Security Sensitive Path Instrumenter

What it does

When your agent uses it

• Developers need to add security monitoring and logging to their code
• Including tracking authentication attempts (login/logout)
• Authorization decisions (access control checks)
• Input validation failures

Example prompts

• “Use the security-sensitive-path-instrumenter skill to instrument authentication, authorization, and input-handling code paths to monitor…”
• “/security-sensitive-path-instrumenter”

Requirements

• Python 3

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

1. 1Identify security-sensitive code paths - Locate authentication, authorization, input validation, or session management code that needs…
2. 2Determine event types - Classify the security events to monitor (see security_events.md for taxonomy)
3. 3Review best practices - Check best_practices.md for what to log and what to avoid (never log passwords, secrets, or sensitive PII)
4. 4Select language patterns - Use language_patterns.md for language-specific instrumentation code (Python, JavaScript/TypeScript, Java)
5. 5Add instrumentation - Insert structured logging calls at key decision points
6. 6Include context - Log relevant data points
7. 7Verify instrumentation - Ensure

What it can do on your machine

Read from SKILL.md and the folder at commit 4f38503. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • python

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Sensitive Path Instrumenter loads about 1.1k tokens when it runs, and up to ~6.2k if it reads all its reference files. Until then it costs about 186 tokens; SKILL.md has 292 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~186

When it runs · the whole SKILL.md, loaded when a task matches

~1.1k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~6.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from ArabelaTso/Skills-4-SE at commit 4f38503, republished under its Apache-2.0 licence (© ArabelaTso). 292 words, ~1,102 tokens.

name

security-sensitive-path-instrumenter

description

Instruments authentication, authorization, and input-handling code paths to monitor security-relevant events and states at runtime. Use this skill when developers need to add security monitoring and logging to their code, including tracking authentication attempts (login/logout), authorization decisions (access control checks), input validation failures, session management events, and other security-critical operations. Supports Python, JavaScript/TypeScript, and Java with structured logging patterns. Triggers when users ask to add security instrumentation, monitor security events, log authentication/authorization, track security-sensitive operations, or add security observability to their codebase.

log_security_event(
    event_type='authentication_attempt',
    username=username,
    ip_address=request.remote_addr
)

logSecurityEvent('authorization_check', {
  user_id: user.id,
  resource: resourceId,
  permission: requiredPermission,
  decision: hasPermission ? 'granted' : 'denied'
});

Map<String, Object> data = new HashMap<>();
data.put("user_id", user.getId());
data.put("errors", validationErrors);
SecurityLogger.logSecurityEvent("validation_failure", data);

# Generate Python authentication instrumentation
python scripts/generate_instrumentation.py python authentication

# Generate JavaScript authorization instrumentation
python scripts/generate_instrumentation.py javascript authorization

# Generate Java validation instrumentation
python scripts/generate_instrumentation.py java validation

© ArabelaTso, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/security-sensitive-path-instrumenter of ArabelaTso/Skills-4-SE.

• SKILL.md
• references/best_practices.md
• references/language_patterns.md
• references/security_events.md
• scripts/generate_instrumentation.py

Open the folder on GitHubat commit 4f38503