About application-security
application-security is a skill for application development and security work, summarizing OWASP Top 10 (2021) risks and prevention measures. It covers areas including access control, cryptography, injection, authentication, and monitoring.
Key features
- 01Summarizes OWASP Top 10 (2021) risks
- 02Recommends access control and encryption safeguards
- 03Shows parameterized queries to reduce injection risk
- 04Covers authentication, dependencies, and configuration
- 05Describes security-event logging and anomaly monitoring
Use cases
- 01Reviewing common risks in application designs
- 02Improving database queries and permission checks
- 03Planning dependency audits and security monitoring
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/application-securityin Claude Code to confirm it loaded.
Details
From the project READMEApplication Security
OWASP Top 10 (2021)
1. Broken Access Control
Risk: Users accessing unauthorized resources.
Prevention:
- Deny by default
- Implement RBAC/ABAC
- Validate permissions server-side
- Log access failures
2. Cryptographic Failures
Risk: Sensitive data exposure.
Prevention:
- Encrypt data at rest and in transit
- Use strong algorithms (AES-256, RSA-2048+)
- Never store passwords in plaintext
- Use secure key management
3. Injection
Risk: Malicious input executed as code.
Prevention:
// BAD - SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD - Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
db.query(query, [userId]);
4. Insecure Design
Risk: Missing security controls by design.
Prevention:
- Threat modeling
- Security requirements
- Defense in depth
5. Security Misconfiguration
Risk: Default or weak configuration.
Prevention:
- Disable unnecessary features
- Remove default credentials
- Keep software updated
- Harden server configuration
6. Vulnerable Components
Risk: Using libraries with known vulnerabilities.
Prevention:
- Regular dependency audits
- Keep dependencies updated
- Monitor CVE databases
7. Authentication Failures
Risk: Weak or broken authentication.
Prevention:
- Multi-factor authentication
- Strong password policies
- Secure session management
- Rate limiting on login
8. Software & Data Integrity
Risk: Untrusted sources for updates.
Prevention:
- Verify code signatures
- Use SRI for CDN resources
- Secure CI/CD pipeline
9. Logging & Monitoring Failures
Risk: Attacks go undetected.
Prevention:
- Log security events
- Monitor for anomalies
- Alert on suspicious activity
10. Server-Side Request Forgery
Risk: Server makes requests to unintended destinations.
Prevention:
- Validate URLs
- Use allowlists
- Block internal IPs