Security First

Security First is a preventive guardrail that integrates security into the development lifecycle during the planning phase, before any code is written. Rather than conducting retrospective audits, it forces an AI agent to identify trust boundaries, surface security assumptions, and define verification steps while a task is being scoped. The skill addresses a common pattern where standard LLMs prioritize functionality over safety, proposing insecure defaults or neglecting edge cases such as untrusted input and session handling. It shifts security left by requiring structured analysis of the attack surface relevant to the specific task. Authentication, authorization, and data handling are treated as first-class requirements rather than afterthoughts. The supported workflows are Trust Boundary Mapping, Secure Defaults, Attack Surface Reduction, and Pre-implementation Verification. These workflows compel the agent to clarify where data changes trust levels, reject weak initial configurations, minimize exposed interfaces, and list concrete validation checks. When activated against a specific task, the agent produces a concise, actionable security brief that outlines the trust boundaries, surfaced assumptions, required verification steps, and risk points identified during the structured analysis.