Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MartinOlivero/saas-builder --skill secure-codinggit clone --depth 1 https://github.com/MartinOlivero/saas-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/martinolivero/saas-builder/secure-coding)<a href="https://agentmods.dev/skills/martinolivero/saas-builder/secure-coding"><img src="https://agentmods.dev/badge/skills/martinolivero/saas-builder/secure-coding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/martinolivero/saas-builder/secure-coding"><img src="https://agentmods.dev/badge/skills/martinolivero/saas-builder/secure-coding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.01738 |
| Opus 5.5 | $0.00051 | $0.00695 |
| Sonnet 5.5 | $0.00026 | $0.00348 |
| Haiku 4.5 | $0.00013 | $0.00174 |
Grade A, and why
secure-coding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Secure Coding
This skill keeps you from introducing vulnerabilities while you build. It is prevention, not audit — it runs at the moment you write an endpoint, a form handler, or a database write, and bakes in the safe default before the bug exists.
Analogy: it is the seatbelt you put on before driving, not the crash investigator who shows up afterward. Audit tools (Trail of Bits, Semgrep, CodeQL) inspect the wreck. This skill stops the crash.
Scope
This skill is for the solo dev or small team who has no security tooling installed and just wants to ship without leaving holes. If a dedicated audit plugin is present, this skill still runs first — preventing a vuln is always cheaper than finding it later.
Trigger
Activate whenever code touches: a request handler/endpoint, user input, a database write, authentication, file uploads, secrets/env vars, CORS, or any third-party webhook. Default-deny mindset: code with no explicit security decision is the bug.
Discovery (max 3 questions, only if unknown)
- Is this endpoint/data public, authenticated, or admin-only?
- Does it touch personal data (email, name, payment, location, anything identifying a person)?
- What is the backend — serverless functions (Vercel), a Node server, or a BaaS (Supabase/InsForge)?
The OWASP Top 10, as prevention rules
Apply the matching rule the instant you write the code. Each maps an OWASP 2021 category to a concrete default.
| Risk | Prevent it by |
|---|---|
| A01 Broken Access Control | Check authorization on the server, on every endpoint. Verify the resource belongs to req.user (stop IDOR). Default-deny: no explicit check = bug. Never trust client-sent role/price/owner fields. |
| A02 Cryptographic Failures | HTTPS everywhere (free on Vercel). Hash passwords with bcrypt or argon2, never plaintext/reversible. Encrypt PII at rest. Never roll your own crypto. |
| A03 Injection | Never string-concat SQL. Parameterized queries / ORM only (pg params, Drizzle, Prisma, Kysely). Validate every input at the boundary with zod before it reaches logic or the DB. |
| A04 Insecure Design | Threat-model the feature first: who can call this, what is the worst input. Enforce limits by design — quotas, server-side amount/price checks. |
| A05 Security Misconfiguration | Add Helmet for secure headers. CORS = explicit origin allowlist (never * with credentials: true). Disable verbose error stacks in prod. |
| A06 Vulnerable Components | Pin deps, run npm audit + Dependabot, remove unused packages, update before shipping. |
| A07 Auth Failures | Use a vetted auth provider (see the auth skill). Rate-limit login routes harder. httpOnly + Secure + SameSite cookies for sessions. MFA where possible. |
| A08 Data Integrity | Verify webhook signatures (e.g. Stripe signing secret). Don't deserialize untrusted data. Commit the lockfile. |
| A09 Logging Failures | Log auth + authz denials — but never log PII, tokens, passwords, or full request bodies. Redact first. |
| A10 SSRF | Don't fetch user-supplied URLs server-side without an allowlist; block internal/metadata IP ranges. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed · +23 lines 6ae881f46b6e
- 2mo ago First seen · 71 lines · 128 tokens per session scan A 1830238eceba
secure-coding is a skill published in the GitHub repository MartinOlivero/saas-builder (5 stars, last pushed 26d ago), licensed MIT. It adds 128 tokens to every session and 1,738 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
secure-coding compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| secure-codingMartinOlivero/saas-builder | Skill | 5 | 26d ago | MIT | A | 128 | Claude Code |
| architecture-paradigm-microkernelathola/claude-night-market | Skill | 348 | yesterday | MIT | A | 32 | Claude Code |
| plugin-systemellmos-ai/skills | Skill | 9 | 4d ago | MIT | A | 27 | Claude Code, Codex |
| saas-migration-auditparisgroup-ai/imersao-ia-setup | Skill | 1 | 1mo ago | MIT | A | 90 | Claude Code |
| multi-tenancycamilooscargbaptista/cto-toolkit | Skill | 8 | 7mo ago | MIT | A | 22 | Claude Code |
| moai-ref-api-patternsmodu-ai/moai-adk | Skill | 1.3k | 4d ago | Apache-2.0 | A | 85 | Claude Code |
| flow-next-impl-reviewgmickel/flow-next | Skill | 717 | yesterday | MIT | A | 34 | Claude Code, Codex |