security_skill

Overview

This skill reviews TypeScript implementations for security vulnerabilities and best practices, producing a pass/fail report with findings and concrete recommendations. It focuses on input validation, injection prevention, auth/authz, secrets handling, data protection, and dependency risks. Use it after code review and before merging changes.

How this skill works

The skill loads the spec group and implementation evidence, identifies entry points and data flows, and runs targeted checks across source files. It inspects input validation, database and shell usage, authentication and authorization logic, secret handling, logging, encryption practices, and dependency vulnerabilities, then aggregates findings into a structured security report. The process enforces prerequisites and halts if code review or implementation status is not satisfied.

When to use it

• After code review and when all atomic specs are implemented
• Any change that handles user input or external requests
• Authentication or authorization logic changes
• API endpoints, data access, or database queries
• File system operations, shell execution, or crypto changes

Best practices

• Run security review after passing code review to avoid noise from quality issues
• Validate every user input with a schema (Zod/Joi) and enforce length/enum whitelists
• Use parameterized queries or an ORM; never concatenate user input into SQL
• Ensure endpoints enforce authentication and explicit authorization checks
• Keep secrets out of code, use environment variables, and avoid logging sensitive values
• Run dependency audits and keep lockfiles committed

Example use cases

• Review a new login or registration endpoint for validation, password hashing, and token handling
• Audit a data-access endpoint for SQL injection and proper authorization checks
• Verify a feature that spawns processes or calls shell commands to prevent command injection
• Check infrastructure-related code (CDKTF) for secrets in config or misconfigured access controls
• Run a quick pass on UI-only changes to confirm no accidental data exposure