name: prompt-and-code-security description: >- Use this skill whenever designing, building, or securing any web application, API, registry, or platform that accepts user-submitted markdown, code snippets, system prompts, or AI agent configurations. Provides comprehensive threat detection, file validation, XSS sanitization, rate limiting, and community moderation workflows to protect users, servers, and AI agents from destructive commands, remote execution, reverse shells, and credential exfiltration.

Prompt & Code Upload Security Architecture

A complete, framework-agnostic security standard for any application that allows users to upload, publish, or share code snippets, markdown documents, system prompts, or AI agent rules.

---

The Threat Model

When users share prompts, scripts, or markdown that other users copy into their local IDEs, terminals, or autonomous AI agents (Cursor, Claude, Copilot, AutoGPT, terminal agents), the application faces four distinct threat vectors:

1. Destructive Shell Commands: Malicious prompts directing autonomous agents to execute rm -rf /, Windows rmdir /s /q, fork bombs, or drive wipers.
2. Remote Script Cradles: Commands downloading and executing external payloads via curl ... | bash, wget ... | sh, PowerShell DownloadString | IEX, or certutil.
3. Reverse Shells & Backdoors: Socket connections (/dev/tcp/, nc -e, Python socket payloads) establishing remote command channels back to attackers.
4. Credential & Secret Exfiltration: Prompts secretly commanding the AI agent to read .env, SSH keys, or AWS tokens and transmit them via HTTP POST to third-party webhooks (webhook.site, pipedream, etc.).
5. Cross-Site Scripting (XSS): Rendering malicious markdown links ([Click](javascript:...)) or unescaped HTML scripts in other users' browsers.
6. Denial of Service & Binary Masquerading: Uploading binary executables (.exe, .bin) or bloated files to exhaust database storage.

---

5-Layer Defense Architecture

User Input / File Upload
          │
          ▼
┌───────────────────────────────────────────────┐
│ Layer 1: File & Input Validation              │  --> Cap size (300KB), whitelist extensions,
│                                               │      reject null bytes / binary data
└───────────────────────┬───────────────────────┘
                        │
                        ▼
┌───────────────────────────────────────────────┐
│ Layer 2: Static Threat & Heuristic Scanner    │  --> Scan for rm -rf, curl|bash, reverse
│                                               │      shells, webhooks, fork bombs
└───────────────────────┬───────────────────────┘
                        │
                        ▼
┌───────────────────────────────────────────────┐
│ Layer 3: Server-Side Defense & Rate Limiting  │  --> Enforce sliding window limits (Redis),
│                                               │      re-validate on server (defense-in-depth)
└───────────────────────┬───────────────────────┘
                        │
                        ▼
┌───────────────────────────────────────────────┐
│ Layer 4: Client XSS & Link Sanitization       │  --> urlTransform (allow only http/https),
│                                               │      rel="noopener noreferrer"
└───────────────────────┬───────────────────────┘
                        │
                        ▼
┌───────────────────────────────────────────────┐
│ Layer 5: Community Reporting & Auto-Flagging  │  --> User reporting, threshold auto-flag,
│                                               │      quarantine hide logic
└───────────────────────────────────────────────┘

---

Layer 1: File & Input Validation

Before reading or processing any uploaded file:

1. Size Cap: Restrict prompts/markdown to 100 KB - 300 KB. Genuine prompts and agent rules are rarely larger.
2. Extension Whitelist: Only accept strictly defined text formats:

   const ALLOWED_EXTENSIONS = ['.md', '.txt', '.mdc', '.yaml', '.yml', '.json'];
   

3. Binary Byte Check: Reject files containing null bytes (\0) or high ratios of non-printable control characters to prevent compiled malware from masquerading as text:

export function containsBinaryBytes(content: string): boolean {
  if (content.includes('\0')) return true;

  const sample = content.slice(0, 1024);
  let controlChars = 0;
  for (let i = 0; i < sample.length; i++) {
    const code = sample.charCodeAt(i);
    if ((code < 32 && code !== 9 && code !== 10 && code !== 13) || code === 65533) {
      controlChars++;
    }
  }
  return sample.length > 0 && controlChars / sample.length > 0.03;
}

---

Layer 2: Threat & Heuristic Pattern Catalog

Run content through regular expression scans categorized by severity:

