Security Expert Skill
When to Use
- Implementing authentication or authorization
- Reviewing code for security vulnerabilities
- Setting up security configurations
- Handling sensitive data
- Implementing encryption or hashing
- Configuring CORS, CSP, or security headers
- Reviewing dependencies for vulnerabilities
- Implementing multi-tenancy or data isolation
Project Context Discovery
- Check
.agents/memory/ for security architecture notes and project facts
- Review the agent instruction files (
AGENTS.md/CLAUDE.md, repo-level and global) for security rules and "never do" constraints
- Identify security patterns and tools
- Check for
[project]-security-expert skill
Core Security Principles
Authentication & Authorization
Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
Input Validation
- DTOs with class-validator
- Sanitize user input
- Prevent NoSQL/SQL injection
- Parameterized queries
Data Protection
- Encryption at rest and in transit
- Passwords hashed (never plaintext)
- Environment variables for secrets
- No secrets in code
Security Headers
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security
- Content Security Policy
OWASP Top 10 Quick Reference
- Broken Access Control: Verify auth on all endpoints
- Cryptographic Failures: Strong encryption, proper hashing
- Injection: Parameterized queries, input validation
- Insecure Design: Security by design, threat modeling
- Security Misconfiguration: Secure defaults, remove unused features
- Vulnerable Components: Keep dependencies updated
- Authentication Failures: Strong passwords, MFA, brute force protection
- Integrity Failures: Secure CI/CD, code signing
- Logging Failures: Comprehensive logging, monitoring
- SSRF: Validate URLs, whitelist domains
Security Checklist Summary
For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md
1---2name: security-expert-43description: Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.4---56# Security Expert Skill78## When to Use910- Implementing authentication or authorization11- Reviewing code for security vulnerabilities12- Setting up security configurations13- Handling sensitive data14- Implementing encryption or hashing15- Configuring CORS, CSP, or security headers16- Reviewing dependencies for vulnerabilities17- Implementing multi-tenancy or data isolation1819## Project Context Discovery20211. Check `.agents/memory/` for security architecture notes and project facts222. Review the agent instruction files (`AGENTS.md`/`CLAUDE.md`, repo-level and global) for security rules and "never do" constraints233. Identify security patterns and tools244. Check for `[project]-security-expert` skill2526## Core Security Principles2728### Authentication & Authorization2930**Authentication:** Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO3132**Authorization:** RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement3334### Input Validation3536- DTOs with class-validator37- Sanitize user input38- Prevent NoSQL/SQL injection39- Parameterized queries4041### Data Protection4243- Encryption at rest and in transit44- Passwords hashed (never plaintext)45- Environment variables for secrets46- No secrets in code4748### Security Headers4950- X-Content-Type-Options: nosniff51- X-Frame-Options: DENY52- Strict-Transport-Security53- Content Security Policy5455## OWASP Top 10 Quick Reference56571. **Broken Access Control:** Verify auth on all endpoints582. **Cryptographic Failures:** Strong encryption, proper hashing593. **Injection:** Parameterized queries, input validation604. **Insecure Design:** Security by design, threat modeling615. **Security Misconfiguration:** Secure defaults, remove unused features626. **Vulnerable Components:** Keep dependencies updated637. **Authentication Failures:** Strong passwords, MFA, brute force protection648. **Integrity Failures:** Secure CI/CD, code signing659. **Logging Failures:** Comprehensive logging, monitoring6610. **SSRF:** Validate URLs, whitelist domains6768## Security Checklist Summary6970- [ ] Passwords hashed (bcrypt/argon2)71- [ ] All endpoints protected72- [ ] Multi-tenancy enforced73- [ ] All inputs validated74- [ ] Encryption at rest/transit75- [ ] Security headers configured76- [ ] CORS properly configured77- [ ] Dependencies up to date7879---8081**For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see:** `references/full-guide.md`
shipshitdev