360 Secure SkillHub
360 安全技能中心

principle-boundary-discipline

面向编码实践的原则型 Skill:主张在系统边界(命令行参数、配置、网络、外部接口)集中做校验、类型收窄与错误处理,内部代码信任类型不再重复校验;业务逻辑放入无框架依赖的纯函数,外壳保持轻薄机械,并给出判断校验是否冗余的两条检查方法。

cursor
热度 0.00
最近更新 2026-10-18 16:52:27
分类:开发依赖:纯提示词应用场景:代码生成 / 代码审查 / 概念解释

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add cursor/plugins/principle-boundary-discipline
Metadata
name
principle-boundary-discipline
description
Apply when wiring validation, error handling, or framework adapters. Concentrate guards at system boundaries (CLI, config, network, external APIs); trust internal types and keep business logic in pure functions.
disable-model-invocation
true

Boundary Discipline

Place validation, type narrowing, and error handling at system boundaries. Trust internal code unconditionally. Business logic lives in pure functions. The shell is thin and mechanical.

Why: Scattered validation is noisy, redundant, and gives a false sense of safety. Keep logic out of framework wiring so it can be tested without the framework.

The pattern:

  • At boundaries (CLI args, config files, external APIs, network protocols): validate, return errors, handle defensively.
  • Inside the system: typed data, error propagation, no re-validation. Trust the types.
  • Across the boundary. Expose domain concepts, not the boundary's private representation. Keep general-purpose mechanism inside and special-purpose policy at the edge.

Applications:

Validation and error handling:

  • Validate config at parse time (the boundary), not inside business logic
  • Parse raw data into domain types at the boundary
  • Do not re-export transport, storage, framework, or wire types through the public surface
  • No redundant nil checks deep in call chains if the boundary already validated

Code organization:

  • Business logic in pure functions with no framework dependencies
  • Parse functions: pure transforms from raw bytes to typed state
  • Prompt construction: structured state in, string out
  • Scoring and assessment: pure transforms from state to results

The tests:

  • "Is this data crossing a system boundary right now?" If not, validation is redundant.
  • "Can this be a pure function that the shell just calls?" If yes, extract it.