skills.rest
Yoodaddy0311
Yoodaddy0311COMMUNITY
Explore all skills by this author →
GitHub

security-standards

Enforces OWASP Top 10 security checklists, secret management, and input validation during code changes.

3|2|Updated Feb 13, 2026
Search Tags:#code review#security#secret management#authentication#input validation#sql injection#owasp
One-click install
npx skills add https://github.com/Yoodaddy0311/artibot --skill security-standards-yoodaddy0311
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-standards
Source: https://github.com/Yoodaddy0311/artibot/tree/main/plugins/artibot/skills/security-standards
Command: npx skills add https://github.com/Yoodaddy0311/artibot --skill security-standards-yoodaddy0311

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Code changes involving APIs, authentication, or user input often ship with preventable vulnerabilities like hardcoded secrets, SQL injection, and missing authorization. This Skill applies a structured security checklist with human checkpoints so critical issues are caught before commit or deployment. ## Core Features & Use Cases - OWASP Top 10 Coverage: A mandatory pre-commit checklist covering injection, broken access control, cryptographic failures, SSRF, and more, backed by a detailed references/owasp-checklist.md. - Secret & Input Validation Patterns: Concrete TypeScript examples for environment-variable secret loading with guards and Zod schema validation of untrusted input. - Threat Response Protocol: A five-step procedure (stop, assess, fix, rotate, search) for handling discovered vulnerabilities, plus severity-based dependency audit guidance. - Use Case: While adding a new authenticated API endpoint, the Skill walks you through verifying parameterized queries, CSRF protection, rate limiting, and auth coverage, with human checkpoints before proceeding past secrets exposure and SQL injection review. ## Quick Start Review this new API endpoint code against the security standards checklist and flag any hardcoded secrets, injection risks, or missing authentication.

Frequently Asked Questions about security-standards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my code for OWASP Top 10 vulnerabilities before committing?▼

Run the mandatory pre-commit checklist: scan for hardcoded secrets, validate all user inputs with a schema library like Zod, verify parameterized queries, and confirm XSS and CSRF protections. The references/owasp-checklist.md file maps each check to its OWASP category.

How should API keys and secrets be stored in Node.js applications?▼

Store secrets in environment variables loaded via process.env with a throw guard if undefined, never hardcoded in source. Use .env.local files excluded by .gitignore, and rotate any secret that was ever committed to version control.

What is the correct way to validate user input in Express APIs?▼

Parse every request body through a schema validator such as Zod before use, replacing req.body with the validated result. Client-side validation is only a UX hint; server handlers must re-validate because attackers bypass frontends with direct HTTP requests.

When should the full security checklist not be applied?▼

Skip the full checklist for internal CLI tools with no network exposure, local-only scripts, or test fixtures where the attack surface is zero. In those cases, scale down to a secret-check only rather than running all eight workflow steps.

How do I handle dependency vulnerabilities found in an audit?▼

Run npm audit and fail CI on high severity or above. Update vulnerable dependencies immediately when possible; otherwise document an explicit risk acceptance or block the release until Critical vulnerabilities are resolved.

Related Skills

Explore More Software Engineering Skills→
sarkarshivaditya-labsarkarshivaditya-lab

security-review

Reviews security-sensitive code changes against the OWASP Top 10 checklist.

Community
Intermediate
bjornslibbjornslib

codebase-quality:security

Scan codebases for secrets, dependency vulnerabilities, and injection risks.

Community
Advanced
pascallammerspascallammers
1

threat-hunting

Analyzes network traffic, authentication logs, and system configurations to detect anomalies and potential compromises.

Community
Advanced
Kisilev13Kisilev13

security-arsenal

Provide security payloads for XSS, SSRF, SQLi, and other web vulnerabilities.

Community
Advanced