secure-ai-agent-coding v1.0.0A

Immutable. This exact content is served forever at /api/v1/blob/6c19af8ef5097256.

---
name: secure-ai-agent-coding
description: "Build, review, or harden AI agents, LLM apps, RAG, tool-calling, coding agents, and agentic workflows with secure-by-default controls. Trigger on prompt injection, tool permissions, approvals, AI data handling, RAG poisoning, observability, or safety CI. Do NOT use for non-AI appsec."
compatibility: "Requires: python3 for optional local pattern scanning. No external packages required."
metadata:
  version: "1.0.0"
  short-description: "Secure AI agent coding review and hardening"
  openclaw:
    category: "development"
    requires:
      bins: [python3]
references:
  - review-workflow
  - controls
  - implementation-patterns
  - threat-model
  - governance
  - gotchas
---

# secure-ai-agent-coding

Build or review AI agents and LLM applications so their blast radius stays small, their behavior is auditable, and high-impact actions require explicit control.

## Decision Tree

What is the user asking for?

- Build a new AI agent or LLM feature:
  Read `references/implementation-patterns.md`, then apply `references/controls.md` before writing integration code.
- Review an existing codebase or design:
  Run `scripts/scan_patterns.py /path/to/project --json` if source code is available, then read `references/review-workflow.md`.
- Add tools, system calls, code execution, database writes, API calls, or email/message sending:
  Treat it as a high-risk action surface. Read `references/implementation-patterns.md` and require allowlisted tools, per-action authorization, rate limits, rollback, and approval gates.
- Handle user data, production data, documents, web pages, email, vector stores, embeddings, or fine-tuning data:
  Read `references/governance.md` and `references/threat-model.md` before designing prompts or retrieval flows.
- Debug a safety incident, unexpected model behavior, prompt injection, data leak, or harmful automation:
  Read `references/review-workflow.md` and `references/gotchas.md`, preserve logs, stop autonomous actions, and recover from a known safe state.
- The request is only generic web app security with no AI, model, RAG, tool-call, or agentic workflow:
  Do not use this skill unless the AI-specific attack surface is part of the task.

## Quick Reference

| Task | Action |
|------|--------|
| Find likely dangerous patterns | Run `python3 scripts/scan_patterns.py /path/to/project` |
| Classify risk | Tier each agent action by impact, reversibility, data sensitivity, and external side effects |
| Protect prompts | Separate instructions from untrusted data; validate, delimit, and minimize context |
| Protect tool calls | Use explicit allowlists, scoped credentials, per-action authorization, and rate limits |
| Protect users and data | Classify data, minimize disclosure, redact logs, verify consent, and avoid raw production data in test systems |
| Protect downstream systems | Validate structured model output before using it in code, SQL, shell, APIs, or UI rendering |
| Protect production | Add monitoring, anomaly alerts, safety regression tests, rollback plans, and incident response steps |
| Review exceptions | Document why a control does not apply, who accepted the risk, and when it expires |

## Core Workflow

1. Map the AI surface: model calls, prompts, retrieved content, tools, state, credentials, data stores, and external side effects.
2. Classify every input as untrusted unless it is generated by a trusted server-side component and still validate it.
3. Classify every action the agent can take. Default to reversible, low-privilege actions and escalate high-impact actions to human approval.
4. Design controls before implementation: schemas, allowlists, server-side authorization, idempotency, rate limits, locks, rollback, and audit logs.
5. Keep sensitive data out of prompts and logs unless the model truly needs it. Prefer redaction, tokenization, anonymization, or synthetic data.
6. Validate AI output before it reaches downstream interpreters, renderers, databases, APIs, file systems, or shell commands.
7. Test safety controls in CI and again after model, prompt, framework, dependency, retrieval, or tool changes.

## Control Router

| Area | Load |
|------|------|
| End-to-end review process, severity, report format | `references/review-workflow.md` |
| Control catalog and evidence checklist | `references/controls.md` |
| Copyable implementation patterns | `references/implementation-patterns.md` |
| AI-specific threat scenarios and risk tiers | `references/threat-model.md` |
| Inventory, consent, model updates, lifecycle, and operations | `references/governance.md` |
| Common failure modes and reviewer traps | `references/gotchas.md` |
| Source conversion notes and scope exclusions | `references/source-policy.md` |

## Operational Scripts

Use `scripts/scan_patterns.py` as a first-pass heuristic scanner, not as proof of safety.

```bash
python3 scripts/scan_patterns.py /path/to/project
python3 scripts/scan_patterns.py /path/to/project --json --fail-on high
```

The scanner intentionally favors review prompts over automated verdicts. Treat findings as places to inspect.

## Source Scope

This skill adapts the engineering-applicable controls from Galdren's "Secure AI & Agent Coding Policy" into an agent skill. It keeps the parts that can drive code review, architecture decisions, local checks, and production hardening. It leaves legal judgment, organization-specific approvals, and physical security as prompts to involve the right team rather than pretending a coding skill can resolve them.

## Gotchas

1. Prompt-only defenses are not enough. Enforce authorization, validation, and tool limits outside the model.
2. A model used as a validator is still an AI input surface. Validate its inputs and outputs like any other component.
3. "Authenticated user" is not the same as "authorized agent action." Check each action separately.
4. Logs can become a data leak. Record enough to investigate, but redact secrets, personal data, and sensitive context.
5. Model or framework upgrades can change behavior without a code diff. Retest safety and output contracts after every change.
6. Broad tool access turns small prompt failures into production incidents. Keep the agent footprint minimal at every step.