← All skills
security-best-practices
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By lev-os/agents (GitHub) · coding · 27 stars · scanned at commit 201a805
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 24 places.
Show 17 more
- skills-db/security/security-best-practices/references/javascript-express-web-server-security.md, line 143
* Identify “untrusted-to-sink” flows: request → sink (`res.redirect`, SQL execution, `sendFile`, `child_process`, template render, outbound fetch). - skills-db/security/security-best-practices/references/javascript-express-web-server-security.md, line 780
* MUST avoid `exec()` / `execSync()` with attacker-influenced strings - skills-db/security/security-best-practices/references/javascript-express-web-server-security.md, line 794
* Search for `child_process`, `exec(`, `execSync(`, `spawn(`, `fork(`. - skills-db/security/security-best-practices/references/javascript-express-web-server-security.md, line 1082
* `child_process.exec` / `execSync` / `shell: true` ([OWASP Cheat Sheet Series][14]) - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 872
* Search for `child_process`, `exec`, `spawn`, `shell: true`. - skills-db/security/security-best-practices/references/python-django-web-server-security.md, line 499
* MUST NOT use `shell=True` with attacker-influenced content. - skills-db/security/security-best-practices/references/python-django-web-server-security.md, line 505
* `os.system(request.GET["cmd"])` - skills-db/security/security-best-practices/references/python-django-web-server-security.md, line 506
* `subprocess.run(f"convert {path}", shell=True)` where `path` is user-controlled. - skills-db/security/security-best-practices/references/python-django-web-server-security.md, line 510
* Search `os.system`, `subprocess`, `Popen`, `shell=True`. - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 780
* MUST NOT use `shell=True` with attacker-influenced strings - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 785
* `os.system(user_input)` - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 786
* `subprocess.run(f"cmd {user}", shell=True)` - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 787
* Passing user strings into `bash -c`, `sh -c`, PowerShell, etc. - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 791
* Search for `os.system`, `subprocess`, `Popen`, `shell=True`. - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 944
* `subprocess.*`, `shell=True`, `os.system` ([OWASP Cheat Sheet Series][22]) - skills-db/security/security-best-practices/references/python-flask-web-server-security.md, line 500
- MUST NOT use `shell=True` with attacker-influenced strings - skills-db/security/security-best-practices/references/python-flask-web-server-security.md, line 506
- `os.system(user_input)`
and 4 more places
Connects to the internet
This is disclosed by the author in the skill's SKILL.md or README.
Found in 23 places.
Show 17 more
- skills-db/security/security-best-practices/references/javascript-jquery-web-frontend-security.md, line 329
* SHOULD prefer `fetch()`/XHR to retrieve data, then render with safe DOM creation or sanitize explicitly. - skills-db/security/security-best-practices/references/javascript-jquery-web-frontend-security.md, line 346
* `fetch()` to retrieve JSON, then render via `.text()` / node construction, or - skills-db/security/security-best-practices/references/javascript-jquery-web-frontend-security.md, line 347
* `fetch()` to retrieve HTML, sanitize it, then inject. - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 715
* MUST treat any server-side `fetch()` to a user-provided URL as high-risk. - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 726
* `await fetch(req.query.url)` or `await fetch((await request.json()).url)` - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 731
* Search for `fetch(` in server code and trace where the URL comes from. - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 977
* Blindly cloning all request headers to an outbound `fetch()` call. - skills-db/security/security-best-practices/references/javascript-typescript-nextjs-web-server-security.md, line 1083
* `fetch(userProvidedUrl)` from Route Handlers / Server Actions - skills-db/security/security-best-practices/references/javascript-typescript-react-web-frontend-security.md, line 83
* State changes are often triggered by `fetch/axios` calls or form submissions. If authentication is cookie-based, these calls can be CSRF-relevant (§4 REACT-CS - skills-db/security/security-best-practices/references/javascript-typescript-react-web-frontend-security.md, line 564
* `fetch('/api/transfer', { method: 'POST', credentials: 'include' })` with no CSRF token/header, relying only on cookies. - skills-db/security/security-best-practices/references/javascript-typescript-react-web-frontend-security.md, line 635
* `fetch(userProvidedUrl, { credentials: 'include' })` - skills-db/security/security-best-practices/references/javascript-typescript-react-web-frontend-security.md, line 636
* `axios.create({ baseURL: userProvidedBase })` - skills-db/security/security-best-practices/references/javascript-typescript-react-web-frontend-security.md, line 641
* Search for `fetch(` / `axios(` where the first argument or `baseURL` is derived from: - skills-db/security/security-best-practices/references/javascript-typescript-vue-web-frontend-security.md, line 66
* Anything from APIs: `fetch`, `axios`, GraphQL responses, webhooks, third-party SDKs. - skills-db/security/security-best-practices/references/javascript-typescript-vue-web-frontend-security.md, line 503
* `fetch(url, { credentials: 'include', method: 'POST', body: ... })` with no CSRF token/header usage anywhere. - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 817
* `httpx.get(request.query_params["url"])` - skills-db/security/security-best-practices/references/python-fastapi-web-server-security.md, line 947
* `httpx.get/post` or `requests.*` with URL from request/DB, no allowlist/timeouts ([OWASP Cheat Sheet Series][23])
and 3 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'security-best-practices' ] || [ -L ~/.agents/skills/'security-best-practices' ]; then echo 'A skill folder named security-best-practices already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/lev-os/agents' "$d" && git -C "$d" checkout --quiet '201a80515e1dc58addfda3cd9978907de2c944a6' -- 'skills-db/security/security-best-practices' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills-db/security/security-best-practices' ~/.agents/skills/'security-best-practices' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security-best-practices' ~/.claude/skills/'security-best-practices' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for lev-os/agents shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/lev-os/agents/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | 201a805 | 92 |