The Complete Production SOP: How to Deploy and Run ESLint Security Rules & AST Taint Hardening in Autonomous AI Agents

Autonomous runtimes like Claude Code, Cursor, and Codex automatically parse local skill registries located under .agents/skills or ~/.agents/skills. Placing the SKILL.md definition directly within the repository root under .agents/skills/eslint-security-rules-hardening ensures the agent dynamically inspects AST security triggers whenever ESLint or vulnerability mitigation tasks are assigned.

import securityPlugin from 'eslint-plugin-security';
import tseslint from 'typescript-eslint';

export default tseslint.config(
  tseslint.configs.recommended,
  securityPlugin.configs.recommended,
  {
    rules: {
      'security/detect-object-injection': 'warn',
      'security/detect-unsafe-regex': 'error',
      'security/detect-non-literal-fs-filename': 'warn',
      'security/detect-eval-with-expression': 'error'
    }
  }
);

Modern ESLint v9 utilizes the Flat Config format. To ensure the agent can execute lint checks and detect AST taint without syntax failures, both eslint-plugin-security and typescript-eslint must be installed as devDependencies.

Runtimes match user intent against triggers specified in SKILL.md. By commanding the agent with explicit trigger phrasing, such as 'configure eslint-plugin-security' or 'prevent prototype pollution eslint', the agent automatically selects the security SOP and applies AST rules to target directories.

Instruct the agent to run the configured security linter and parse the resulting diagnostics. If security/detect-object-injection or security/detect-unsafe-regex errors occur, the agent must inspect the AST node, apply defensive coding (e.g., Object.hasOwn check or safe regex replacement), and rerun linting until exit code 0 is attained.