security-practices
This skill teaches you to recognize and defend against the OWASP Top 10 security vulnerabilities that threaten modern applications. Through practical guidance on threat identification and mitigation strategies, you'll build the defensive coding practices needed to protect your software from common attacks and exploits.
security-practices teaches you to recognize SQL injection as a critical vulnerability and provides practical mitigation strategies. The skill covers input validation and sanitization techniques that prevent attackers from injecting malicious SQL code into your application queries. By learning parameterized queries, prepared statements, and proper input handling through this skill, you can defend your database layer against one of the most common attack vectors threatening modern applications.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-01-20
security-practices teaches you to recognize SQL injection as a critical vulnerability and provides practical mitigation strategies. The skill covers input validation and sanitization techniques that prevent attackers from injecting malicious SQL code into your application queries. By learning parameterized queries, prepared statements, and proper input handling through this skill, you can defend your database layer against one of the most common attack vectors threatening modern applications.
Use it when
- security-practices covers the full spectrum of OWASP Top 10 vulnerabilities explained through threat identification and mitigation.
- security-practices provides comprehensive guidance on implementing secure authentication and authorization mechanisms.
Verify before relying
Read SKILL.md below before installing (5 files). Open directory: indexed for reading, not audited.
Install
miles990/claude-software-skills/security-practices · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does security-practices help prevent SQL injection attacks?
security-practices teaches you to recognize SQL injection as a critical vulnerability and provides practical mitigation strategies. The skill covers input validation and sanitization techniques that prevent attackers from injecting malicious SQL code into your application queries. By learning parameterized queries, prepared statements, and proper input handling through this skill, you can defend your database layer against one of the most common attack vectors threatening modern applications.
What OWASP Top 10 vulnerabilities are explained in security-practices?
security-practices covers the full spectrum of OWASP Top 10 vulnerabilities explained through threat identification and mitigation strategies. The skill teaches you to recognize these critical security weaknesses and implement defensive coding practices to protect against them. By understanding each vulnerability category and learning practical prevention techniques, you gain the foundational knowledge needed to build more secure applications and reduce your attack surface.
How can security-practices help implement secure authentication?
security-practices provides comprehensive guidance on implementing secure authentication and authorization mechanisms. The skill covers multiple authentication approaches including JWT authentication, OAuth 2.0 setup, and secure password hashing best practices using modern algorithms like Argon2. You'll learn how to protect against broken authentication vulnerabilities and implement role-based access control (RBAC) to ensure only authorized users can access sensitive resources and functionality.
What XSS protection techniques does security-practices teach?
security-practices equips you with practical XSS protection strategies for web applications. The skill covers input validation, output encoding, and content security policy (CSP) implementation to prevent cross-site scripting attacks. By learning these defensive coding practices, you'll understand how to sanitize user input, implement security headers, and configure your application to block malicious scripts from executing in users' browsers.
How does security-practices address secrets management and environment variables?
security-practices teaches you to configure security headers and manage secrets properly through environment variables. The skill provides guidance on securing sensitive configuration data, API keys, and credentials outside of your codebase. By learning secure secrets management practices, you prevent accidental exposure of sensitive information and reduce the risk of attackers stealing data or gaining unauthorized access to your application infrastructure.
What secure coding practices for Node.js does security-practices cover?
security-practices delivers secure coding practices tailored for Node.js environments, including CSRF token implementation, rate limiting for login attempts, and command injection prevention. The skill teaches you to apply input validation and sanitization across your Node.js applications, implement proper authorization checks, and protect against insecure direct object references. These practical techniques help you build defensive applications that resist common web attacks and exploits.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Security Practices
Overview
Essential security practices for application development. Covers OWASP Top 10 and secure coding guidelines.
OWASP Top 10
1. Injection (SQL, NoSQL, Command)
``typescript
// ❌ SQL Injection vulnerable
const query =SELECT * FROM users WHERE email = '${email}'`;
// Attack: email = "'; DROP TABLE users; --"
// ✅ Parameterized query const result = await db.query( 'SELECT * FROM users WHERE email = $1', [email] );
// ✅ ORM with parameterization const user = await prisma.user.findUnique({ where: { email } });
// ❌ Command injection vulnerable
exec(ping ${userInput});
// Attack: userInput = "google.com; rm -rf /"
//
(truncated - see the full file via the links below)
File tree — 5 files
software-engineering/security-practices/SKILL.md
software-engineering/security-practices/templates/.env.example
software-engineering/security-practices/templates/README.md
software-engineering/security-practices/templates/csp-policy.json
software-engineering/security-practices/templates/helmet-config.js
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn OWASP Top 10 vulnerabilities and how to prevent them”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill equips you with essential knowledge of the OWASP Top 10—the most critical web application security risks—and demonstrates how to identify and remediate each vulnerability in your codebase. Through hands-on code examples and defensive techniques, you'll learn to build more resilient applications and protect against common attack vectors.
Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform.
This skill helps you integrate security best practices and OWASP-aligned patterns directly into your codebase, whether you're starting fresh or hardening existing systems. It guides you through vulnerability assessment, secure coding patterns, and compliance-focused implementation strategies to reduce risk and build defensible applications.
This skill scans your code for security vulnerabilities and provides actionable remediation guidance. It helps development teams quickly identify and address potential risks before they reach production, streamlining the security review process.
This skill helps developers uncover and patch security weaknesses in TypeScript applications. Receive targeted recommendations to harden your codebase against common attack vectors and best-practice violations.
This skill configures GitLeaks within Husky pre-commit hooks to catch secrets before they're committed, then runs a security audit on your code. It can optionally scan git history for previously leaked secrets and provides remediation guidance.
More skills testing-strategies (MIT)