@firstpick/pi-skill-code-security

Agents should invoke this skill for code security reviews, leaked secret checks, dependency risk, unsafe shell/Python/TypeScript/Rust patterns, auth/input-validation flaws, SAST-style audits, or supply-chain concerns in repositories.

Packages

Package details

skill

Install @firstpick/pi-skill-code-security from npm and Pi will load the resources declared by the package manifest.

npm repohome report
$ pi install npm:@firstpick/pi-skill-code-security
Package
@firstpick/pi-skill-code-security
Version
0.1.5
Published
Aug 7, 2026
Downloads
386/mo · 28/wk
Author
firstpick
License
MIT
Types
skill
Size
10.6 KB
Dependencies
0 dependencies · 0 peers
Pi manifest JSON
{
  "skills": [
    "./skills"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

Code Security

Look for realistic security problems before they put users, data, or systems at risk.

Helpful when

  • You changed sign-in, permissions, payments, or sensitive data handling.
  • You want to check for exposed passwords or keys.
  • You are preparing an application or service for release.

What to share with Pi

  • The files, branch, or project to review
  • What the software protects and who can access it
  • Any known concerns or likely threats

Try asking

Review this sign-in change for security problems. Show evidence, explain the real-world risk, and suggest the smallest safe fix.

What you’ll get

  • Prioritized findings with evidence
  • A clear explanation of who or what could be affected
  • Practical fixes and ways to verify them

Keep in mind

A review can find important risks, but it cannot prove complete security. Redact any discovered secret values, and require explicit approval before installing scanners, changing dependencies, rewriting Git history, rotating credentials, or force pushing.

Install

pi install npm:@firstpick/pi-skill-code-security

Restart Pi if the skill does not appear in your current session.

Technical details

See TECHNICAL.md for advanced usage, configuration, compatibility, and limitations.