Skills security-patterns

📦

security-patterns

Name: security-patterns
Author: 0xDarkMatter

Content revision r1 Critical 🌐 Network access🔑 Env variables⚙️ External commands⚡ Contains scripts📁 Filesystem access

Review Code with Security Patterns

Security reviews can miss common web application risks when guidance is scattered. This skill gives Claude, Codex, and Claude Code a focused OWASP-based checklist with examples and local audit scripts.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "security-patterns" from https://skillstore.io/skills/0xdarkmatter-security-patterns.md and its manifest at https://skillstore.io/api/skills/0xdarkmatter-security-patterns/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/0xdarkmatter-security-patterns.md Signed manifest GET /api/skills/0xdarkmatter-security-patterns/manifest Signed lockfile GET /api/skills/0xdarkmatter-security-patterns/lockfile

Test it

Using "security-patterns". Review this API endpoint for security risks.

Expected outcome:

Access control needs a server-side owner check before returning the record.
The SQL query should use parameters instead of string formatting.
Add a rate limit if this endpoint can trigger expensive work.

Using "security-patterns". Check our web security headers.

Expected outcome:

Add a restrictive Content-Security-Policy with default-src self.
Enable HSTS after confirming HTTPS works for all subdomains.
Remove X-Powered-By and test the deployed headers with a scanner.

Using "security-patterns". Review our password storage approach.

Expected outcome:

Use bcrypt, Argon2, or scrypt with a current work factor.
Do not use MD5 or SHA1 for password hashing.
Store reset tokens as hashes and expire them after a short time.

Security Audit

Critical

v9 • 7/9/2026 Open versioned report

The skill is primarily defensive security documentation with local scanning scripts. Most static findings are false positives caused by intentionally unsafe examples, scanner regexes, or standard audit commands, but several copyable unsafe examples remain confirmed risks for marketplace presentation.

Files scanned

1,561

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

references/owasp-detailed.md:251

Python pickle deserialization (RCE risk)

data = pickle.loads(user_input) # RCE vulnerability!

The line intentionally shows pickle.loads(user_input) and labels it an RCE vulnerability. Although educational, it is dangerous copyable code and should be minimized or made non-runnable.

High

references/crypto-patterns.md:285

Weak cryptographic algorithm

hash = hashlib.md5(password.encode())

The line intentionally demonstrates MD5 password hashing as a wrong pattern. It is educational but dangerous if copied without context, so it should remain flagged for remediation.

High

references/owasp-detailed.md:64

Weak cryptographic algorithm

password_hash = hashlib.md5(password.encode()).hexdigest()

The line intentionally demonstrates MD5 password hashing as a wrong pattern. It is educational but dangerous if copied without context, so it should remain flagged for remediation.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/owasp-detailed.md:109

Python os.system

os.system(f"ping {host}")

The example explicitly labels os.system(f"ping {host}") as command injection. It is educational, but marketplace content still contains dangerous copyable code and should be rewritten or fenced with stronger warnings.

High

SKILL.md:121

Generic API/secret keys

API_KEY = "sk-1234567890abcdef"

The skill includes a fake API key as a wrong example. The value appears non-real, but realistic secret-shaped examples can train unsafe copying and trigger secret scanners.

Medium

SKILL.md:60

innerHTML assignment (XSS risk)

element.innerHTML = userInput;

The skill includes a direct innerHTML assignment as a wrong XSS example. It is educational, but copyable unsafe JavaScript can mislead users if extracted from context.

Risk Factors

🌐 Network access (14)

references/auth-patterns.md:173 references/auth-patterns.md:174 references/auth-patterns.md:175 references/owasp-detailed.md:314 references/owasp-detailed.md:322 references/owasp-detailed.md:315 references/owasp-detailed.md:328 references/owasp-detailed.md:53 references/secure-headers.md:8 references/secure-headers.md:60 references/secure-headers.md:66 references/secure-headers.md:222 references/secure-headers.md:225 references/secure-headers.md:228

🔑 Env variables (22)

⚙️ External commands (32)

⚡ Contains scripts (5)

references/secure-headers.md:47 scripts/security-scan.sh:41 scripts/security-scan.sh:54 scripts/security-scan.sh:42 SKILL.md:60

📁 Filesystem access (10)

scripts/dependency-audit.sh:19 scripts/dependency-audit.sh:22 scripts/dependency-audit.sh:36 scripts/dependency-audit.sh:47 scripts/dependency-audit.sh:61 scripts/dependency-audit.sh:75 scripts/security-scan.sh:26 scripts/security-scan.sh:28 scripts/security-scan.sh:72 scripts/security-scan.sh:74

Detected Patterns

Weak cryptographic algorithm×2Python pickle deserialization (RCE risk)

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/0xdarkmatter-security-patterns/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/0xdarkmatter-security-patterns/security.svg)](https://skillstore.io/skills/0xdarkmatter-security-patterns?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/0xdarkmatter-security-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/0xdarkmatter-security-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/0xdarkmatter-security-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

0xDarkMatter. (2026). security-patterns security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/0xdarkmatter-security-patterns/audits/9

BibTeX citation

@techreport{0xdarkmatter-0xdarkmatter-security-patterns-2026,
  author = {0xDarkMatter},
  title = {security-patterns security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/0xdarkmatter-security-patterns/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-patterns security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "0xDarkMatter"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/0xdarkmatter-security-patterns/audits/9"
identifiers:
  - type: other
    value: "skillstore:0xdarkmatter-security-patterns:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a web feature before merge

Use the OWASP checklist to inspect access control, injection, authentication, logging, and SSRF risks before approving code.

Harden application defaults

Apply secure header, session, and cookie guidance when preparing a service for production.

Teach secure implementation patterns

Compare unsafe and safer examples for authentication, cryptography, and input handling during code coaching.

Try These Prompts

Check one feature

Use the security-patterns skill to review this feature for OWASP Top 10 risks. Focus on input validation, authorization, and secrets.

Review authentication code

Use the authentication patterns to review this login and session code. Check password hashing, cookies, rate limiting, JWT handling, and account lockout.

Audit cryptography choices

Use the crypto patterns to evaluate this encryption and signing code. Identify weak algorithms, key storage problems, nonce reuse, and unsafe custom crypto.

Run a structured security pass

Use this skill as a pre-release checklist. Review OWASP risks, security headers, dependency exposure, secrets handling, and provide prioritized remediation steps.

Best Practices

Start with the OWASP checklist, then inspect framework-specific details in the reference files.
Treat every unsafe example as a pattern to remove, not a template to copy.
Run dependency and grep scripts only on trusted local repositories and review results manually.

Avoid

Do not assume the scanner output is complete or free of false positives.
Do not paste wrong examples into production code without the surrounding warning context.
Do not use the skill as a substitute for testing authorization, authentication, and cryptographic behavior.