security-first

What it does

Security First is a preventive guardrail designed to bake security into the development lifecycle before the first line of code is even written. Instead of performing retrospective audits, this skill forces your AI agent to identify trust boundaries, surface security assumptions, and define verification steps during the planning phase.

Why use this skill

Standard LLMs often prioritize functionality over safety, frequently suggesting insecure defaults or overlooking edge cases like untrusted input and session handling. This skill shifts security "left" by requiring a structured analysis of the attack surface relevant to your specific task. It ensures that authentication, authorization, and data handling are treated as first-class requirements rather than afterthoughts.

Supported workflows

• Trust Boundary Mapping: Identifies actors, privileges, and sensitive data flows.
• Secure Defaults: Enforces the principle of least privilege and minimum secure design.
• Attack Surface Reduction: Evaluates webhooks, file storage, and infrastructure exposure.
• Pre-implementation Verification: Defines the exact tests needed to prove security properties.

The Output

The result is a concise, actionable security brief tailored to your current task. It avoids generic OWASP dumps in favor of specific risks, explicit assumptions, and a concrete verification plan to guide the coding process.