Claude Code Plugins

Community-maintained marketplace

Feedback

security-basics

@matt-riley/mjrwtf
0
20

Apply project-specific security and privacy guardrails (auth, headers, rate limiting, logging). Use when touching authentication, request handling, metrics exposure, or anything that could leak sensitive data.

Install Skill

Shared

Installs to .agents/skills, used by Codex, Amp, Warp, Cursor, OpenCode, and more.

CodexAmp
WarpCursorOpenCode
ClineGemini CLI
GitHub Copilot
Personal

Available across projects.

$npx skills-installer add @matt-riley/mjrwtf/security-basics --client shared
Project

Writes to .agents/skills.

$npx skills-installer add @matt-riley/mjrwtf/security-basics -p --client shared
Note: Review the skill instructions before using it.

SKILL.md

name security-basics
description Apply project-specific security and privacy guardrails (auth, headers, rate limiting, logging). Use when touching authentication, request handling, metrics exposure, or anything that could leak sensitive data.
license MIT
compatibility Applies to the mjrwtf Go server; requires bash and git for repo work.
metadata [object Object]
allowed-tools Bash(git:*) Bash(go:*) Bash(make:*) Read

Tooling assumptions

  • Use a terminal runner with bash and git available.
  • Prefer make targets when available; fall back to direct CLI commands when needed.

Authentication & secrets

  • Auth tokens: AUTH_TOKENS (preferred; comma-separated) or AUTH_TOKEN (legacy; single token).
  • Never hardcode tokens; use environment variables.
  • Avoid logging full URLs, tokens, session cookies, or authorization headers.

Rate limiting & client IP

  • The rate limiter keys by client IP and may use X-Forwarded-For / X-Real-IP.
  • In production, ensure the reverse proxy strips/overwrites forwarding headers to prevent spoofing.

Metrics exposure

  • /metrics may be public by default; enable protection when needed via METRICS_AUTH_ENABLED=true.

Practical review checklist

  • Inputs validated (especially short codes and URLs).
  • Error responses don’t reveal internals/secrets.
  • CORS settings (ALLOWED_ORIGINS) are appropriate for production.
  • Secure cookies enabled (SECURE_COOKIES=true) when behind HTTPS.