Critical Threats (Strictly Block Publication)

Threat Category	Pattern	Description
Destructive Command	/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*|--force)\s+[/~*]/i	Deleting filesystem root or home directory
Windows Destructive	/\brmdir\s+\/[sS]\s+\/[qQ]\s+[a-zA-Z]:\\/i	Silent recursive Windows drive deletion
Disk Format	/\b(mkfs(\.[a-z0-9]+)?|format\s+[a-zA-Z]:)\b/i	Partition wiping / formatting
Fork Bomb	:[(][)]\s*[{]\s*:[|]:\s*&?\s*[}]\s*;\s*:	OS process exhaustion exploit
Raw Disk Wipe	/\bdd\s+if=.*of=\/dev\/(sd[a-z]|nvme[0-9]|hd[a-z])/i	Direct block device overwrite
Remote Bash Pipe	/\b(curl|wget)\s+[^|\n;]+(|\s*(sudo\s+)?(bash|sh|zsh))\b/i	Remote script piped directly to shell
PowerShell Cradle	/\bpowershell(\.exe)?\s+.*(iex|Invoke-Expression|DownloadString|DownloadFile)\b/i	PowerShell memory-injected execution
Certutil Cradle	/\bcertutil(\.exe)?\s+.*-urlcache\b/i	Abusing Windows certutil as download cradle
MSHTA Remote	/\bmshta(\.exe)?\s+https?:\/\//i	Remote HTML application payload execution
Dev TCP Shell	/\/dev\/tcp\/[0-9a-zA-Z.-]+\/[0-9]+/i	Linux /dev/tcp socket reverse shell
Netcat Backdoor	/\b(nc|ncat|netcat)\s+(-[a-zA-Z]*e|--exec)\s+(\/bin\/)?(bash|sh|cmd|powershell)\b/i	Netcat command shell binding (-e)
Python Socket	/python(\d)?\s+-c\s+.*socket.*connect.*os\.dup2/i	Python reverse shell one-liner
Base64 Shell Pipe	/\becho\s+[A-Za-z0-9+/=]{24,}\s*|\s*base64\s+-d\s*|\s*(sudo\s+)?(bash|sh|zsh)\b/i	Obfuscated payload piped to shell

Warning & Advisory Threats (Flag for Review)

Threat Category	Pattern	Description
Secret Exfiltration	/\b(exfiltrate|send|upload|post)\s+.*(\.env|credentials|private_key|secret_key|api_key|token)s?\s+.*https?:\/\//i	Instructing AI to steal keys and POST to external endpoint
Public Webhook	/https?:\/\/(webhook\.site|requestbin\.(com|net)|hookbin\.com|pipedream\.net)\/[a-zA-Z0-9_-]+/i	Known public endpoints for blind data exfiltration
Env Variable Post	/\bcurl\s+.*-(d|F|X\s*POST).*(@\.env|\$AWS_|\$OPENAI_API_KEY)/i	Terminal command uploading secret env files

---

Layer 3: Server-Side Defense & Rate Limiting

Never trust client-side validation alone. Form validation can be bypassed with curl or direct API calls.

1. Server Validation: Run the scanner inside the API route or Server Action before database insertion.
2. Sliding-Window Rate Limiting:
   • Limit publishing: e.g. 5 creations per 10 minutes per authenticated user ID.
   • Limit reporting: e.g. 5 reports per 5 minutes per authenticated user ID.
3. Fail-Open Strategy: Wrap Redis / rate-limiter calls in try/catch so transient cache failures do not break legitimate user requests.

---

Layer 4: Client-Side Markdown & Link Sanitization

When rendering user-generated markdown in React, Vue, or vanilla HTML:

1. Protocol Whitelist: Only allow http://, https://, and mailto:. Strictly strip javascript:, data:, and vbscript:.

export function sanitizeMarkdownUrl(url: string): string {
  if (!url) return '';
  const trimmed = url.trim().toLowerCase();
  if (
    trimmed.startsWith('http://') ||
    trimmed.startsWith('https://') ||
    trimmed.startsWith('mailto:') ||
    trimmed.startsWith('#')
  ) {
    return url.trim();
  }
  return '';
}

2. External Link Safety: Add target="_blank" and rel="noopener noreferrer" to all external anchor tags.
3. Terminal Script Advisory: Detect if markdown contains terminal code blocks (```bash, ```sh, ```powershell) and display an advisory warning:

   💡 Advisory: This prompt contains terminal commands. Always review scripts before executing them in your local terminal or coding agent.

