Safe alternative
exec.Command("cmd", args...)
html/template auto-escaping

Verification flow

1. Run security_scanner.cjs
2. Review findings, sorted by severity
3. Check that security decisions are documented
4. Emit the security report
5. Critical/High findings must be fixed before delivery

Auto-trigger moments

Scenario	Trigger
New module	When module creation completes
Security-related change	Auth, authorization, crypto, input handling
Offensive/defensive task	When a red/blue-team task completes
Refactor done	When a refactoring task completes
Pre-commit	Before committing code

Report format

## Security Verification Report

✓ pass | ✗ fail

- 🔴 Critical: N
- 🟠 High: N
- 🟡 Medium: N
- 🔵 Low: N

### Findings

| File | Line | Kind | Severity | Description |
|------|------|------|--------|------|
| ... | ... | ... | ... | ... |

### Verdict

Deliverable / fix before delivery

---name: verify-securitydescription: Security verification gate. Scans code for vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when the user mentions security scans, vulnerability detection, security audits, code security, OWASP, injection detection, or sensitive-data leaks. Auto-triggers for new modules, security-related changes, offensive/defensive tasks, and completed refactors.license: MIT---# ⚖ Verification Gate · Security## Core principle```Security is the foundation; a breach sinks the release.Security decisions must be traceable.Critical/High findings must be fixed before delivery.```## Automatic scanRun the security scanner script (cross-platform):```bash# from the skill directorynode scripts/security_scanner.cjs <scan-path>node scripts/security_scanner.cjs <scan-path> -v # verbose modenode scripts/security_scanner.cjs <scan-path> --json # JSON outputnode scripts/security_scanner.cjs <scan-path> --exclude vendor # exclude a directory```## Coverage### Vulnerability classes detected| Class | Checks | Severity ||------|--------|--------|| **Injection** | SQL injection, command injection, code injection | 🔴 Critical || **Secrets** | Hardcoded keys, AWS keys, private keys | 🔴 Critical || **XSS** | innerHTML, dangerouslySetInnerHTML | 🟠 High || **Deserialization** | pickle.loads, yaml.load | 🟠 High || **Path traversal** | Unvalidated file-path operations | 🟠 High || **SSRF** | Unvalidated URL requests | 🟠 High || **XXE** | Unsafe XML parsing | 🟠 High || **Weak crypto** | MD5/SHA1 in security contexts | 🟡 Medium || **Insecure randomness** | Non-crypto RNG in security contexts | 🟡 Medium || **Debug code** | console.log, print, debugger | 🔵 Low |### Documentation-level checksSecurity-relevant code must be recorded in DESIGN.md:- [ ] **Threat model** — which attacks are defended against- [ ] **Security decisions** — why this approach was chosen- [ ] **Security boundaries** — where the trust boundaries sit- [ ] **Accepted risks** — which risks were consciously accepted## Dangerous-pattern quick reference### Python```python# 🔴 Dangerouseval(), exec(), os.system()subprocess(..., shell=True)pickle.loads(), yaml.load()cursor.execute(f"SELECT * FROM t WHERE id = {id}")# ✅ Safe alternativeast.literal_eval()subprocess([...], shell=False)yaml.safe_load()cursor.execute("SELECT * FROM t WHERE id = %s", (id,))```### JavaScript```javascript// 🔴 Dangerouseval(), innerHTML, document.write()new Function(userInput)// ✅ Safe alternativeJSON.parse(), textContenttemplate engines with auto-escaping```### Go```go// 🔴 Dangerousexec.Command("sh", "-c", userInput)template.HTML(userInput)// ✅ Safe alternativeexec.Command("cmd", args...)html/template auto-escaping```## Verification flow```1. Run security_scanner.cjs2. Review findings, sorted by severity3. Check that security decisions are documented4. Emit the security report5. Critical/High findings must be fixed before delivery```## Auto-trigger moments| Scenario | Trigger ||------|----------|| New module | When module creation completes || Security-related change | Auth, authorization, crypto, input handling || Offensive/defensive task | When a red/blue-team task completes || Refactor done | When a refactoring task completes || Pre-commit | Before committing code |## Report format```## Security Verification Report✓ pass | ✗ fail- 🔴 Critical: N- 🟠 High: N- 🟡 Medium: N- 🔵 Low: N### Findings| File | Line | Kind | Severity | Description ||------|------|------|--------|------|| ... | ... | ... | ... | ... |### VerdictDeliverable / fix before delivery```---

Frequently asked questions