owasp-security_skill

Overview

This skill implements secure coding patterns based on the OWASP Top 10 to prevent common web application vulnerabilities. It provides pragmatic guidance, code patterns, and a pre-deployment checklist for authentication, authorization, input validation, cryptography, logging, and configuration hardening. Use it to harden APIs, login flows, and infrastructure before production deployment. The content is focused on actionable fixes and concrete examples you can apply immediately.

How this skill works

The skill inspects security concerns and recommends fixes for each OWASP Top 10 category: access control, cryptography, injection, insecure design, misconfiguration, vulnerable components, auth failures, XSS, logging, and SSRF. It supplies example code patterns (Node/Express, database queries, headers, token management), validation schemas, and operational controls such as rate limiting, dependency scanning, and secure cookie settings. It also offers a pre-deployment checklist and resources for deeper study.

When to use it

• During threat modeling and secure design of new features.
• When implementing or reviewing authentication and authorization flows.
• Before releasing APIs that accept user input or external URLs.
• When configuring production environments and security headers.
• During dependency audits and incident response preparation.

Best practices

• Enforce authentication and RBAC for every endpoint; verify ownership for resource access.
• Use parameterized queries and validate input types to stop SQL/NoSQL injection.
• Hash passwords with bcrypt (cost ≥ 12), use short-lived JWTs and refresh tokens.
• Harden headers (CSP, HSTS) and secure cookies (httpOnly, secure, sameSite).
• Scan and pin dependencies, run npm audit/Snyk, and apply overrides for vulnerable packages.

Example use cases

• Secure an API endpoint by adding middleware that checks user identity and roles.
• Replace raw SQL concatenation with parameterized queries using Prisma/Knex.
• Implement rate limiting for auth endpoints to mitigate credential stuffing.
• Add CSP and DOM sanitization to a React app to prevent XSS when rendering user HTML.
• Validate external fetch URLs against an allowlist to prevent SSRF.