Secure Coding Agent Skills

Guides secure design and review of Lightning Web Components, covering DOM safety, Apex data exposure, and Lightning Web Security.

Explains cryptographic primitives and provides Python implementations for encryption, hashing, key exchange, and digital signatures.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Scaffolds and reviews custom WordPress REST API endpoints, covering registration, authorization, input validation, response shaping, and security best practices.

Configures and secures Spring Boot Actuator HTTP endpoints, including custom paths, ports, SSL, authentication, and CORS.

Scans a single file against the OWASP Top 10:2025, tracks cross-file connections, and maintains a persistent findings record.

Reviews pull request diffs for correctness, security, maintainability, and test coverage, providing severity-ranked findings and a close-out recommendation.

Provides a structured deep-dive into CORS misconfiguration vulnerabilities with exact payloads for every PortSwigger lab variant, including zero-day escalation techniques and blue-team detection guidance.

Detect and exploit Server-Side Template Injection vulnerabilities across multiple template engines including Jinja2, Twig, Freemarker, and Velocity, with payloads for sandbox escape and remote code execution. Includes detection methodology, bypass techniques, and fix patterns.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.

Provides exact payloads and bypass techniques for every PortSwigger DOM-based vulnerability lab variant, including zero-day extensions and blue team detection strategies.

Provides step-by-step guidance and generates configurations for OAuth2 flows, following industry best practices and security patterns.