Eclair/Skills
FRENES
GitHub
DOCUMENTATION CENTER

Security

From first steps to security requirements: practical documentation for developers and AI-agent users.

Security and quality

A skill can guide implementation; it cannot independently prove that a module is safe.

  1. Never treat SKILL.md as executable code or evidence of safety.
  2. Do not change core files outside a reviewed development branch.
  3. Check permissions per resource, not only in navigation.
  4. Use CSRF protection, HTTPS and rate limits on sensitive public forms.
  5. Never put secrets or customer data into shared caches.
  6. Validate packages against the native contract and run complete tests.
bash
php tools/validate.php path/to/extension --json
php tests/run.php
php tools/measure.php --check

Transactional features require verified Éclair 2.0 compatibility before deployment. Experimental public authentication is not part of the standard core.