security

Skill — Security

This skill defines how to handle security on a project using Lytos. An agent loaded with this skill knows how to identify vulnerabilities, apply secure coding patterns, and enforce security best practices across any language.

---

When to invoke this skill

• When writing code that handles user input, authentication, or authorization
• During a code review — check for OWASP Top 10 vulnerabilities
• When adding dependencies — audit for known vulnerabilities
• When configuring servers, APIs, or deployment pipelines
• After a security incident — fix the flaw and harden the surrounding code

---

Procedure

1. OWASP Top 10 — common vulnerabilities

For each vulnerability, know the bad pattern and the fix.

Injection (SQL, command)

# BAD — SQL injection
query = f"SELECT * FROM users WHERE name = '{user_input}'"
cursor.execute(query)

# GOOD — parameterized query
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))

// BAD — command injection
const output = execSync(`ls ${userInput}`);

// GOOD — avoid shell, pass args as array
const output = execFileSync('ls', [userInput]);

Broken authentication

# BAD — MD5 for passwords
import hashlib
hashed = hashlib.md5(password.encode()).hexdigest()

# GOOD — bcrypt with salt
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

// BAD — plain comparison, timing attack
if (token === storedToken) { /* ... */ }

// GOOD — constant-time comparison
const crypto = require('crypto');
if (crypto.timingSafeEqual(Buffer.from(token), Buffer.from(storedToken))) { /* ... */ }

Sensitive data exposure

// BAD — logging sensitive data
log.Printf("User login: email=%s password=%s", email, password)

// GOOD — never log secrets
log.Printf("User login: email=%s", email)

// BAD — exposing stack traces to the user
ini_set('display_errors', 1);

// GOOD — log errors, show generic message
ini_set('display_errors', 0);
ini_set('log_errors', 1);