security-practices
This skill teaches you to recognize and defend against the OWASP Top 10 security vulnerabilities that threaten modern applications. Through practical guidance on threat identification and mitigation strategies, you'll build the defensive coding practices needed to protect your software from common attacks and exploits.
security-practices teaches you to recognize SQL injection as a critical vulnerability and provides practical mitigation strategies. The skill covers input validation and sanitization techniques that prevent attackers from injecting malicious SQL code into your application queries. By learning parameterized queries, prepared statements, and proper input handling through this skill, you can defend your database layer against one of the most common attack vectors threatening modern applications.
AI-generated summary based on this skill's SKILL.md
Install
miles990/claude-software-skills/security-practices · repository language: TypeScript
git clone https://github.com/miles990/claude-software-skills
cp -r claude-software-skills/software-engineering/security-practices ~/.claude/skills/security-practicesFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does security-practices help prevent SQL injection attacks?
security-practices teaches you to recognize SQL injection as a critical vulnerability and provides practical mitigation strategies. The skill covers input validation and sanitization techniques that prevent attackers from injecting malicious SQL code into your application queries. By learning parameterized queries, prepared statements, and proper input handling through this skill, you can defend your database layer against one of the most common attack vectors threatening modern applications.
What OWASP Top 10 vulnerabilities are explained in security-practices?
security-practices covers the full spectrum of OWASP Top 10 vulnerabilities explained through threat identification and mitigation strategies. The skill teaches you to recognize these critical security weaknesses and implement defensive coding practices to protect against them. By understanding each vulnerability category and learning practical prevention techniques, you gain the foundational knowledge needed to build more secure applications and reduce your attack surface.
How can security-practices help implement secure authentication?
security-practices provides comprehensive guidance on implementing secure authentication and authorization mechanisms. The skill covers multiple authentication approaches including JWT authentication, OAuth 2.0 setup, and secure password hashing best practices using modern algorithms like Argon2. You'll learn how to protect against broken authentication vulnerabilities and implement role-based access control (RBAC) to ensure only authorized users can access sensitive resources and functionality.
What XSS protection techniques does security-practices teach?
security-practices equips you with practical XSS protection strategies for web applications. The skill covers input validation, output encoding, and content security policy (CSP) implementation to prevent cross-site scripting attacks. By learning these defensive coding practices, you'll understand how to sanitize user input, implement security headers, and configure your application to block malicious scripts from executing in users' browsers.
How does security-practices address secrets management and environment variables?
security-practices teaches you to configure security headers and manage secrets properly through environment variables. The skill provides guidance on securing sensitive configuration data, API keys, and credentials outside of your codebase. By learning secure secrets management practices, you prevent accidental exposure of sensitive information and reduce the risk of attackers stealing data or gaining unauthorized access to your application infrastructure.
What secure coding practices for Node.js does security-practices cover?
security-practices delivers secure coding practices tailored for Node.js environments, including CSRF token implementation, rate limiting for login attempts, and command injection prevention. The skill teaches you to apply input validation and sanitization across your Node.js applications, implement proper authorization checks, and protect against insecure direct object references. These practical techniques help you build defensive applications that resist common web attacks and exploits.
SKILL.md
rendered from the published skill — quoted content, verbatim
Security Practices
Overview
Essential security practices for application development. Covers OWASP Top 10 and secure coding guidelines.
OWASP Top 10
1. Injection (SQL, NoSQL, Command)
``typescript
// ❌ SQL Injection vulnerable
const query =SELECT * FROM users WHERE email = '${email}'`;
// Attack: email = "'; DROP TABLE users; --"
// ✅ Parameterized query const result = await db.query( 'SELECT * FROM users WHERE email = $1', [email] );
// ✅ ORM with parameterization const user = await prisma.user.findUnique({ where: { email } });
// ❌ Command injection vulnerable
exec(ping ${userInput});
// Attack: userInput = "google.com; rm -rf /"
//
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 5 files
software-engineering/security-practices/SKILL.md
software-engineering/security-practices/templates/.env.example
software-engineering/security-practices/templates/README.md
software-engineering/security-practices/templates/csp-policy.json
software-engineering/security-practices/templates/helmet-config.js