htlin222/security
claude.symlink/skills/security/SKILL.md
Security audits, vulnerability detection, and secure coding. Use for security reviews, auth implementation, or OWASP compliance.
$ install --global
skillsauthnpx skillsauth add htlin222/dotfiles securityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 5, 2026, 8:06 PM9.6s1 file scanned
SKILL.md
- name:
- security
- description:
- Security audits, vulnerability detection, and secure coding. Use for security reviews, auth implementation, or OWASP compliance.
Security Audit
Identify vulnerabilities and implement secure coding practices.
When to Use
- Security review of code or architecture
- Implementing authentication/authorization
- Before deploying to production
- User asks about security best practices
- Handling sensitive data
OWASP Top 10 Checklist
- Injection - Parameterized queries, input sanitization
- Broken Auth - Strong sessions, MFA, secure password storage
- Sensitive Data - Encryption at rest and transit, minimal exposure
- XXE - Disable external entities, use JSON over XML
- Broken Access Control - RBAC, deny by default
- Misconfiguration - Secure defaults, remove debug info
- XSS - Output encoding, CSP headers
- Insecure Deserialization - Validate input, avoid native serialization
- Vulnerable Components - Dependency scanning, updates
- Logging - Audit logs, no sensitive data in logs
Security Headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
Auth Implementation
// Password hashing
const hash = await bcrypt.hash(password, 12);
// JWT with short expiry
const token = jwt.sign({ userId }, secret, { expiresIn: "15m" });
// Refresh token rotation
const refreshToken = crypto.randomBytes(32).toString("hex");
Audit Output Format
## Security Audit Report
**Severity Levels:** Critical | High | Medium | Low
### Critical
- [Issue]: [Description] → [Fix]
### High
- [Issue]: [Description] → [Fix]
### Recommendations
- [Improvement suggestion]
Examples
Input: "Review auth implementation" Action: Check password storage, session management, token handling, report findings
Input: "Make this API secure" Action: Add input validation, auth checks, rate limiting, security headers
Related Skills
htlin222/zettel
testing
VerifiedTrustedCommunity
Converts narrative medical text into Pocket Medicine bullet-style notes with proper abbreviations, then modularizes sections exceeding 20 lines into linked standalone files.
76SKILL.mdUpdated Apr 5, 2026
htlin222/vm-docker
devops
VerifiedTrustedCommunity
Use when deploying Docker services on the local VM (hostname: vm, Pop!_OS) with Traefik reverse proxy and Homepage dashboard. Covers crane image workflow, Traefik file-provider registration, Homepage services.yaml entries, and compose templates on the traefik-proxy network.
76SKILL.mdUpdated Apr 5, 2026
htlin222/visualization-check
development
VerifiedTrustedCommunity
Use when reviewing a data visualization or figure for clarity, checking if a graph communicates its message without additional context, or iterating on R/Python plot scripts until a naive reader can fully understand the figure.
76SKILL.mdUpdated Apr 5, 2026
htlin222/vale
development
VerifiedTrustedCommunity
Runs Vale prose linter on markdown/text files and auto-fixes issues. Use when the user asks to lint, proofread, or improve writing quality of markdown or text files.
76SKILL.mdUpdated Apr 5, 2026