Skills no-hardcoding

📦

no-hardcoding

Name: no-hardcoding
Author: Doyajin174

v1.0 Content revision r1 Safe ⚙️ External commands🌐 Network access🔑 Env variables

Detect Hardcoded Values in Code

Hardcoded values make code harder to change and can expose secrets. This skill guides reviews toward constants, configuration files, and environment variables.

Supports: Claude Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "no-hardcoding" from https://skillstore.io/skills/doyajin174-no-hardcoding.md and its manifest at https://skillstore.io/api/skills/doyajin174-no-hardcoding/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/doyajin174-no-hardcoding.md Signed manifest GET /api/skills/doyajin174-no-hardcoding/manifest Signed lockfile GET /api/skills/doyajin174-no-hardcoding/lockfile

Test it

Using "no-hardcoding". Review a feature file with repeated status strings and numeric limits.

Expected outcome:

Flags repeated status text as a constant candidate.
Recommends named limits for user counts and timeouts.
Notes values that may be acceptable exceptions.

Using "no-hardcoding". Audit a pull request that adds API calls and credentials.

Expected outcome:

The review highlights hardcoded endpoints, secret-like values, and missing environment documentation.

Using "no-hardcoding". Plan configuration for a new integration.

Expected outcome:

The response separates public URLs, private keys, retry limits, and timeout values into appropriate configuration locations.

Security Audit

Safe

v9 • 7/6/2026 Open versioned report

The static findings are false positives caused by Markdown code fences and illustrative TypeScript or bash examples in SKILL.md. No evidence found that the skill executes commands, performs network requests, reads environment files, exfiltrates secrets, or contains prompt injection.

Files scanned

239

Lines analyzed

Review items

False positives ignored

Risk Factors

⚙️ External commands (26)

🌐 Network access (3)

SKILL.md:72 SKILL.md:76 SKILL.md:72

🔑 Env variables (23)

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/doyajin174-no-hardcoding/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/doyajin174-no-hardcoding/security.svg)](https://skillstore.io/skills/doyajin174-no-hardcoding?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/doyajin174-no-hardcoding?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doyajin174-no-hardcoding/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/doyajin174-no-hardcoding.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Doyajin174. (2026). no-hardcoding security audit report (audit version 9) [Author version 1.0]. Skillstore. https://skillstore.io/skills/doyajin174-no-hardcoding/audits/9

BibTeX citation

@techreport{doyajin174-doyajin174-no-hardcoding-2026,
  author = {Doyajin174},
  title = {no-hardcoding security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/doyajin174-no-hardcoding/audits/9},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "no-hardcoding security audit report (audit version 9)"
version: "1.0"
type: report
authors:
  - name: "Doyajin174"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/doyajin174-no-hardcoding/audits/9"
identifiers:
  - type: other
    value: "skillstore:doyajin174-no-hardcoding:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review Pull Requests

Find hardcoded limits, URLs, statuses, and secrets before changes are merged.

Build New Features

Place configurable values in constants, config files, or environment variables from the start.

Prepare Configuration Cleanup

Plan a cleanup of repeated values and undocumented environment variables across a repository.

Try These Prompts

Basic Hardcoding Review

Review this file for hardcoded values. List magic numbers, repeated strings, URLs, secrets, and suggested replacements.

Guided Refactor

Refactor this feature to move changeable values into constants, config, or environment variables. Preserve behavior and explain each moved value.

Pull Request Audit

Audit this pull request for hardcoded credentials, endpoints, ports, and business thresholds. Prioritize findings by security and maintenance impact.

Repository Policy Design

Design a no-hardcoding policy for this repository. Include folder placement, naming rules, environment validation, and review checklist items.

Best Practices

Name constants by meaning, not by current value.
Keep secret values in approved secret storage, not source files.
Update environment examples whenever required variables change.

Avoid

Leaving repeated status strings in separate modules.
Putting private API keys in client-side configuration.
Using broad search results without reviewing context.

Frequently Asked Questions

Does this skill execute code?

The skill contains guidance and example search commands. It does not include executable scripts.

Can it detect real secrets?

It can help find secret-like patterns, but dedicated secret scanning tools should verify results.

Which languages does it cover?

The examples use TypeScript, but the review principles apply to most application code.

Will it remove every hardcoded value?

No. Some values are acceptable when their meaning is obvious or conventional.

How should environment variables be handled?

Use validation, documentation, and secret storage according to your deployment platform.

Does it support Claude Code and Codex?

Yes. The report marks support for Claude, Claude Code, and Codex.

Developer Details

Author

Doyajin174

License

MIT

Author version

v1.0

Skillstore revision

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/Doyajin174/myskills/tree/main/.public/skills/no-hardcoding

Ref

72d5025b022c77f7a51bdf5c1637c689c80e89d1

Maintenance freshness

7/18/2026

Usage

3 downloads · 200 views

File structure

📄 SKILL.md