Security Engineer
Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform.
Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2025-12-25
Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.
Use it when
- Security Engineer provides detailed strategies to prevent SQL injection by teaching parameterized queries, prepared statements.
- Security Engineer assists with role-based access control (RBAC) implementation by defining role hierarchies, permission mappings.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
daffy0208/ai-dev-standards/security-engineer · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I implement JWT authentication in Next.js with Security Engineer?
Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.
What does Security Engineer teach about preventing SQL injection attacks in my app?
Security Engineer provides detailed strategies to prevent SQL injection by teaching parameterized queries, prepared statements, and ORM best practices. The skill emphasizes input validation, output encoding, and the principle of least privilege for database accounts. You'll learn to sanitize user inputs, use allowlists for expected data formats, and implement Web Application Firewalls (WAF). Security Engineer also covers detection techniques and demonstrates how SQL injection ranks among OWASP Top 10 vulnerabilities that require immediate mitigation.
How should Security Engineer help me implement role-based access control?
Security Engineer assists with role-based access control (RBAC) implementation by defining role hierarchies, permission mappings, and enforcement policies. The skill guides you through designing granular permissions, implementing middleware to check user roles before granting access, and managing role assignments. You'll learn to separate authentication (verifying identity) from authorization (checking permissions), use attribute-based access control (ABAC) for complex scenarios, and audit role changes. Security Engineer ensures your RBAC design aligns with the principle of least privilege and supports your application's scalability.
What are bcrypt password hashing best practices according to Security Engineer?
Security Engineer emphasizes that bcrypt password hashing best practices include using appropriate cost factors (typically 10-12 rounds), never storing plain-text passwords, and always hashing passwords server-side. The skill teaches you to generate unique salts automatically with bcrypt, verify passwords by comparing hashes rather than decrypting, and implement rate limiting on login attempts to prevent brute-force attacks. Security Engineer recommends bcrypt over faster algorithms for password storage because its intentional slowness makes cracking attempts computationally expensive, protecting your users even if your database is compromised.
How does Security Engineer help set up rate limiting for login endpoints?
Security Engineer provides frameworks for implementing rate limiting on login endpoints to prevent brute-force and credential-stuffing attacks. The skill teaches you to track failed login attempts per IP address and username, implement exponential backoff delays after repeated failures, and temporarily lock accounts after threshold breaches. You'll learn to configure rate limits using middleware, cache solutions like Redis, or API gateway tools. Security Engineer emphasizes monitoring rate-limit triggers as security events, logging them for audit purposes, and balancing security with user experience by allowing legitimate users to recover access through verified recovery channels.
What guidance does Security Engineer provide for OWASP Top 10 compliance and security reviews?
Security Engineer conducts security reviews ensuring compliance with OWASP Top 10 vulnerabilities including injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging. The skill provides assessment frameworks to identify gaps in your application, prioritize remediation efforts, and implement controls for each vulnerability class. Security Engineer helps you establish continuous security testing practices, vulnerability scanning routines, and documentation standards that demonstrate compliance to stakeholders and maintain security posture as your application evolves.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Security Engineer
Security is not optional - build it in from day one.
Core Principle
Security is built-in, not bolted-on.
Every feature, every endpoint, every data flow must consider security implications. Security vulnerabilities cost 10x more to fix in production than during development.
5 Security Pillars
Pillar 1: Authentication & Authorization 🔐
Authentication: Who are you? Authorization: What can you do?
Authentication Strategies
JWT (JSON Web Tokens):
- When: Stateless APIs, mobile apps, microservices
- How: Sign tokens with secret, store in httpOnly cookies or Authorization header
- Security: Use RS256 (not HS256), short expiry (15min access, 7d refresh)
```typescript // Example: Next.js API with JWT import { SignJWT, jwtVerify } from 'jose'
const secret = new
(truncated - see the full file via the links below)
File tree — 3 files
skills/security-engineer/README.md
skills/security-engineer/SKILL.md
skills/security-engineer/manifest.yaml
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Implement authentication and authorization mechanisms for web applications”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill equips you with essential knowledge of the OWASP Top 10—the most critical web application security risks—and demonstrates how to identify and remediate each vulnerability in your codebase. Through hands-on code examples and defensive techniques, you'll learn to build more resilient applications and protect against common attack vectors.
This skill helps you integrate security best practices and OWASP-aligned patterns directly into your codebase, whether you're starting fresh or hardening existing systems. It guides you through vulnerability assessment, secure coding patterns, and compliance-focused implementation strategies to reduce risk and build defensible applications.
This skill scans your code for security vulnerabilities and provides actionable remediation guidance. It helps development teams quickly identify and address potential risks before they reach production, streamlining the security review process.
This skill teaches you to recognize and defend against the OWASP Top 10 security vulnerabilities that threaten modern applications. Through practical guidance on threat identification and mitigation strategies, you'll build the defensive coding practices needed to protect your software from common attacks and exploits.
Cloudflare Workers Security delivers production patterns for protecting APIs and Workers through authentication verification, request rate limiting, input validation, and security headers. It covers JWT and API key validation, CORS configuration, and defends against common vulnerabilities like injection, XSS, and unauthorized access.
This skill equips developers with practical techniques to defend against cross-site scripting (XSS) vulnerabilities through input sanitization and secure output encoding. Master the core defensive patterns needed to protect web applications from malicious script injection and ensure safe handling of untrusted data across your codebase.
More skills Appsec Expert (Unlicense) · Typescript Security (GFDL-1.3) · Accessibility Engineer (MIT) · Testing Strategist (MIT)