security-specialist_skill

Overview

This skill implements practical security measures for TypeScript projects, covering authentication, authorization, data protection, and vulnerability checks. It helps teams add secure authentication flows, enforce access control, and protect sensitive data while integrating automated vulnerability scanning. Use it to harden APIs, manage sessions, and ensure consistent security practices across services.

How this skill works

The skill inspects code and configuration to identify missing or weak security controls and offers concrete fixes: password hashing, token handling, session management, and MFA options. It validates input handling, recommends encryption for data at rest and in transit, and integrates vulnerability scans and security logging. Actionable suggestions map to code-level changes, configuration updates, and testing checkpoints.

When to use it

• Adding or updating user authentication flows (passwords, tokens, sessions)
• Protecting API endpoints and implementing access control
• Handling or storing sensitive data like passwords, API keys, or PII
• Performing security reviews, audits, or automated vulnerability scans
• Implementing rate limiting, logging, or incident monitoring

Best practices

• Never trust user input — validate and sanitize on both client and server
• Use strong, salted hashing for passwords and rotate keys regularly
• Enforce least privilege with RBAC or attribute-based access control
• Encrypt sensitive data in transit (TLS) and at rest (AES/GCM or equivalent)
• Use parameterized queries to prevent SQL injection and implement rate limiting
• Log security events and monitor for anomalies; maintain incident response playbooks

Example use cases

• Add JWT-based authentication with refresh tokens and secure cookie storage
• Introduce role-based access control for admin and user endpoints
• Migrate plaintext secrets to environment-managed encrypted stores and rotate keys
• Run automated vulnerability scans and fix high-severity findings before deployment
• Add input validation and parameterized queries to eliminate injection risks