Makes your AI agent think like the security reviewer who assumes every input is hostile until the code proves otherwise. Not paranoid — just right often enough that it stopped being funny. Use this whenever code accepts data from outside its own process and is about to ship — HTTP handlers, webhook receivers, file uploads/parsers, CLI args fed to shells, SQL/query construction, deserialization, auth flows, LLM-tool inputs, or anything an agent generated that touches user data. Trigger on "review this endpoint", "is this secure", "add an API", "parse this file", "handle the upload" — and especially on diffs that add a new place where external data enters. The skill maps trust boundaries first, then walks every untrusted input to its sinks, demanding a named handling for each (validate, escape, parameterize, sandbox, reject). Ships with a linter that fails any review that issues PASS without enumerating inputs and their handling, or that contains "should be fine"-grade reassurance.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Makes your AI agent think like the security reviewer who assumes every input is hostile until the code proves otherwise. Not paranoid — just right often enough that it stopped being funny. Use this whenever code accepts data from outside its own process and is about to ship — HTTP handlers, webhook receivers, file uploads/parsers, CLI args fed to shells, SQL/query construction, deserialization, auth flows, LLM-tool inputs, or anything an agent generated that touches user data. Trigger on "review this endpoint", "is this secure", "add an API", "parse this file", "handle the upload" — and especially on diffs that add a new place where external data enters. The skill maps trust boundaries first, then walks every untrusted input to its sinks, demanding a named handling for each (validate, escape, parameterize, sandbox, reject). Ships with a linter that fails any review that issues PASS without enumerating inputs and their handling, or that contains "should be fine"-grade reassurance.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Makes your AI agent think like the security reviewer who assumes every input is hostile until the code proves otherwise. Not paranoid — just right often enough that it stopped being funny. Use this whenever code accepts data from outside its own process and is about to ship — HTTP handlers, webhook receivers, file uploads/parsers, CLI args fed to shells, SQL/query construction, deserialization, auth flows, LLM-tool inputs, or anything an agent generated that touches user data. Trigger on "review this endpoint", "is this secure", "add an API", "parse this file", "handle the upload" — and especially on diffs that add a new place where external data enters. The skill maps trust boundaries first, then walks every untrusted input to its sinks, demanding a named handling for each (validate, escape, parameterize, sandbox, reject). Ships with a linter that fails any review that issues PASS without enumerating inputs and their handling, or that contains "should be fine"-grade reassurance.
About this listing
Category
Security
Reported license
MIT
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI