Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Tencentblueking/蓝鲸代码安全三大红线 | DecimalAI

securityby tencentblueking

Tencentblueking/蓝鲸代码安全三大红线

tencentblueking/蓝鲸代码安全三大红线

Source tencentblueking/bk-bcs ↗License NOASSERTION

基于 IEG 安全规范，覆盖输入校验、鉴权、数据加密三大高危领域

NewMaintained

Automatic

Security & AppSec pack

Last verified 8/27/2026

What it changes

2 of 22 test cases passed with the skill.

Pass-rate lift: —
Tokens: -4%
Agent turns: 0%
Response time: -13%

Model gemini-3.6-flashMeasured 8/27/2026v22 of 22 cases passed with skill · 4 comparable

Tokens, turns and time describe resource use, not a dollar price.

Lift withheld: 4 comparable cases; this report requires 8.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/tencentblueking-fee3ed/SKILL.md https://app.decimal.ai/s/tencentblueking/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add tencentblueking, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/tencentblueking-fee3ed/ and pins it in .decimal/skills.lock

decimalai skills add tencentblueking

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/tencentblueking-fee3ed/SKILL.md https://app.decimal.ai/s/tencentblueking/SKILL.md

Raw file: /s/tencentblueking/SKILL.md ↗ · machine-readable summary at /s/tencentblueking.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

What's inside

The instructions your model reads when the skill loads.

SKILL.md50 lines4 files

蓝鲸代码安全三大红线

⚠️ 核心规则

红线 1：外部输入未校验

外部输入进入高危操作前，必须完成服务端强约束校验（类型/长度/格式/白名单），不可绕过。

高危操作：命令执行、模板解释/eval、文件路径、请求目标、SQL/NoSQL 构造、渲染解析、协议输出

红线 2：敏感接口未鉴权

高危能力或敏感资源接口必须同时实施身份认证 + 权限校验，缺一即违规。

禁止：接口无认证、仅登录不校验权限、依赖前端字段/URL/IP 判权、服务间调用无鉴权

红线 3：敏感数据未加密

敏感数据（密码/Token/AKSK/私钥/PII）在存储、传输、日志、导出任一环节保护不当即违规。

禁止：硬编码凭证、明文存储、异常回显细节、日志记录敏感字段、URL 携带 token

常见错误

错误做法	正确做法
❌ 仅前端/网关校验	✅ 服务端强约束校验
❌ 仅判空/黑名单	✅ 白名单 + 类型/长度/格式
❌ 内网可达即放通	✅ 服务间调用也需鉴权
❌ 日志记录完整请求	✅ 脱敏后记录

📦 按需加载资源

资源	URI	说明
输入校验详解	`./references/input-validation.md`	7 类高危操作场景
鉴权检查详解	`./references/auth-check.md`	8 类鉴权缺失场景
数据加密详解	`./references/data-encryption.md`	8 类加密缺失场景

Track record

Benchmark

2 / 22

test cases passed with the skill

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 8/25/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

tencentblueking / bk-bcs

bcs-services/bcs-project-manager/.cursor/skills/bk-security-redlines/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/25/2026Version v2Bundled 3 files

More skills from the same source and nearby in the registry, with their headline benchmark lift.