security-checklist
SkillSecurityLets your agent check a reference security checklist for guidance during reviews.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the security-checklist skill
About this capability
Security checklist to run before marking any task done
What this skill tells your AI
The instructions your AI receives, as published by albinotonnina/echos in .hive/prompts/skills/security-checklist/SKILL.md and read by ahel’s review.
Before reporting status="done", verify each item:
Input validation
- All request parameters validated with Zod or a validation library
- File uploads: type, size, and filename are validated; files stored outside webroot
- Query parameters that drive DB queries use allowlists, not blocklists
Authentication & authorisation
- Every new endpoint has an auth middleware applied
- Authorisation checks are centralised — not ad-hoc comparisons scattered in handlers
- Password fields: never returned in API responses, never logged
Data handling
- No credentials, tokens, session IDs, or PII in log messages
- No sensitive values in error messages returned to clients
- All DB queries are parameterised — no string concatenation
Transport & headers
- New endpoints inherit the global CORS policy
-
Content-Security-Policyheader still passes for any new inline scripts/styles
Rate limiting
- Unauthenticated endpoints have rate limiting applied
- Auth endpoints (
/login,/register,/reset-password) have strict rate limits (≤5 req/min)
If any item is not applicable, note why in the PR description.
Signals
- GitHub stars
- 60
- Forks
- 8
- Last commit
- Jul 2026
Advanced
- Catalog kind
- skill
- Gateway key
security-checklist- Source
- github.com/albinotonnina/echos