Installs into .claude/skills of the current project.
Are you the author of Security Boundaries?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/shugokifable-security-boundaries)
---
name: security-boundaries
description: Use when code executes commands, installs hooks/plugins, handles untrusted input, writes outside a workspace, or crosses privilege/network boundaries.
---
# Security Boundaries
## Core rule
Identify each **trust boundary** explicitly and apply **least privilege** at that boundary.
## Contract
Treat downloaded content, repository files from unknown origins, generated shell text, archive members, plugin hooks, environment variables, and user-supplied paths as **untrusted** until validated for the operation being performed.
Prefer argument arrays over shell interpolation; validate archive paths; constrain write roots; avoid privilege elevation unless required; verify signatures/hashes for bootstrapped executables when feasible; preserve provider trust prompts unless the user has explicitly opted into the exact automation being installed.
Do not disable dangerous-command approval globally to remove one setup prompt. Scope consent to the known component or one installer process.
Security checks are part of correctness: a “working” installer that can overwrite arbitrary paths or silently trust future third-party hooks is not near-perfect.
