About

Imported from shipshitdev/skills (skills/security-expert/SKILL.md). Install upstream with npx skills add shipshitdev/skills --skill security-expert. Copyright stays with the author.

Security Expert Skill

Name: security-expert
Author: shipshitdev

When to Use

Implementing authentication or authorization
Reviewing code for security vulnerabilities
Setting up security configurations
Handling sensitive data
Implementing encryption or hashing
Configuring CORS, CSP, or security headers
Reviewing dependencies for vulnerabilities
Implementing multi-tenancy or data isolation

Project Context Discovery

Check .agents/memory/ for security architecture notes and project facts
Review the applicable AGENTS.override.md / AGENTS.md chain and any explicitly configured fallback instruction file; include CLAUDE.md only for Claude-specific rules
Identify security patterns and tools
Check for [project]-security-expert skill

Core Security Principles

Authentication & Authorization

Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO

Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement

Input Validation

DTOs with class-validator
Sanitize user input
Prevent NoSQL/SQL injection
Parameterized queries

Data Protection

Encryption at rest and in transit
Passwords hashed (never plaintext)
Environment variables for secrets
No secrets in code

Security Headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security
Content Security Policy

OWASP Top 10 Quick Reference

Broken Access Control: Verify auth on all endpoints
Cryptographic Failures: Strong encryption, proper hashing
Injection: Parameterized queries, input validation
Insecure Design: Security by design, threat modeling
Security Misconfiguration: Secure defaults, remove unused features
Vulnerable Components: Keep dependencies updated
Authentication Failures: Strong passwords, MFA, brute force protection
Integrity Failures: Secure CI/CD, code signing
Logging Failures: Comprehensive logging, monitoring
SSRF: Validate URLs, whitelist domains

Security Checklist Summary

For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/shipshitdev-skills-security-expert/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

shipshitdev-skills-security-expert.ocm.jsonjson

{
  "ocm": "1",
  "id": "shipshitdev-skills-security-expert",
  "kind": "skill",
  "name": "security-expert",
  "description": "Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing.",
  "publisher": "shipshitdev",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "security",
      "owasp",
      "application-security",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications. Use when implementing authentication or authorization, reviewing code for vulnerabilities, handling sensitive data, or implementing encryption or hashing."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/shipshitdev/skills",
      "path": "skills/security-expert/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/shipshitdev/skills/blob/HEAD/skills/security-expert/SKILL.md",
      "key": "shipshitdev/skills/skills/security-expert/SKILL.md"
    }
  },
  "instructions": "# Security Expert Skill\n\n## When to Use\n\n- Implementing authentication or authorization\n- Reviewing code for security vulnerabilities\n- Setting up security configurations\n- Handling sensitive data\n- Implementing encryption or hashing\n- Configuring CORS, CSP, or security headers\n- Reviewing dependencies for vulnerabilities\n- Implementing multi-tenancy or data isolation\n\n## Project Context Discovery\n\n1. Check `.agents/memory/` for security architecture notes and project facts\n2. Review the applicable `AGENTS.override.md` / `AGENTS.md` chain and any explicitly configured fallback instruction file",
  "cost": {
    "context_tokens": 658
  }
}

Fetch it by URL: GET /api/v1/registry/shipshitdev-skills-security-expert/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.