Validates that all code changes follow Hack23 ISMS security architecture principles, ensures SECURITY_ARCHITECTURE.md and FUTURE_SECURITY_ARCHITECTURE.md are maintained, and enforces security-by-design practices across the codebase.
This skill ensures that all code changes in Black Trigram comply with Hack23 AB's Information Security Management System (ISMS) and maintain the required security architecture documentation.
Automatically trigger this skill when:
ALWAYS apply these principles:
✅ Defense in Depth
✅ Least Privilege
✅ Secure by Default
✅ Separation of Concerns
ALL security-related changes MUST update:
Document the current state of:
Document planned improvements for:
Always reference applicable ISMS policies:
| Policy | When to Reference | |--------|------------------| | Information Security Policy | All security-related changes | | Secure Development Policy | Code development and review | | Vulnerability Management | Security vulnerabilities | | Access Control Policy | Authentication/authorization | | Cryptography Policy | Encryption and key management |
Before approving any security-related change:
Immediately flag and reject these patterns:
❌ Hard-coded Secrets
// BAD: Never commit secrets
const API_KEY = "sk-1234567890abcdef";
❌ Weak Cryptography
// BAD: Don't use weak algorithms
crypto.createHash('md5').update(password).digest('hex');
❌ SQL Injection Risk
// BAD: Never concatenate user input in queries
const query = `SELECT * FROM users WHERE id = ${userId}`;
❌ XSS Vulnerability
// BAD: Never insert unescaped user content
element.innerHTML = userContent;
❌ Insecure Randomness
// BAD: Don't use Math.random() for security
const token = Math.random().toString(36);
Enforce these secure patterns:
✅ Environment Variables for Secrets
// GOOD: Use environment variables
const apiKey = process.env.VITE_API_KEY;
if (!apiKey) throw new Error('API key not configured');
✅ Strong Cryptography
// GOOD: Use modern, strong algorithms
import { webcrypto } from 'crypto';
const hash = await webcrypto.subtle.digest('SHA-256', data);
✅ Parameterized Queries
// GOOD: Use parameterized queries
const result = await db.query(
'SELECT * FROM users WHERE id = ?',
[userId]
);
✅ Context-Aware Output Encoding
// GOOD: Escape based on context
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(userContent);
✅ Cryptographically Secure Random
// GOOD: Use crypto for security-critical randomness
import { randomBytes } from 'crypto';
const token = randomBytes(32).toString('hex');
IF (code change affects security)
THEN (SECURITY_ARCHITECTURE.md MUST be updated)
ELSE (reject the change)
IF (new secret or credential is needed)
THEN (use environment variable OR secret management service)
ELSE (reject the hard-coded secret)
IF (security control added or modified)
THEN (security tests MUST be added or updated)
ELSE (change is incomplete)
IF (security-related change)
THEN (reference applicable ISMS policy in PR description)
ELSE (add policy reference before approval)
This skill enforces controls from:
Security is not optional. Every line of code must be secure by design.
When in doubt about security implications:
흑괘의 보안을 지켜라 - Protect the Security of the Black Trigram
npx skills add Hack23/security-architecture-validation下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer