Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Tencentblueking/蓝鲸代码安全三大红线 — measured AI agent skill | DecimalAI

tencentblueking/蓝鲸代码安全三大红线

NewSkillScoreMaintained

基于 IEG 安全规范，覆盖输入校验、鉴权、数据加密三大高危领域

Securityby tencentblueking

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/tencentblueking/SKILL.md

decimalai skills pull tencentblueking --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/tencentblueking/SKILL.md https://app.decimal.ai/s/tencentblueking/SKILL.md

Raw file: /s/tencentblueking/SKILL.md ↗ · machine-readable summary at /s/tencentblueking.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 3h ago

—-23% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-11	✗→✓	▲ Improved	-46%	0%
case-04	✗→✓	▲ Improved	-10%	0%
case-12	✗→✓	▲ Improved	-66%	0%
case-13	✗→✓	▲ Improved	-68%	0%
case-16	✗→✓	▲ Improved	-13%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

tencentblueking / bk-bcs

bcs-services/bcs-project-manager/.cursor/skills/bk-security-redlines/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

蓝鲸代码安全三大红线

⚠️ 核心规则

红线 1：外部输入未校验

外部输入进入高危操作前，必须完成服务端强约束校验（类型/长度/格式/白名单），不可绕过。

高危操作：命令执行、模板解释/eval、文件路径、请求目标、SQL/NoSQL 构造、渲染解析、协议输出

红线 2：敏感接口未鉴权

高危能力或敏感资源接口必须同时实施身份认证 + 权限校验，缺一即违规。

禁止：接口无认证、仅登录不校验权限、依赖前端字段/URL/IP 判权、服务间调用无鉴权

红线 3：敏感数据未加密

敏感数据（密码/Token/AKSK/私钥/PII）在存储、传输、日志、导出任一环节保护不当即违规。

禁止：硬编码凭证、明文存储、异常回显细节、日志记录敏感字段、URL 携带 token

常见错误

| 错误做法 | 正确做法 | |---------|---------| | ❌ 仅前端/网关校验 | ✅ 服务端强约束校验 | | ❌ 仅判空/黑名单 | ✅ 白名单 + 类型/长度/格式 | | ❌ 内网可达即放通 | ✅ 服务间调用也需鉴权 | | ❌ 日志记录完整请求 | ✅ 脱敏后记录 |

📦 按需加载资源

| 资源 | URI | 说明 | |-----|-----|------| | 输入校验详解 | skill://bk-security-redlines/references/input-validation.md | 7 类高危操作场景 | | 鉴权检查详解 | skill://bk-security-redlines/references/auth-check.md | 8 类鉴权缺失场景 | | 数据加密详解 | skill://bk-security-redlines/references/data-encryption.md | 8 类加密缺失场景 |

📦 可用资源

skill://bk-security-redlines/references/auth-check.md
skill://bk-security-redlines/references/data-encryption.md
skill://bk-security-redlines/references/input-validation.md

> 根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载

Want to see if tencentblueking/蓝鲸代码安全三大红线 would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.