skills.rest
lunaticwithaduck
lunaticwithaduckCOMMUNITY
Explore all skills by this author →
GitHub

security

Implements OWASP Top 10 prevention, input validation, and security headers for web applications.

2|Updated Jun 8, 2026
Search Tags:#security#authentication#sql injection#rate limiting#owasp#security headers#xss prevention
One-click install
npx skills add https://github.com/lunaticwithaduck/easytech3d --skill security-lunaticwithaduck
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/lunaticwithaduck/easytech3d/tree/main/.claude/skills/security
Command: npx skills add https://github.com/lunaticwithaduck/easytech3d --skill security-lunaticwithaduck

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications face constant threats from injection attacks, XSS, CSRF, and misconfigured security settings. This Skill provides a structured reference for identifying and preventing the OWASP Top 10 vulnerabilities, so developers can harden applications without memorizing every attack vector. ## Core Features & Use Cases - OWASP Top 10 Prevention: Quick-reference table mapping each vulnerability class to concrete prevention strategies and priority levels. - Input Validation & Sanitization: Zod-based validation patterns for API endpoints, forms, URL parameters, and file uploads, with allowlist-first rules. - XSS, SQL Injection & CSRF Defense: Code-level guidance on output encoding, DOMPurify sanitization, parameterized Prisma queries, and SameSite cookie strategies. - Security Headers & Auth Hardening: Helmet.js and Next.js header configurations, bcrypt password hashing, token storage rules, rate limiting, and CORS setup. - Use Case: Before shipping a Next.js storefront, run through the included security audit checklist to confirm server-side validation, secure headers, rate-limited auth endpoints, and audited dependencies. ## Quick Start Ask the AI to review your API route or authentication flow for OWASP vulnerabilities and suggest fixes using the security checklist.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent XSS attacks in React applications?▼

React escapes output by default, so rendering user input in JSX is safe. Never pass user input to dangerouslySetInnerHTML without sanitizing it with DOMPurify first, avoid eval() and document.write(), and configure a Content Security Policy header as a defense layer.

How to prevent SQL injection with Prisma?▼

Prisma queries are parameterized by default, so standard methods like findUnique are safe. For raw queries, use the $queryRaw tagged template which parameterizes values, and never use $queryRawUnsafe with user-supplied input.

What security headers should a Next.js app have?▼

Configure Strict-Transport-Security with a one-year max-age, X-Frame-Options or CSP frame-ancestors to prevent clickjacking, X-Content-Type-Options: nosniff, Referrer-Policy, and a Content-Security-Policy. Add them via the headers() function in next.config.js.

Does bcrypt password hashing slow down my server?▼

bcrypt is intentionally computationally expensive to resist brute-force attacks, but using the async API with 12 salt rounds keeps the Node.js event loop unblocked. Hashing happens only at signup and login, so the impact on normal request throughput is minimal.

How do I rate limit authentication endpoints in Express?▼

Use express-rate-limit with a strict window on auth routes, such as 5 attempts per 15 minutes with skipSuccessfulRequests enabled. Apply a separate, more permissive global limiter for general API traffic.

When should I use CSRF tokens versus SameSite cookies?▼

SameSite=Strict cookies are the default defense for cookie-based auth and cover most cases. Add CSRF tokens for traditional form-based apps, or use the double-submit cookie pattern for SPAs calling APIs with cookie credentials.

Related Skills

Explore More Software Engineering Skills→
yknothingyknothing
1

security-design

Codify security boundaries, threat models, and controls per architectural layer.

Community
Advanced
agentmattersagentmatters
3

canary-watch

Monitor deployed URLs for HTTP status, console errors, and performance regressions.

Official
Advanced
Camilo8902Camilo8902

api-security-hardener

Harden Express.js APIs with rate limiting, JWT authentication, and Zod validation.

Community
Advanced
NagyViktNagyVikt
2

vercel-firewall

Configure Vercel Firewall WAF rules, rate limiting, and OWASP protection.

Community
Advanced