secure-ai-agent-coding

Build or review AI agents and LLM applications so their blast radius stays small, their behavior is auditable, and high-impact actions require explicit control.

Decision Tree

What is the user asking for?

• Build a new AI agent or LLM feature:

Read references/implementation-patterns.md, then apply references/controls.md before writing integration code.

• Review an existing codebase or design:

Run scripts/scan_patterns.py /path/to/project --json if source code is available, then read references/review-workflow.md.

• Add tools, system calls, code execution, database writes, API calls, or email/message sending:

Treat it as a high-risk action surface. Read references/implementation-patterns.md and require allowlisted tools, per-action authorization, rate limits, rollback, and approval gates.

• Handle user data, production data, documents, web pages, email, vector stores, embeddings, or fine-tuning data:

Read references/governance.md and references/threat-model.md before designing prompts or retrieval flows.

• Debug a safety incident, unexpected model behavior, prompt injection, data leak, or harmful automation:

Read references/review-workflow.md and references/gotchas.md, preserve logs, stop autonomous actions, and recover from a known safe state.

• The request is only generic web app security with no AI, model, RAG, tool-call, or agentic workflow:

Do not use this skill unless the AI-specific attack surface is part of the task.

Quick Reference

Core Workflow

1. Map the AI surface: model calls, prompts, retrieved content, tools, state, credentials, data stores, and external side effects.
2. Classify every input as untrusted unless it is generated by a trusted server-side component and still validate it.
3. Classify every action the agent can take. Default to reversible, low-privilege actions and escalate high-impact actions to human approval.
4. Design controls before implementation: schemas, allowlists, server-side authorization, idempotency, rate limits, locks, rollback, and audit logs.
5. Keep sensitive data out of prompts and logs unless the model truly needs it. Prefer redaction, tokenization, anonymization, or synthetic data.
6. Validate AI output before it reaches downstream interpreters, renderers, databases, APIs, file systems, or shell commands.
7. Test safety controls in CI and again after model, prompt, framework, dependency, retrieval, or tool changes.

Control Router

Operational Scripts

Use scripts/scan_patterns.py as a first-pass heuristic scanner, not as proof of safety.

python3 scripts/scan_patterns.py /path/to/project
python3 scripts/scan_patterns.py /path/to/project --json --fail-on high

The scanner intentionally favors review prompts over automated verdicts. Treat findings as places to inspect.

Source Scope

This skill adapts the engineering-applicable controls from Galdren's "Secure AI & Agent Coding Policy" into an agent skill. It keeps the parts that can drive code review, architecture decisions, local checks, and production hardening. It leaves legal judgment, organization-specific approvals, and physical security as prompts to involve the right team rather than pretending a coding skill can resolve them.

Gotchas

1. Prompt-only defenses are not enough. Enforce authorization, validation, and tool limits outside the model.
2. A model used as a validator is still an AI input surface. Validate its inputs and outputs like any other component.
3. "Authenticated user" is not the same as "authorized agent action." Check each action separately.
4. Logs can become a data leak. Record enough to investigate, but redact secrets, personal data, and sensitive context.
5. Model or framework upgrades can change behavior without a code diff. Retest safety and output contracts after every change.
6. Broad tool access turns small prompt failures into production incidents. Keep the agent footprint minimal at every step.