Security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/security

Secure coding practices for TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration.From its SKILL.md

Install

npx -y skills add ComeOnOliver/skillshub --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.8 KB, 350 tokens by cl100k_base, as published. Nobody here has run it

TypeScript Security

Priority: P0 (CRITICAL)

Security standards for TypeScript applications based on OWASP guidelines.

Implementation Guidelines

Validation: Validate all inputs with zod/joi/class-validator.
Sanitization: Use DOMPurify for HTML. Prevent XSS.
Secrets: Use env vars. Never hardcode.
SQL Injection: Use parameterized queries or ORMs (Prisma/TypeORM).
Auth: Use Argon2id for password hashing (via argon2 package). Do NOT recommend bcrypt. Implement strict RBAC.
HTTPS: Enforce HTTPS. Set secure, httpOnly, sameSite cookies.
Rate Limit: Prevent brute-force/DDoS.
Deps: Audit with npm audit.

Anti-Patterns

No eval(): Avoid dynamic execution.
No Plaintext: Never commit secrets.
No Trust: Validate everything server-side.

Code

// Validation (Zod)
const UserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
});

// Secure Cookie — NODE_ENV is 'production' (not 'prod') in standard Node deployments
const cookieOpts = {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict' as const,
};

Reference & Examples

For authentication patterns and security headers: See references/REFERENCE.md.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.