catpilotai
- 19 skills
- 0 followers
- 4 hours ago last updated
- ▌ Supply Chain · catpilotaiBlock typosquats, unpinned dependencies, floating GitHub Actions tags, `curl | bash` installs, unverified agent skills/MCP servers, and post-install scripts from unknown publishers before they reach a developer machine, a CI runner, or a production image. Require lockfile-based installs, SHA-pinned third-party actions, registry-namespace verification, and provenance checks (Sigstore, npm provenance, GitHub attestations) for any code that will run.
- ▌ Catpilot Safe Building · catpilotai bundlePlain-language security guidance for anyone building an app, automation, dashboard, or data tool with an AI assistant, whether or not they can read code. Use whenever the conversation is about building, connecting, deploying, or sharing something that touches company data or company systems. Eight checkpoints: data in prompts, access and identity, hosting, sharing and publishing, keys and credentials, third-party services, untrusted input, and when to ask a human. Advisory guidance the assistant reads; not monitoring, not enforcement, and not a review of the app.
- ▌ Catpilot Security Core · catpilotai bundleCatpilot's universal AI-coding-agent security baseline: advisory guardrails across nine components: cloud CLI mutations, database state changes, local CLI destruction, Docker container builds, hardcoded secrets, secrets management, supply-chain integrity, PII / test-data hygiene, and language-agnostic secure-coding patterns (SQL injection, command injection, XSS, path traversal, insecure deserialization, eval-class APIs, SSRF). Intended to apply on every code generation, file write, and shell command in a host that has loaded it. Born from real production incidents. Guidance the agent reads, not a runtime control.
- ▌ Docker Safety · catpilotaiBlock container runtime escape paths, root-by-default images, build-time secrets baked into layers, and supply-chain risks from floating base tags before they reach a registry or a host. Require non-root `USER`, digest-pinned base images, BuildKit secret mounts (never `ENV`/`ARG` for secrets), `--no-install-recommends` + cache cleanup, and refuse `--privileged`, `--net=host`, `--pid=host`, host root bind-mounts, and `chmod 777` inside containers.
- ▌ Database Safety · catpilotaiRequire preview-before-modify, row-count disclosure, transactional execution, and rollback preparation before any SQL or ORM operation that mutates data or schema. Block destructive statements without a WHERE clause, schema drops without confirmation, prod migrations without dry-run, and raw string interpolation into queries. Covers PostgreSQL, MySQL, SQL Server, SQLite, and ORM equivalents.
- ▌ Secret Blocking · catpilotaiDetects and blocks hardcoded secrets — API keys, tokens, private keys, and database connection strings — before they are written to disk, committed to git, or echoed to logs. Covers 40+ patterns across Stripe, AWS, GitHub, GitLab, OpenAI, Anthropic, Slack, Google, SendGrid, Mailgun, Square, Twilio, and generic credential formats. Apply on every file write, every diff review, and every shell command that emits configuration.
- ▌ Cloud CLI Safety · catpilotai bundleRequire query-before-modify, full-command display, explicit confirmation, and rollback preparation before any cloud CLI invocation that mutates infrastructure. Covers Azure (`az`), AWS (`aws`), GCP (`gcloud`, `gsutil`), Kubernetes (`kubectl`, `helm`), and Terraform/IaC (`terraform`). Born from a real production incident where a partial-YAML container update wiped every environment variable on a live service.
- ▌ Local CLI Safety · catpilotaiBlock irreversible filesystem operations, history-destroying git commands on shared branches, network exposure to non-loopback interfaces, world-readable credential paths, and credential exfiltration patterns before they run on a developer or CI machine. Covers `rm`/`find -delete`/`dd`/`chmod -R`, `git push --force`/`reset --hard`/`clean -fd` on protected branches, `--bind 0.0.0.0` services, and patterns that pipe `~/.ssh`, `~/.aws`, or environment variables into external requests.
- ▌ Language Baseline · catpilotaiBlock the language-agnostic classes of injection and arbitrary-code-execution failures — SQL via string concatenation, command injection via shell-true subprocess calls, XSS via `innerHTML`/`document.write`, path traversal via unvalidated filenames, insecure deserialization (`pickle`, unsafe `yaml.load`, PHP `unserialize`, Java `ObjectInputStream`, Ruby `Marshal`), dynamic code execution (`eval`, `Function`, `setTimeout(string)`), TypeScript `as any` escape hatches, and SSRF via unvalidated outbound URLs.
- ▌ Pii And Test Data · catpilotaiBlock real customer data from appearing in test fixtures, code comments, documentation, debug output, or shared transcripts. Require synthetic generators (`faker`, `@faker-js/faker`, provider test cards), reserved test ranges (555 phone numbers, `@example.com` emails, RFC 5737 IPs), and redaction of PII/PHI/PCI from logs and error messages. Refuse to copy production rows into development environments under any framing.
- ▌ Secrets Management · catpilotaiGovern how secrets are stored, scoped, distributed, rotated, and surfaced to running code — never committed `.env` files, never echoed in CI logs, never embedded in URLs or error messages, never shared across environments. Complements `secret-blocking` (which detects hardcoded patterns at write time) by enforcing the lifecycle around already-secured secrets — `.gitignore` hygiene, CI log redaction, vault-backed access, scoped credentials per environment, and a documented response when exposure happens.
- ▌ Data In Prompts · catpilotaiBefore any real information goes into a prompt, a file upload, or a test, help the person use made-up or masked data instead. Refuse to continue with card numbers, government IDs, health records, or credentials, and say why in one sentence.
- ▌ Untrusted Input · catpilotaiIf the app takes input from people, documents, emails, or web pages, treat that input as untrusted. The app follows the company's instructions, never the input's; user text never becomes a raw command; and blank, wrong, or unusual entries get a calm, helpful response.
- ▌ Access And Identity · catpilotaiDefault every app to the company's own sign-in and the smallest audience that needs it. Ask who should be able to open it, and flag public links, shared passwords, and everyone-can-see settings before they are chosen.
- ▌ When To Ask A Human · catpilotaiExplicit triggers to stop and ask for a security review, including real customer or employee data, external users, payments, health data, anything that writes to a system of record, and anything the person cannot explain. Give the person a two-sentence summary to send.
- ▌ Keys And Credentials · catpilotaiNever let a password, API key, token, or connection string be pasted into a prompt, a file, or generated code. Use the company's approved way to connect, use obvious placeholders in examples, and treat anything already pasted as exposed.
- ▌ Third Party Services · catpilotaiTreat any new software service, plugin, connector, extension, or AI model endpoint as an approval question, not a convenience. Check the company's approved list first, and explain in one sentence what a new service would receive.
- ▌ Sharing And Publishing · catpilotaiBefore anything is published, shared, embedded, or sent, check for company data in the output, public link settings, and screenshots that leak. Start with a small private preview and keep a way back to the last working version.
- ▌ Hosting And Where It Runs · catpilotaiAsk where the finished app, automation, or dashboard will live before it is built, and steer to the company's approved hosting. Flag personal accounts, free tiers, trial workspaces, and unmanaged servers.