Security Checklist Skill for AI Agent Developers

Where this fits

Imagine you’re about to commit a change that adds a new IPC capability, an AI prompt template, and a file upload endpoint to an agent. The delta touches user PII, shell access, and model inputs — exactly where a casual “looks fine” review breaks. The security-checklist skill loads the security rules and anchors from the repository, so your agent can review the diff with a structured checklist instead of making up criteria on the spot.

Why agents benefit

• Loads the authoritative docs/knowledge/security-rules.md, so review findings align with the repo’s accepted security posture rather than generic advice.
• Forces severity rounding up for security/data issues, making the agent stop on potential findings instead of downgrading them.
• Covers validation, secrets, logging, dependencies, abuse, cost caps, AI injection, and data retention in one pass.
• Checks prompt-injection paths: whether user-controlled content can manipulate system prompts, leak sensitive data, or reach unintended tools.
• Asks for concrete mitigations — rate limits, temp-file cleanup, export file protections — so the output is actionable, not a list of worries.

Practical scenarios

New capabilities and IPC surface

When you add a capability that lets the model read files or call shell commands, the skill prompts the agent to ask: What attack surface just opened? Can a crafted user message invoke this tool indirectly? It anchors the review to the repo’s existing rules for capability boundaries and permission minimization.

AI features with user-controlled prompts

You’re building a summarize-resume feature where user input goes into the model call. The skill checks whether user input can inject instructions, whether resume PII can leak into logs or prompts, and whether AI output is validated before being stored or displayed.

Dependency and secret handling

A new dependency brings a helper that logs request metadata. The skill flags potential PII in logs, checks whether secrets are in client-side code, and reminds you to review the dependency’s access scopes before accepting the upgrade.

Add it to your agent workflow

Install the skill with:

npx skills add saeedkolivand/ai-job-hunter-app --skill security-checklist

Then ask your agent to run it during review. For example:

Load security-checklist. Review the uncommitted diff, then list validation, abuse, AI, and data findings with severity.

This fits naturally into a pre-merge checklist or a CI-based agent review step.

Compare before adopting

Before adopting, compare this skill against your own security review prompts or generic OWASP-based checklists. Look at maintenance freshness: is docs/knowledge/security-rules.md updated as the repo changes? Check quality signals like GitHub stars, open issues, and whether the author revisits the skill. Also decide if the ai-job-hunter-app anchors match your own stack and threat model, or if you’ll need to adapt the checklist.

Why it is worth tracking

The skill has 52 stars from the saeedkolivand/ai-job-hunter-app repo, which suggests early but real community interest. Security checklists age quickly as your capabilities and dependencies change, so tracking it signals whether the author keeps the anchors fresh. You can see updates and community usage on OpenAgentSkill at https://www.openagentskill.com/skills/saeedkolivand-security-checklist — useful to re-evaluate whenever you introduce more AI, file handling, or IPC boundaries.