PITFALL:
AI context includes sensitive data.
Secrets sent to AI providers.
SOLUTION:
- Use .cursorignore for .env files
- Use environment variables
- Enable Privacy Mode for sensitive code
- Never hardcode credentials
Trusting AI for Security Code
PITFALL:
AI-generated auth/crypto code may have flaws.
Security vulnerabilities in generated code.
SOLUTION:
- Extra review for security code
- Use established libraries
- Security review by human expert
- Test with security tools
API Keys in Settings
PITFALL:
Storing API keys in settings.json.
Keys visible in plaintext.
SOLUTION:
- Use environment variables
- Use secrets managers
- Never commit keys to repo
- Rotate keys if exposed
1---2name: 2068-security-pitfalls-abdac7c43description: Security Pitfalls4---5# Security Pitfalls67## Security Pitfalls89### Exposing Secrets10```11PITFALL:12AI context includes sensitive data.13Secrets sent to AI providers.1415SOLUTION:16- Use .cursorignore for .env files17- Use environment variables18- Enable Privacy Mode for sensitive code19- Never hardcode credentials20```2122### Trusting AI for Security Code23```24PITFALL:25AI-generated auth/crypto code may have flaws.26Security vulnerabilities in generated code.2728SOLUTION:29- Extra review for security code30- Use established libraries31- Security review by human expert32- Test with security tools33```3435### API Keys in Settings36```37PITFALL:38Storing API keys in settings.json.39Keys visible in plaintext.4041SOLUTION:42- Use environment variables43- Use secrets managers44- Never commit keys to repo45- Rotate keys if exposed46```
Run npx skillmds@latest add tools-only/2068-security-pitfalls-abdac7c4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Security Pitfalls It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tools-only