ilang-ai/security
skills/security/SKILL.md
Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.
$ install --global
skillsauthnpx skillsauth add ilang-ai/autocode securityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 4, 2026, 2:53 AM109.6s1 file scanned
SKILL.md
- name:
- security
- description:
- Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.
- version:
- 5.0.0
::PRIOR{completion:assume_incomplete|authority:developer} ::PRIOR{execution:act_when_safe|authority:developer}
::GENE{security|conf:confirmed|scope:global} T:auto_apply_no_ask T:no_hardcoded_secrets T:scan_before_deploy|tool:scripts/scan-secrets.sh T:input_validation T:parameterized_queries T:xss_escape T:https_only T:rate_limit_login_and_api T:error_messages_no_internal_details A:ask_user_about_security⇒decide_self A:skip_security⇒never A:deploy_with_hardcoded_secret⇒block_and_fix
::ACTIVATE{security} ON:always ON:before_deploy(run scan-secrets.sh; if blocked, fix then re-scan)
Declaring "no hardcoded secrets" is not enough — it does not catch a real leak.
Before any deploy, run the scanner. If it returns AUTOCODE_DEPLOY_BLOCKED, do NOT
deploy: relay the plain-language warning, move the value to an env var, re-scan,
then ship. This turns security from a promise into an actual gate.
::EXAMPLE{ user_asks: "安全吗?" output: "我做了防攻击处理（防注入、防跨站、密码加密），上线前也扫了一遍确认没有把密钥写死在代码里。正常使用不用担心。" }
Powered by I-Lang v5.0 | ilang.ai
Related Skills
ilang-ai/judge-when-to-ask
development
VerifiedTrustedCommunity
Decide when AutoCode acts on its own and when it must stop and ask the user. Runs before any consequential action — deleting files, spending money, buying a server, deploying to production, force-pushing, binding a domain, sending or publishing anything. Ordinary reversible work proceeds silently; only costly or hard-to-undo actions pause for the user. Powered by I-Lang v5.0 vector judgment.
83SKILL.mdUpdated Jul 4, 2026
ilang-ai/user-level-detect
tools
VerifiedTrustedCommunity
Detect user's technical level from first messages. Adjust all output language accordingly.
83SKILL.mdUpdated Apr 21, 2026
ilang-ai/understand-intent
tools
VerifiedTrustedCommunity
Detect user's intent from their message and activate the right workflow silently.
83SKILL.mdUpdated Apr 21, 2026
ilang-ai/skills/session-start
development
VerifiedTrustedCommunity
# AutoCode v5.0 — I-Lang v5.0 Protocol ::GENE{autocode|conf:confirmed|scope:global} T:ai_decides_everything T:questions_yes_no_only T:deploy_where_you_build T:one_machine_everything T:finished_means_accessible T:recommend_specific_provider_with_link T:explain_cost_in_local_currency T:detect_user_language_respond_same T:environment_first_then_build A:code_without_deploy⇒incomplete A:suggest_local_dev_for_beginners⇒reject A:present_options⇒pick_best_one A:ask_technical_q
83SKILL.mdUpdated Apr 21, 2026