secure-coding
Comprehensive secure coding practices covering input validation, authentication, authorization, cryptography, secrets management, and error handling. Provides actionable code examples and checklists for building security into every stage of development.
Profile →npx skills add cosmicstack-labs/mercury-agent-skills --skill secure-coding --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Describes a set of secure coding practices across input validation, authentication, authorization, cryptography, secrets management, and error handling, including practical code examples and a comprehensive checklist for secure development.
How it works
The skill provides concrete patterns and code samples for:
- Input validation, including allowlist concepts, sanitization, parameterized queries, and file upload validation.
- Authentication, covering password hashing (bcrypt/argon2/scrypt), JWT handling (RS256/ES256, token claims, revocation considerations), OAuth2 best practices, and session management with cookie security and session rotation.
- Authorization using RBAC and ABAC examples, plus enforcing least privilege for service accounts and API keys.
- Cryptography guidance, ensuring TLS, HSTS, data encryption at rest and in transit, and secrets management (keys in a secrets manager).
- Error handling, with user-friendly messages and server-side detailed logging, avoiding information leakage.
- Output encoding to prevent XSS across HTML, JavaScript, and URL contexts. The material is presented as code snippets, configuration-style rules, and checklists that a developer would apply during review and implementation.
When to use it
Use whenever designing or reviewing secure coding practices in a project, especially for input handling, authentication/authorization flows, cryptography usage, secret management, and error handling strategies.
What it can touch
Inputs for code examples include sample Python, JavaScript, and general security patterns. It references libraries like bcrypt, argon2, scrypt, HTML escaping, and typical web stack patterns. The skill declares one tool: "claude-code".
Caveats
No explicit licensing or risk statements beyond the MIT license noted in the metadata. The skill emphasizes secure defaults and defense-in-depth but does not guarantee vulnerability-free implementations; it provides patterns and checklists to mitigate common issues.
# Secure Coding Skill Writing code that is resistant to attack requires intentional practices at every layer. This skill covers the fundamental security patterns every developer should implement: input validation, authentication, authorization, cryptography, secrets management, and error handling. --- ## Core Principles ### 1. **Never Trust User Input** All input is guilty until proven innocent. Validate, sanitize, and parameterize every piece of data that crosses a trust boundary — HTTP requests, file uploads, database queries, API calls, message queue payloads. ### 2. **Fail Securely** When something goes wrong, the default behavior should be denial, not access. An error should reject the request, log the event, and return minimal information to the user. ### 3. **Defense in Depth** No single control is sufficient. If input validation fails, parameterized queries should prevent injection. If authentication is bypassed, authorization should block access. Layer your defenses. ### 4. **Keep Security Simple** Complex cryptography, custom authentication schemes, and convoluted permission models are more likely to have bugs. Use well-vetted libraries. Do not roll your own crypto. ### 5
- Core Principles
- 1. Never Trust User Input
- 2. Fail Securely
- 3. Defense in Depth
- 4. Keep Security Simple
- 5. Least Privilege
- 6. Secure by Default
- 7. Don't Expose Internals
- Secure Coding Checklist
- Pre-Commit
- Authentication
- Authorization
- Cryptography
- Error Handling
service-account.json credentials.json Pre-commit hook (truffleHog / Gitleaks) Scan entire git history gitleaks detect --source . --report-path gitleaks-report.json --verbose
What does the secure-coding skill do?
Comprehensive secure coding practices covering input validation, authentication, authorization, cryptography, secrets management, and error handling. Provides actionable code examples and checklists for building security into every stage of development.
How do I install it?
Run `npx skills add cosmicstack-labs/mercury-agent-skills --skill secure-coding --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From cosmicstack-labs/mercury-agent-skills, a repository with 364 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.