Security Expert Skill
When to Use
- Implementing authentication or authorization
- Reviewing code for security vulnerabilities
- Setting up security configurations
- Handling sensitive data
- Implementing encryption or hashing
- Configuring CORS, CSP, or security headers
- Reviewing dependencies for vulnerabilities
- Implementing multi-tenancy or data isolation
Project Context Discovery
- Check
.agents/memory/ for security architecture notes and project facts
- Review the applicable
AGENTS.override.md / AGENTS.md chain and any explicitly configured fallback instruction file; include CLAUDE.md only for Claude-specific rules
- Identify security patterns and tools
- Check for
[project]-security-expert skill
Core Security Principles
Authentication & Authorization
Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
Input Validation
- DTOs with class-validator
- Sanitize user input
- Prevent NoSQL/SQL injection
- Parameterized queries
Data Protection
- Encryption at rest and in transit
- Passwords hashed (never plaintext)
- Environment variables for secrets
- No secrets in code
Security Headers
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security
- Content Security Policy
OWASP Top 10 Quick Reference
- Broken Access Control: Verify auth on all endpoints
- Cryptographic Failures: Strong encryption, proper hashing
- Injection: Parameterized queries, input validation
- Insecure Design: Security by design, threat modeling
- Security Misconfiguration: Secure defaults, remove unused features
- Vulnerable Components: Keep dependencies updated
- Authentication Failures: Strong passwords, MFA, brute force protection
- Integrity Failures: Secure CI/CD, code signing
- Logging Failures: Comprehensive logging, monitoring
- SSRF: Validate URLs, whitelist domains
Security Checklist Summary
For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md
1---2name: security-expert3description: Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.4---5
6# Security Expert Skill
7
8## When to Use
9
10- Implementing authentication or authorization
11- Reviewing code for security vulnerabilities
12- Setting up security configurations
13- Handling sensitive data
14- Implementing encryption or hashing
15- Configuring CORS, CSP, or security headers
16- Reviewing dependencies for vulnerabilities
17- Implementing multi-tenancy or data isolation
18
19## Project Context Discovery
20
211. Check `.agents/memory/` for security architecture notes and project facts
222. Review the applicable `AGENTS.override.md` / `AGENTS.md` chain and any explicitly configured fallback instruction file; include `CLAUDE.md` only for Claude-specific rules
233. Identify security patterns and tools
244. Check for `[project]-security-expert` skill
25
26## Core Security Principles
27
28### Authentication & Authorization
29
30**Authentication:** Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
31
32**Authorization:** RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
33
34### Input Validation
35
36- DTOs with class-validator
37- Sanitize user input
38- Prevent NoSQL/SQL injection
39- Parameterized queries
40
41### Data Protection
42
43- Encryption at rest and in transit
44- Passwords hashed (never plaintext)
45- Environment variables for secrets
46- No secrets in code
47
48### Security Headers
49
50- X-Content-Type-Options: nosniff
51- X-Frame-Options: DENY
52- Strict-Transport-Security
53- Content Security Policy
54
55## OWASP Top 10 Quick Reference
56
571. **Broken Access Control:** Verify auth on all endpoints
582. **Cryptographic Failures:** Strong encryption, proper hashing
593. **Injection:** Parameterized queries, input validation
604. **Insecure Design:** Security by design, threat modeling
615. **Security Misconfiguration:** Secure defaults, remove unused features
626. **Vulnerable Components:** Keep dependencies updated
637. **Authentication Failures:** Strong passwords, MFA, brute force protection
648. **Integrity Failures:** Secure CI/CD, code signing
659. **Logging Failures:** Comprehensive logging, monitoring
6610. **SSRF:** Validate URLs, whitelist domains
67
68## Security Checklist Summary
69
70- [ ] Passwords hashed (bcrypt/argon2)
71- [ ] All endpoints protected
72- [ ] Multi-tenancy enforced
73- [ ] All inputs validated
74- [ ] Encryption at rest/transit
75- [ ] Security headers configured
76- [ ] CORS properly configured
77- [ ] Dependencies up to date
78
79---
80
81**For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see:** `references/full-guide.md`
shipshitdev