Skip to content

Security: tody-agent/codymaster

Security

docs/security.md

Security

CodyMaster takes security seriously. Here's how the skill kit prevents and detects security vulnerabilities.

Built-in Security Skills

Skill What it does
cm-secret-shield Pre-commit secret scanning, repo-wide pattern detection, token lifecycle management
cm-identity-guard Verify git/deploy identity before push — prevents wrong-account deploys
cm-quality-gate Layer 8: XSS scan + Gate 6: Snyk SAST integration

Security Rules in Code Generation

Five skills enforce security patterns when generating or reviewing code:

cm-execution — Security Rules

  • Frontend: No innerHTML without escapeHtml(), prefer textContent, validate URLs
  • Python: All paths from config/input must use safe_resolve(), no shell=True
  • Node/Express: Disable x-powered-by, set body limits, filter prototype pollution

cm-planning — Scope Definition

Requires answering: How will dynamic data be rendered? before starting frontend work.

cm-tdd — Security TDD

Every XSS, path traversal, or injection fix starts with a failing test.

cm-code-review — Part D: Security Checklist

Mandatory security pass covering frontend, backend, and general patterns.

cm-quality-gate — Automated Scans

  • Layer 8: Grep scan for unescaped innerHTML patterns
  • Gate 6: Snyk Code SAST with severity-based gate decisions

Utilities

sanitize.js (Frontend)

Shared utility loaded in all HTML pages:

  • escapeHtml(str) — Prevents DOM XSS in innerHTML
  • escapeHtmlWithBreaks(str) — Preserves \n as <br> while escaping HTML
  • escapeAttr(str) — Prevents attribute injection

safe_path.py (Python)

Path traversal prevention:

  • safe_resolve(base, path) — Validates path stays within base directory
  • safe_join(base, *parts) — Safe path joining
  • safe_open(base, path) — Safe file open

Audit Results (March 2026)

Scan Result
Snyk Code (SAST) ✅ 0 medium+ issues
innerHTML grep scan ✅ 0 unescaped patterns
Secret scan ✅ 0 real issues (2 false positives in docs)

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly by opening a private issue on GitHub.

There aren’t any published security advisories