06-security-rules
- **Auth store:** Cloudflare D1 `user-auth-db` — users, sessions, roles, password hashes (PBKDF2) - **Session:** Opaque `session_token` cookie (or Bearer header), resolved by `src/lib/api-auth.ts` - **Default session:** 30 days; 60 days with "remember me"
Install / Use
npx skills add Themis128/cloudless.grInstalls into whichever agent you are using.
Our assessment of 06-security-rules
06-security-rules scores 57/100 on our quality scale, 1075th of 1,099 Security skills we index.
Its .clinerules is 2.7 KB long, split into 7 sections and no code examples: a solid amount of guidance for an agent.
It has no GitHub stars yet, so there is no community track record; judge it on its content.
Maintenance, license and trust
- We could not determine when the repository was last updated.
- Our last check on 2026-10-18 found the source still online.
- No license is declared. By default that means all rights are reserved: you can read it, but reusing or redistributing it is not clearly permitted. Ask the author before building on it commercially.
- Its trust signals score 68/100, with 3 cautions from licensing, adoption, age or documentation. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
Safety scan
No issues foundOur scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. An AI review of the same text found nothing harmful.
AI review by kimi-k2.7-code on 2026-09-24. Automated pattern scan on 2026-09-24. It catches known dangerous patterns, not every risk — read a skill before letting an agent act on it.
06-security-rules compared with similar skills
All 4 of these similar skills score higher than 06-security-rules; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| 06-security-rules (this skill)by Themis128 | 57 | 0 | — | .clinerules |
| Agent-Reachby Panniantong | 100 | 109.2k | today | CLAUDE.md |
| headroomby headroomlabs-ai | 100 | 78.9k | today | CLAUDE.md |
| Scraplingby D4Vinci | 100 | 97.9k | today | MCP Server |
| crawl4aiby unclecode | 100 | 87.0k | 1d ago | MCP Server |
Frequently asked questions
- How do I install 06-security-rules?
- Run
npx skills add Themis128/cloudless.gr. The install tabs above show the steps for each supported agent. - Which AI agents does 06-security-rules work with?
- It is written for Cline, as a .clinerules file. Other agents that read the same format can often use it too.
- Is 06-security-rules safe to use?
- Our scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. An AI review of the same text found nothing harmful. It declares no license and scores 68/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is 06-security-rules still maintained?
- We could not determine when the repository was last updated.
Skill content
View source on GitHubSecurity Rules
Authentication & Authorization
- Auth store: Cloudflare D1
user-auth-db— users, sessions, roles, password hashes (PBKDF2) - Session: Opaque
session_tokencookie (or Bearer header), resolved bysrc/lib/api-auth.ts - Default session: 30 days; 60 days with "remember me"
- Admin check: Membership in D1
roles→ projected asgroups: ["admin"] - Route protection:
src/proxy.ts(before render) + layout guards - Password rules: ≥8 chars with upper, lower, digit, and special character
- Account lockout: After 5 failed attempts in 15 minutes
- Rate limiting: Auth endpoints: max 10 attempts/minute. Centralized in
proxy.ts. - CSRF protection: Implemented via
csrf.tsutility and migration 0004 - Email verification: Activation token + OTP via SES (
auth-activation.ts) - Password reset: Max 3 requests/hour
API Security
- CORS: Restricted to
cloudless.grin production, localhost in dev - Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS with preload
- Checkout validation: Server-side product lookup by ID; client cannot set prices
- Stripe webhooks: Signature verification via
stripe.webhooks.constructEvent() - Slack endpoints: HMAC-SHA256 verification for events, commands, interactions
- Rate limiting: Centralized in
proxy.ts(IP-based, per endpoint). Do NOT add per-route rate limiters.
Secret Management
- Production secrets: Wrangler secrets (Workers) or environment variables (k3s)
- Non-secret config: D1
app_configtable (migration 0007) - No .env files in production — only in development
- SSM fallback: Available for legacy compatibility, disabled via
SSM_DISABLED=1 - Required secrets:
SESSION_SECRET(32+ bytes),STRIPE_SECRET_KEY,STRIPE_WEBHOOK_SECRET,NOTION_API_KEY,SLACK_WEBHOOK_URL
Output Security
- Email bodies: HTML-escaped via
escapeHtml()to prevent injection - API responses: Never expose internal error details to clients
- User data: Never expose password hashes or session tokens in API responses
Audit Logging
- Admin audit log: All admin actions logged to
admin_audit_logtable (migration 0005) - Session activity: Login IPs/timestamps tracked
- Retention: Audit logs retained for 365 days (configurable)
Infrastructure Security
- Cloudflare Tunnel: All traffic encrypted end-to-end; no public IPs for internal services
- DDoS protection: Built-in Cloudflare DDoS mitigation
- WAF: Web Application Firewall with OWASP rules
- Bot management: Protection against malicious bots
- Zero-trust: Service bindings communicate via private network
Related Skills
Agent-Reach
109.2kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
headroom
78.9kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
Scrapling
97.9k🕷️ The BEST Web Scraping framework that handles everything from a single request to a full-scale crawl! Don't be shy, join here: https://discord.gg/EMgGbDceNQ and follow here for daily tips and tricks: https://x.com/Scrapling_dev
crawl4ai
87.0kOfficial Crawl4AI Cloud: a hosted web scraping, extraction, and search API for AI agents. Free API key, 1,000 credits a month, no card. Fully open source: this repo is the Apache-2.0 crawler that powers it, and you can self-host it.
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.