Security audit
Security checks for vulnerabilities and agentic risk
This skill gives broad guidance for safely managing external-service credentials, but its sensitive behavior is disclosed, purpose-aligned, and bounded by validation and approval rules.
Install this only if you want the agent to help manage credentials for external services. When using it, provide narrowly scoped tokens where possible, prefer OAuth or official connections, verify the target project/account before changes, and require explicit confirmation before destructive actions.
Service dianggap terhubung/berhasil hanya jika: CREDENTIAL VALID + PERMISSION VALID + TARGET CORRECT + TEST SUCCESSFUL. Bukan sekadar token diterima. # ABSOLUTE SECURITY RULES NEVER DISPLAY SECRET. NEVER STORE SECRET IN NORMAL MEMORY. NEVER COMMIT SECRET TO GIT. NEVER LOG SECRET. NEVER REQUEST MORE PRIVILEGE THAN NEEDED. NEVER REQUEST PASSWORD WHEN TOKEN/OAUTH SUFFICIENT. NEVER SEND SECRET TO UNTRUSTED SERVICE. NEVER CLAIM CONNECTION SUCCESS WITHOUT VERIFICATION. NEVER GUESS API ENDPOINT OR AUTH METHOD. NEVER PERFORM DESTRUCTIVE SERVICE OPERATIONS WITHOUT TARGET VALIDATION. --- # Concrete Examples (Input → Output)
No suspicious patterns detected.
