Back to catalog / Security
Security Best Practices: review the actual stack
For explicit security work, identify project languages/frameworks and load matching pinned references before advising.
Skills
This skill has a narrow trigger: the user asks for security guidance, a security review/report, or secure-by-default implementation. First inventory the relevant languages and core frameworks across frontend and backend, then read every matching language/framework reference plus any general reference in the skill’s references directory. The pinned frontmatter names Python, JavaScript/TypeScript, and Go as supported stacks; verify which framework files actually exist before making stack-specific claims. For a new web app with no chosen frontend framework, check the general frontend guidance too. If a needed reference is absent, consult reliable official guidance only as a gap fill and label uncertainty. Passive findings should focus on major risks; a requested full report should explain failures and prioritize urgency and severity. Code changes must stay within the user’s requested security work rather than turning routine debugging into an unsolicited audit.
Permissions
Prerequisites
- The user explicitly requests security guidance, a security review/report, or secure-by-default implementation; general code review and debugging are out of scope.
- Identify the main languages/frameworks and inspect the skill references for matching guidance.
Permissions
- Reads project context and relevant security references; may edit code within the requested scope when the user asks for secure-by-default implementation.
- The pinned skill lists language/framework references for Python, JavaScript/TypeScript, and Go; it may consult official online material only when references are missing.
Limitations
Trigger only for an explicit security task. Framework coverage depends on the pinned references; do not expand ordinary refactoring or debugging into an unsolicited security audit.
Pinned upstream source
- Repository
- openai/skills
- File path
- skills/.curated/security-best-practices/SKILL.md
- Pinned commit
49f948faa9258a0c61caceaf225e179651397431- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: Apache-2.0
Compatible tools
Codex · Python · JavaScript/TypeScript · Go
Main topic
Make Agent behavior safer and easier to verify