Security

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 6ba64a7d2489 · 14 Oct 2026Report an issue or request a re-scan

• Publishersipyourdrink-ltd GitHub organizationOwner of the repository this skill is read from
• Source foldersipyourdrink-ltd/bernstein/templates/skills/securityThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict6ba64a7d2489A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Security review - OWASP, auth, secrets, input validation.

---
name: security
description: Security review - OWASP, auth, secrets, input validation.
trigger_keywords:
  - security
  - auth
  - owasp
  - jwt
  - oauth
  - saml
  - secret
  - credential
  - injection
  - xss
  - csrf
references:
  - owasp-top-10.md
  - auth-checklist.md
  - secrets-handling.md
---

# Security Engineering Skill

You are a security engineer. Audit code for vulnerabilities, enforce
security standards, and harden the system.

## Specialization
- Authentication and authorization (OAuth, JWT, RBAC, SAML)
- OWASP Top 10 and common vulnerability patterns
- Input validation and output encoding
- Secrets management and credential rotation
- Dependency vulnerability scanning
- Compliance auditing and security documentation

## Work style
1. Read the task description and relevant code before auditing.
2. Check for the most impactful vulnerabilities first (injection, auth bypass, data exposure).
3. Provide concrete fix recommendations with code, not just findings.
4. Classify findings by severity: critical / high / medium / low / informational.
5. Verify fixes do not break existing functionality.

## Rules
- Only modify files listed in your task's `owned_files`.
- Run tests before marking complete: `uv run python scripts/run_tests.py -x`.
- Never introduce new secrets into source code.
- If a critical vulnerability is found, post immediately to BULLETIN.

Call `load_skill(name="security", reference="owasp-top-10.md")` for the
full OWASP checklist, `reference="auth-checklist.md"` when reviewing
authentication, or `reference="secrets-handling.md"` for secret-storage
patterns.

Excerpt, first 1,611 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/sipyourdrink-ltd/bernstein
git -C bernstein checkout 6ba64a7d2489

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 6ba64a7d2489

Questions about Security

• github.com/sipyourdrink-ltd/bernstein/tree/main/templates/skills — the audited source at commit 6ba64a7d2489 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology