Imported from huseyineroglu-16/-znik-tarihi-rehberi (.opencode/skills/project-security-rules/SKILL.md). Install upstream with npx skills add huseyineroglu-16/-znik-tarihi-rehberi --skill project-security-rules. Copyright stays with the author.

Project Security Rules

Name: project-security-rules
Author: huseyineroglu-16

Use for every implementation/review task.

MUST:

Treat spec.md as the source of truth.
Validate untrusted input server-side.
Authorize server-side; default deny.
Return published content only from public APIs.
Keep secrets server-side.
Audit privileged state-changing admin actions.
Use safe error responses.
Apply rate limiting where required.
Preserve privacy and minimize PII.
Fail closed on security failures.

MUST NOT:

Client-only authorization
Raw SQL concatenation
eval/dynamic code execution
unsanitized HTML
arbitrary server-side URL fetch
arbitrary redirect
production HTTP
secrets in client/localStorage/logs
uploaded executable content
client-controlled sponsor boost

Done requires applicable security and acceptance criteria.

{ "ocm": "1", "id": "huseyineroglu-16-znik-tarihi-rehberi-project-security-rules", "kind": "skill", "name": "project-security-rules", "description": "Mandatory project-wide security invariants from spec.md.", "publisher": "huseyineroglu-16", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Mandatory project-wide security invariants from spec.md." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/huseyineroglu-16/-znik-tarihi-rehberi", "path": ".opencode/skills/project-security-rules/SKILL.md", "ref": "ed954a02ce6a1c1e3f7930f588934488129132b4", "url": "https://github.com/huseyineroglu-16/-znik-tarihi-rehberi/blob/ed954a02ce6a1c1e3f7930f588934488129132b4/.opencode/skills/project-security-rules/SKILL.md", "key": "huseyineroglu-16/-znik-tarihi-rehberi/.opencode/skills/project-security-rules/SKILL.md" } }, "instructions": "# Project Security Rules\n\nUse for every implementation/review task.\n\nMUST:\n- Treat spec.md as the source of truth.\n- Validate untrusted input server-side.\n- Authorize server-side; default deny.\n- Return published content only from public APIs.\n- Keep secrets server-side.\n- Audit privileged state-changing admin actions.\n- Use safe error responses.\n- Apply rate limiting where required.\n- Preserve privacy and minimize PII.\n- Fail closed on security failures.\n\nMUST NOT:\n- Client-only authorization\n- Raw SQL concatenation\n- eval/dynamic code execution\n- unsanitized HTML\n- arbitrary server-side URL ", "cost": { "context_tokens": 201 } }

project-security-rules

About

Project Security Rules

Use it

Manifest

Reviews