Security Expert Skill
When to Use
- Implementing authentication or authorization
- Reviewing code for security vulnerabilities
- Setting up security configurations
- Handling sensitive data
- Implementing encryption or hashing
- Configuring CORS, CSP, or security headers
- Reviewing dependencies for vulnerabilities
- Implementing multi-tenancy or data isolation
Project Context Discovery
- Check
.agents/memory/ for security architecture notes and project facts
- Review the applicable
AGENTS.override.md / AGENTS.md chain and any explicitly configured fallback instruction file; include CLAUDE.md only for Claude-specific rules
- Identify security patterns and tools
- Check for
[project]-security-expert skill
Core Security Principles
Authentication & Authorization
Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
Input Validation
- DTOs with class-validator
- Sanitize user input
- Prevent NoSQL/SQL injection
- Parameterized queries
Data Protection
- Encryption at rest and in transit
- Passwords hashed (never plaintext)
- Environment variables for secrets
- No secrets in code
Security Headers
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security
- Content Security Policy
OWASP Top 10 Quick Reference
- Broken Access Control: Verify auth on all endpoints
- Cryptographic Failures: Strong encryption, proper hashing
- Injection: Parameterized queries, input validation
- Insecure Design: Security by design, threat modeling
- Security Misconfiguration: Secure defaults, remove unused features
- Vulnerable Components: Keep dependencies updated
- Authentication Failures: Strong passwords, MFA, brute force protection
- Integrity Failures: Secure CI/CD, code signing
- Logging Failures: Comprehensive logging, monitoring
- SSRF: Validate URLs, whitelist domains
Security Checklist Summary
For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md
1---
2name: security-expert
3description: Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.
4metadata:
5 version: "1.1.0"
6 tags: "security, owasp, application-security"
7---
8
9# Security Expert Skill
10
11## When to Use
12
13- Implementing authentication or authorization
14- Reviewing code for security vulnerabilities
15- Setting up security configurations
16- Handling sensitive data
17- Implementing encryption or hashing
18- Configuring CORS, CSP, or security headers
19- Reviewing dependencies for vulnerabilities
20- Implementing multi-tenancy or data isolation
21
22## Project Context Discovery
23
241. Check `.agents/memory/` for security architecture notes and project facts
252. Review the applicable `AGENTS.override.md` / `AGENTS.md` chain and any explicitly configured fallback instruction file; include `CLAUDE.md` only for Claude-specific rules
263. Identify security patterns and tools
274. Check for `[project]-security-expert` skill
28
29## Core Security Principles
30
31### Authentication & Authorization
32
33**Authentication:** Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
34
35**Authorization:** RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
36
37### Input Validation
38
39- DTOs with class-validator
40- Sanitize user input
41- Prevent NoSQL/SQL injection
42- Parameterized queries
43
44### Data Protection
45
46- Encryption at rest and in transit
47- Passwords hashed (never plaintext)
48- Environment variables for secrets
49- No secrets in code
50
51### Security Headers
52
53- X-Content-Type-Options: nosniff
54- X-Frame-Options: DENY
55- Strict-Transport-Security
56- Content Security Policy
57
58## OWASP Top 10 Quick Reference
59
601. **Broken Access Control:** Verify auth on all endpoints
612. **Cryptographic Failures:** Strong encryption, proper hashing
623. **Injection:** Parameterized queries, input validation
634. **Insecure Design:** Security by design, threat modeling
645. **Security Misconfiguration:** Secure defaults, remove unused features
656. **Vulnerable Components:** Keep dependencies updated
667. **Authentication Failures:** Strong passwords, MFA, brute force protection
678. **Integrity Failures:** Secure CI/CD, code signing
689. **Logging Failures:** Comprehensive logging, monitoring
6910. **SSRF:** Validate URLs, whitelist domains
70
71## Security Checklist Summary
72
73- [ ] Passwords hashed (bcrypt/argon2)
74- [ ] All endpoints protected
75- [ ] Multi-tenancy enforced
76- [ ] All inputs validated
77- [ ] Encryption at rest/transit
78- [ ] Security headers configured
79- [ ] CORS properly configured
80- [ ] Dependencies up to date
81
82---
83
84**For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see:** `references/full-guide.md`
shipshitdev