application-security
This skill equips you with essential knowledge of the OWASP Top 10—the most critical web application security risks—and demonstrates how to identify and remediate each vulnerability in your codebase. Through hands-on code examples and defensive techniques, you'll learn to build more resilient applications and protect against common attack vectors.
application-security teaches you to prevent SQL injection by using parameterized queries and prepared statements, which separate SQL code from user input. The skill provides code examples showing how to safely construct database queries, ensuring that user-supplied data is treated as data rather than executable code. This is a foundational defense covered in the OWASP Top 10 vulnerabilities section.
AI-generated summary based on this skill's SKILL.md
Install
travisjneuman/.claude/application-security · repository language: JavaScript
git clone https://github.com/travisjneuman/.claude
cp -r .claude/skills/application-security ~/.claude/skills/application-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to prevent SQL injection attacks with application-security?
application-security teaches you to prevent SQL injection by using parameterized queries and prepared statements, which separate SQL code from user input. The skill provides code examples showing how to safely construct database queries, ensuring that user-supplied data is treated as data rather than executable code. This is a foundational defense covered in the OWASP Top 10 vulnerabilities section.
What are the OWASP Top 10 security vulnerabilities that application-security covers?
application-security equips you with essential knowledge of the OWASP Top 10—the most critical web application security risks—and demonstrates how to identify and remediate each vulnerability in your codebase. The skill covers injection attacks, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting (XSS), insecure deserialization, using components with known vulnerabilities, and insufficient logging and monitoring, each with defensive techniques and code examples.
How do I implement content security policy headers with application-security?
application-security guides you through configuring security headers and CSP policies for web applications, including CSP nonce implementation for inline scripts. The skill teaches you how to set appropriate directives that control which resources can be loaded, preventing unauthorized script execution and mitigating XSS attacks. You'll learn to configure headers that restrict content sources and protect your application from common web vulnerabilities.
What input validation best practices does application-security teach?
application-security covers input validation best practices as a core defense against injection attacks and other vulnerabilities. The skill teaches you to validate user input on both client and server sides, implement allowlisting approaches, sanitize data, and use parameterized queries. These practices are essential for preventing SQL injection, XSS, and other attack vectors that exploit unvalidated or improperly handled user-supplied data.
Which SAST and DAST security testing tools does application-security recommend?
application-security teaches you to select and use SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools for security scanning. The skill covers how to integrate these tools into your development pipeline, interpret their findings, and prioritize remediation efforts. You'll learn which tools are appropriate for different testing scenarios and how to use them to identify vulnerabilities before they reach production.
How can application-security help me audit and harden my application's security posture?
application-security provides a security hardening checklist and comprehensive guidance for auditing your web application's security posture. The skill teaches you to implement secure headers, configure authentication and authorization checks with code examples, apply cryptographic best practices, and conduct systematic reviews of your codebase. You'll learn to identify and fix security vulnerabilities systematically, ensuring your application meets industry security standards.
SKILL.md
rendered from the published skill — quoted content, verbatim
Application Security Skill
Secure coding patterns, vulnerability prevention, and security tooling for web applications.
OWASP Top 10 (2021) with Code Examples
A01: Broken Access Control
// BAD - No authorization check
app.get('/api/users/:id', async (req, res) => {
const user = await db.user.findUnique({ where: { id: req.params.id } });
res.json(user);
});
// GOOD - Verify ownership or role
app.get('/api/users/:id', authenticate, async (req, res) => {
if (req.user.id !== req.params.id && req.user.role !== 'ADMIN') {
return res.status(403).json({ error: 'Forbidden' });
}
const user = await db.user.findUnique({ where: { id: req.params.id } });
res.json(user);
});
A02: Cryptographic Failures
```typescript // BAD - Weak hashing import crypto from 'crypto'; const hash = crypto.createHash('md5').update(password).digest('hex');
// GOOD - Use bcrypt with proper
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/application-security/SKILL.md