mcpField
S
security

security

github.com/htlin222Security7840 installsUpdated 3w ago
Repository

About security

A security review skill for developers assessing code and architecture or implementing safer application practices. It organizes checks around the OWASP Top 10 and provides an audit report format.

Key features

  1. 01OWASP Top 10 review checklist
  2. 02Security header recommendations
  3. 03Authentication implementation examples
  4. 04Severity-based audit report format

Use cases

  1. 01Review authentication and authorization code
  2. 02Check an application before production deployment
  3. 03Assess handling of sensitive data

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/htlin222/dotfiles --skill security

After installing, type/securityin Claude Code to confirm it loaded.

Details

From the project README

Security Audit

Identify vulnerabilities and implement secure coding practices.

When to Use

  • Security review of code or architecture
  • Implementing authentication/authorization
  • Before deploying to production
  • User asks about security best practices
  • Handling sensitive data

OWASP Top 10 Checklist

  1. Injection - Parameterized queries, input sanitization
  2. Broken Auth - Strong sessions, MFA, secure password storage
  3. Sensitive Data - Encryption at rest and transit, minimal exposure
  4. XXE - Disable external entities, use JSON over XML
  5. Broken Access Control - RBAC, deny by default
  6. Misconfiguration - Secure defaults, remove debug info
  7. XSS - Output encoding, CSP headers
  8. Insecure Deserialization - Validate input, avoid native serialization
  9. Vulnerable Components - Dependency scanning, updates
  10. Logging - Audit logs, no sensitive data in logs

Security Headers

Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

Auth Implementation

// Password hashing
const hash = await bcrypt.hash(password, 12);

// JWT with short expiry
const token = jwt.sign({ userId }, secret, { expiresIn: "15m" });

// Refresh token rotation
const refreshToken = crypto.randomBytes(32).toString("hex");

Audit Output Format

## Security Audit Report

**Severity Levels:** Critical | High | Medium | Low

### Critical

- [Issue]: [Description] → [Fix]

### High

- [Issue]: [Description] → [Fix]

### Recommendations

- [Improvement suggestion]

Examples

Input: "Review auth implementation" Action: Check password storage, session management, token handling, report findings

Input: "Make this API secure" Action: Add input validation, auth checks, rate limiting, security headers

Comments

Markdown supported