How do I install the Typescript Security skill?

Run npx skillmds@latest add hoangnguyen0403/typescript-security-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Typescript Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Typescript Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Typescript Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Typescript Security?

HoangNguyen0403 (@hoangnguyen0403) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Typescript Security by hoangnguyen0403

Name: Typescript Security
Rating: 4.2 (5 reviews)
Author: HoangNguyen0403

Typescript Security

Secure coding practices for TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration. (triggers: **/*.ts, **/*.tsx, validate, sanitize, xss, injection, auth, password, secret, token)

HoangNguyen0403 Updated Sep 9, 2026 542 repo stars

File contents

TypeScript Security

Priority: P0 (CRITICAL)

Security standards for TypeScript applications based on OWASP guidelines.

Implementation Guidelines

Validation: Use Zod, Joi, or class-validator at the API boundary. Always parse and validate user-controlled input before using. Use safeParse for error handling without throwing. Return 400 with structured errors on failure.
Sanitization: Use DOMPurify for HTML sanitization to prevent Cross-Site Scripting (XSS).
Secrets: Store secrets in .env (e.g., JWT_SECRET) or Secret Managers. NEVER commit them to Git.
Vulnerabilities: Prevent SQL Injection using Parameterized Queries (e.g., pool.query('... WHERE id = $1', [id])) or Type-safe ORMs (Prisma/TypeORM). Use Prisma.sql for raw queries.
Authentication: Use Argon2id for password hashing. Implement JWT (via jsonwebtoken or jose) with HttpOnly and Secure cookies. Use RS256 for public/private key pairs and implement Refresh Token rotation.
CORS: Configure CORS with Strict Origin Whitelisting. Avoid origin: '*'.
Encryption: Use crypto (Node.js) or Web Crypto API for sensitive data. Avoid legacy algorithms like MD5/SHA1.
Input Filtering: Sanitize user-controlled input before using it in file paths or OS commands (Command Injection).

Verification

After typing validation schemas (Zod/joi) or auth guards, call getDiagnostics (typescript-lsp) to confirm type narrowing is correct before finalizing.

Anti-Patterns

No eval(): Avoid dynamic execution.
No Plaintext: Never commit secrets.
No Trust: Validate everything server-side.

References

See references/REFERENCE.md for Zod validation, secure cookie setup, JWT auth, security headers, and RBAC patterns.

---name: typescript-security-2description: Secure coding practices for TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration. (triggers: **/*.ts, **/*.tsx, validate, sanitize, xss, injection, auth, password, secret, token)--- # TypeScript Security ## **Priority: P0 (CRITICAL)** Security standards for TypeScript applications based on OWASP guidelines. ## Implementation Guidelines - **Validation**: Use **`Zod`**, **`Joi`**, or **`class-validator`** at the **API boundary**. Always **`parse`** and validate **`user-controlled input`** before using. Use **`safeParse`** for error handling without throwing. Return **`400 with structured errors`** on failure. - **Sanitization**: Use **`DOMPurify`** for HTML sanitization to prevent **Cross-Site Scripting (XSS)**. - **Secrets**: Store secrets in **`.env`** (e.g., **`JWT_SECRET`**) or **Secret Managers**. NEVER commit them to Git. - **Vulnerabilities**: Prevent **SQL Injection** using **Parameterized Queries** (e.g., **`pool.query('... WHERE id = $1', [id])`**) or **Type-safe ORMs** (**`Prisma`**/`TypeORM`). Use **`Prisma.sql`** for raw queries. - **Authentication**: Use **`Argon2id`** for password hashing. Implement **`JWT`** (via **`jsonwebtoken`** or **`jose`**) with **`HttpOnly`** and **`Secure`** cookies. Use **`RS256`** for public/private key pairs and implement **`Refresh Token rotation`**. - **CORS**: Configure **`CORS`** with **Strict Origin Whitelisting**. Avoid `origin: '*'`. - **Encryption**: Use **`crypto`** (Node.js) or **`Web Crypto API`** for sensitive data. Avoid legacy algorithms like MD5/SHA1. - **Input Filtering**: Sanitize **`user-controlled input`** before using it in file paths or OS commands (Command Injection). ## Verification After typing validation schemas (Zod/joi) or auth guards, call `getDiagnostics` (typescript-lsp) to confirm type narrowing is correct before finalizing. ## Anti-Patterns - **No `eval()`**: Avoid dynamic execution. - **No Plaintext**: Never commit secrets. - **No Trust**: Validate everything server-side. ## References See [references/REFERENCE.md](references/REFERENCE.md) for Zod validation, secure cookie setup, JWT auth, security headers, and RBAC patterns.

Frequently asked questions