skills.rest
IagoPrandi
IagoPrandiCOMMUNITY
Explore all skills by this author →
GitHub

security-best-practices

Review code against language and framework security best practices and generate prioritized vulnerability reports.

Updated Jul 28, 2026
Search Tags:#OWASP#xss#secure coding#security review#code audit#CSRF#vulnerability report
One-click install
npx skills add https://github.com/IagoPrandi/zeroclaw-plugin --skill security-best-practices-iagoprandi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/IagoPrandi/zeroclaw-plugin/tree/main/.claude/skills/security-best-practices
Command: npx skills add https://github.com/IagoPrandi/zeroclaw-plugin --skill security-best-practices-iagoprandi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Codebases often ship with preventable vulnerabilities like SQL injection, XSS, CSRF gaps, and misconfigured cookies because developers lack framework-specific security guidance at the moment they write or review code. ## Core Features & Use Cases - Secure-by-Default Code Generation: Loads reference guidance for the detected language and framework (Python, JavaScript/TypeScript, Go) so new code follows security best practices from the start. - Passive Vulnerability Detection: Flags critical security issues in existing code while you work, focusing on high-impact findings and secure defaults. - Prioritized Security Reports: Produces a severity-organized Markdown report with numeric finding IDs, line-number references, and impact statements, then offers to fix findings one at a time. - Use Case: Ask for a security review of an Express.js backend and receive a report covering session storage, CSRF protection, CORS policy, and cookie flags, with safe minimal fixes for each finding. ## Quick Start Ask the assistant to perform a security best practices review of this project and write a prioritized vulnerability report.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my codebase?▼

Ask for a security best practices review or vulnerability report. The skill detects your languages and frameworks, loads matching reference guidance, and writes a severity-organized Markdown report with line-numbered findings before offering fixes.

What languages and frameworks does the security review support?▼

The skill supports Python, JavaScript/TypeScript, and Go, with dedicated reference files for stacks like Express web servers and general browser frontend JavaScript. If no matching reference exists, it falls back to well-known best practices and notes the gap.

Can it write secure code instead of only auditing existing code?▼

Yes, secure-by-default generation is the primary mode. Once the language and framework are identified, the loaded guidance is applied to all new code it writes, covering areas like CSRF protection, cookie flags, and parameterized queries.

Does the security skill fix vulnerabilities automatically?▼

No, it asks before fixing. After a report, you confirm which findings to address, and it fixes one finding at a time with concise comments, following your existing test and commit flows to avoid regressions.

What are the limitations of automated security best-practice reviews?▼

Findings are evidence-based from visible code, so controls living in infrastructure like proxies, WAFs, or edge configs are reported as needing runtime verification. It also avoids flagging TLS absence in development and does not recommend HSTS.

Related Skills

Explore More Software Engineering Skills→
fearovexfearovex

project-analyze

Detect a project's structure, stack, and conventions into analysis-report.md and ai-context/ sections.

Community
Advanced
withzombieswithzombies
80

refactoring-safely

Refactor code incrementally while preserving behavior through test cycles.

Community
Intermediate
ClearMeasureLabsClearMeasureLabs
3

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

Official
Advanced
MathiasPaulenkoMathiasPaulenko

k6-load-testing

Automate k6 load testing for web services and APIs.

Community
Advanced