shipshitdev/security-expert
skills/security-expert/SKILL.md
Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.
$ install --global
skillsauthnpx skillsauth add shipshitdev/library security-expertInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 12, 2026, 5:08 AM101.8s3 files scanned
SKILL.md
- name:
- security-expert
- description:
- Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.
- version:
- 1.1.0
- tags:
- security, owasp, application-security
Security Expert Skill
When to Use
- Implementing authentication or authorization
- Reviewing code for security vulnerabilities
- Setting up security configurations
- Handling sensitive data
- Implementing encryption or hashing
- Configuring CORS, CSP, or security headers
- Reviewing dependencies for vulnerabilities
- Implementing multi-tenancy or data isolation
Project Context Discovery
- Check
.agents/memory/for security architecture notes and project facts - Review the applicable
AGENTS.override.md/AGENTS.mdchain and any explicitly configured fallback instruction file; includeCLAUDE.mdonly for Claude-specific rules - Identify security patterns and tools
- Check for
[project]-security-expertskill
Core Security Principles
Authentication & Authorization
Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
Input Validation
- DTOs with class-validator
- Sanitize user input
- Prevent NoSQL/SQL injection
- Parameterized queries
Data Protection
- Encryption at rest and in transit
- Passwords hashed (never plaintext)
- Environment variables for secrets
- No secrets in code
Security Headers
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security
- Content Security Policy
OWASP Top 10 Quick Reference
- Broken Access Control: Verify auth on all endpoints
- Cryptographic Failures: Strong encryption, proper hashing
- Injection: Parameterized queries, input validation
- Insecure Design: Security by design, threat modeling
- Security Misconfiguration: Secure defaults, remove unused features
- Vulnerable Components: Keep dependencies updated
- Authentication Failures: Strong passwords, MFA, brute force protection
- Integrity Failures: Secure CI/CD, code signing
- Logging Failures: Comprehensive logging, monitoring
- SSRF: Validate URLs, whitelist domains
Security Checklist Summary
- [ ] Passwords hashed (bcrypt/argon2)
- [ ] All endpoints protected
- [ ] Multi-tenancy enforced
- [ ] All inputs validated
- [ ] Encryption at rest/transit
- [ ] Security headers configured
- [ ] CORS properly configured
- [ ] Dependencies up to date
For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md
Related Skills
shipshitdev/typescript-refactor
development
VerifiedTrustedCommunity
TypeScript refactoring and modernization guidelines from a principal specialist perspective. This skill should be used when refactoring, reviewing, or modernizing TypeScript code to ensure type safety, compiler performance, and idiomatic patterns. Triggers on tasks involving TypeScript type architecture, narrowing, generics, error handling, or migration to modern TypeScript features.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/typescript-expert
tools
VerifiedTrustedCommunity
Resolves TypeScript and JavaScript problems across type-level programming, performance, monorepo management, migration, and modern tooling. Invoke when diagnosing "type instantiation excessively deep" errors, migrating JS to TS, configuring strict tsconfig, debugging module resolution, or choosing between Biome/ESLint/Turborepo/Nx.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/turborepo
tools
VerifiedTrustedCommunity
Turborepo monorepo build system guidance. Triggers on: `turbo.json`, task pipelines, `dependsOn`, caching, remote cache, the `turbo` CLI, `--filter`, `--affected`, CI optimization, environment variables, internal packages, monorepo structure, and package boundaries. Use when the user configures tasks or workflows, creates packages, sets up a monorepo, shares code between apps, runs changed packages, debugs cache behavior, or works in an `apps/` plus `packages/` workspace.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/tailwind
tools
VerifiedTrustedCommunity
Provides Tailwind CSS v4 performance optimization and best practices guidelines. Triggers when writing, reviewing, or refactoring Tailwind CSS v4 code; when working with Tailwind configuration, @theme directive, utility classes, responsive design, dark mode, container queries, or CSS generation optimization.
30SKILL.mdUpdated Jul 14, 2026