Secure Coding Agent Skills

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Enforces a read-only rule for filesystem junctions and symlinks, blocking writes, deletes, and git commits that resolve outside the current project root.

Applies the DevSecOps framework to structure analysis, guide decision-making, and produce actionable recommendations for engineering and operations contexts.

Guides Firebase development with best practices for security rules, data modeling, and avoiding common pitfalls.

Secure Perl applications against injection, taint, and web vulnerabilities with validated patterns for input handling, file operations, process execution, and DBI queries.

Hardens Django applications against common vulnerabilities with production settings, authentication, authorization, SQL injection and XSS prevention, and secure deployment configurations.

Provides a security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data handling.

Secure Quarkus applications with authentication, authorization, input validation, and secrets management best practices.

Performs structured code reviews of git branches, tracking findings in a living document and optionally running deep architectural analysis with subagents.

Adds input and output guardrails to an agent, including validation, content filtering, domain scoping, and rate limiting, with TypeScript examples and wiring instructions.

Scans Python and JavaScript codebases for bugs, security vulnerabilities, code smells, and anti-patterns, producing a prioritized fix list with line numbers, severity ratings, and suggested corrections.

Builds, configures, and manages AWS Cognito user pools, identity pools, authentication flows, and integrations with other AWS services.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Provides guidance on Firebase best practices, including security rules, data modeling, and avoiding common pitfalls.

Guides backend development across API design, authentication, security, performance, architecture, and testing, with decision guides and defaults for production-ready systems.

Provides expert-level guidance on implementing and applying app security concepts, including design, optimization, debugging, and best practices.

Prevents destructive operations on production systems and restricts edits to a specified directory when running agents autonomously.

Guides building secure admin panels with RBAC, audit logging, and step-up controls for privileged actions.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Audits frontend codebases for security vulnerabilities and bad practices, covering XSS, CSRF, DOM issues, CSP, input validation, file uploads, and Node.js/NPM dependencies across web, React, Astro, Twig, Node.js, and Bun.

Enforces the Vikingo Studio standard for WordPress plugins and repos: naming taxonomy, plugin headers, folder structure, versioning, release flow, private update channel, admin UI rules, security baseline, and pre-release checklist.

Audits WordPress plugin and theme PHP code for advanced security issues beyond basic sanitization, including object injection, SSRF, CSRF, mass assignment, file inclusion, mail header injection, ZipSlip, type juggling, and TOCTOU races.

Audits WordPress plugin or theme PHP code for common security mistakes including missing nonce checks, capability checks, input sanitization, output escaping, SQL preparation, AJAX exposure, file traversal, and unsafe redirects.

Build WordPress admin tables by extending WP_List_Table, covering required overrides, pagination, bulk actions, and CSRF protection.

Provides a pre-deployment security checklist for OAuth-connected apps and external client apps, covering configuration, token policies, access control, and compliance.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Storage, and Hosting, with patterns for security rules, data modeling, and real-time listeners.

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Provides exact payloads and bypass techniques for every PortSwigger JWT authentication lab variant, from unverified signatures to algorithm confusion attacks.

Generates specific, implementable fixes for each vulnerability finding, producing code patches, configuration changes, dependency updates, and IaC fixes with before/after code and verification steps.

Hardens code against vulnerabilities by applying threat modeling, OWASP Top 10 prevention patterns, and secure coding practices for web applications.

Design secure, scalable Firebase backends with Firestore, Auth, Functions, and Storage, following best practices for security rules, data modeling, and real-time listeners.

Verifies that fix commits properly address security audit findings without introducing new bugs or vulnerabilities.

Routes user requests to specialist skills for AEM 6.5 LTS Dispatcher configuration, troubleshooting, performance tuning, security hardening, and lifecycle orchestration.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist and attack surface mapping.