kpeacocke-attest-security-instructions.ocm.json json {
"ocm": "1",
"id": "kpeacocke-attest-security-instructions",
"kind": "skill",
"name": "security",
"description": "Use when changing dependency definitions, command execution, file handling, evidence capture, report content, CI security scanning, or anything with security impact. Covers Snyk, SonarQube, redaction, and safe coding expectations.",
"publisher": "kpeacocke",
"version": "1.0.0",
"capabilities": {
"domains": [
"general"
],
"tags": [
"skill-md",
"github-instructions"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Use when changing dependency definitions, command execution, file handling, evidence capture, report content, CI security scanning, or anything with security impact. Covers Snyk, SonarQube, redaction, and safe coding expectations."
],
"primary": false,
"metadata": {
"source": {
"provider": "github-instructions",
"repository": "https://github.com/kpeacocke/attest",
"path": ".github/instructions/security.instructions.md",
"ref": "ec1d1e12e961b9ba27450a503bc073c8054c6d0f",
"url": "https://github.com/kpeacocke/attest/blob/ec1d1e12e961b9ba27450a503bc073c8054c6d0f/.github/instructions/security.instructions.md",
"key": "kpeacocke/attest/.github/instructions/security.instructions.md"
}
},
"instructions": "# Security Guidance\n\n- Run or request Snyk scanning for new or changed first-party code and dependency updates where the tooling is available.\n- Review SonarQube findings for changed files and fix newly introduced security or maintainability issues.\n- Treat command execution, file parsing, and report generation as hostile-input surfaces.\n- Redact or truncate secrets, credentials, tokens, private keys, and sensitive host evidence.\n- Prefer safe standard-library helpers over shelling out.\n- Validate paths and inputs before reading files, invoking commands, or writing artefacts.\n- Do not add broa",
"cost": {
"context_tokens": 167
}
}