mcpField
W
web-security

web-security

github.com/academindSecurity11297 installsUpdated 40w ago
Repository

About web-security

A web-security skill for developers that sets out defensive practices for handling untrusted input, authentication, browser boundaries, data, and dependencies. It emphasizes validation, restricted exposure, and secure defaults.

Key features

  1. 01Validate and sanitize input
  2. 02Prevent XSS and injection
  3. 03Protect authentication and authorization
  4. 04Apply CORS and CSP boundaries
  5. 05Minimize sensitive data exposure
  6. 06Assess third-party dependencies

Use cases

  1. 01Review input handling in a web application
  2. 02Choose safer storage for credentials
  3. 03Set browser security policies
  4. 04Reduce sensitive data in logs

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/academind/ai-config --skill web-security

After installing, type/web-securityin Claude Code to confirm it loaded.

Details

From the project README

Web Security

We treat web security as a core requirement, not an afterthought. Assume hostile input and untrusted environments by default.

Core Principles

  • NEVER trust user input
  • ALWAYS validate and sanitize data at boundaries
  • Prefer secure defaults over configurability

XSS & Injection

  • AVOID dangerouslySetInnerHTML and raw HTML injection
  • Escape and encode dynamic content properly
  • Never interpolate untrusted data into HTML, CSS, or JS contexts
  • Ensure SQL injection protection

Authentication & Authorization

  • Do not store secrets or tokens in insecure locations
  • AVOID localStorage for sensitive credentials when possible
  • Use HTTP-only, secure cookies where applicable
  • Always enforce authorization on the server

Browser Security APIs

  • Respect CORS, CSP, and browser security boundaries
  • Use Content Security Policy to restrict script and resource execution
  • Avoid inline scripts and styles when CSP is enabled

Data Handling

  • Minimize data exposure
  • Do not log sensitive information

Dependencies & Supply Chain

  • Avoid unnecessary packages
  • Treat third-party code as untrusted input

General Principles

  • Simplicity reduces attack surface
  • If unsure, choose the more restrictive option

Comments

Markdown supported