---

Layer 5: Community Moderation & Auto-Flagging Workflow

Database Schema Pattern

-- 1. Status column on content table
ALTER TABLE items
  ADD COLUMN security_status TEXT NOT NULL DEFAULT 'verified'
  CHECK (security_status IN ('verified', 'flagged', 'quarantined'));

-- 2. Report tracking table
CREATE TABLE item_reports (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  item_id UUID NOT NULL REFERENCES items(id) ON DELETE CASCADE,
  reporter_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  reason TEXT NOT NULL CHECK (reason IN ('malware_virus', 'prompt_injection', 'phishing_spam', 'copyright', 'other')),
  details TEXT NOT NULL DEFAULT '',
  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
  UNIQUE (item_id, reporter_id) -- Prevents multiple reports from same user
);

-- 3. Auto-flagging trigger on report threshold (e.g. 3 reports)
CREATE OR REPLACE FUNCTION check_item_flag_threshold()
RETURNS TRIGGER AS $$
DECLARE
  report_count INT;
BEGIN
  SELECT count(*) INTO report_count
  FROM item_reports
  WHERE item_id = NEW.item_id;

  IF report_count >= 3 THEN
    UPDATE items
    SET security_status = 'flagged'
    WHERE id = NEW.item_id;
  END IF;

  RETURN NEW;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER SET search_path = public;

CREATE TRIGGER on_item_reported
  AFTER INSERT ON item_reports
  FOR EACH ROW EXECUTE PROCEDURE check_item_flag_threshold();

Feed Isolation Rules

• verified: Visible on public feeds, search, and detail pages. Displays Security Verified shield.
• flagged: Stays visible but shows prominent red warning banner: ⚠️ Community Flagged: Potentially harmful instructions reported.
• quarantined: Completely excluded from all public feeds, search, and sitemaps. Direct URLs return 404 Not Found to everyone except the original owner.

---

Standalone Reference Implementation (TypeScript)

A single-file drop-in utility that can be imported into any backend or frontend project:

export interface SecurityIssue {
  severity: 'critical' | 'warning';
  category: string;
  rule: string;
  message: string;
  snippet?: string;
}

export interface ScanResult {
  isSafe: boolean;
  hasCritical: boolean;
  hasWarnings: boolean;
  issues: SecurityIssue[];
}

export function scanContentSecurity(content: string): ScanResult {
  const issues: SecurityIssue[] = [];

  const CRITICAL_RULES = [
    { pattern: /\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*|--force)\s+[/~*]/i, rule: 'rm_root', msg: 'Destructive filesystem deletion' },
    { pattern: /\b(curl|wget)\s+[^|\n;]+(\|\s*(sudo\s+)?(bash|sh|zsh))\b/i, rule: 'curl_pipe_sh', msg: 'Remote script piped to shell' },
    { pattern: /\bpowershell(\.exe)?\s+.*(iex|DownloadString)\b/i, rule: 'ps_download', msg: 'PowerShell memory download cradle' },
    { pattern: /\/dev\/tcp\/[0-9a-zA-Z.-]+\/[0-9]+/i, rule: 'dev_tcp_socket', msg: 'Network socket reverse shell' },
    { pattern: /\b(nc|ncat|netcat)\s+(-[a-zA-Z]*e|--exec)\b/i, rule: 'nc_exec', msg: 'Netcat execution backdoor' },
    { pattern: /:[(][)]\s*[{]\s*:[|]:\s*&?\s*[}]\s*;\s*:/, rule: 'fork_bomb', msg: 'Fork bomb exploit' },
  ];

  for (const item of CRITICAL_RULES) {
    const match = content.match(item.pattern);
    if (match) {
      issues.push({
        severity: 'critical',
        category: 'remote_execution',
        rule: item.rule,
        message: item.msg,
        snippet: match[0].slice(0, 80),
      });
    }
  }

  return {
    isSafe: issues.length === 0,
    hasCritical: issues.some(i => i.severity === 'critical'),
    hasWarnings: issues.some(i => i.severity === 'warning'),
    issues,
  };
}