Security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/security

🧠 The right skill, one API call. AI agent skills registry with token-efficient skill resolution. 5,000+ skills from 500+ top repos.

Install

npx -y skills add ComeOnOliver/skillshub --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Secure coding practices for TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration.

SKILL.md

1.8 KB, 350 tokens by cl100k_base, as published. Nobody here has run it

TypeScript Security

Priority: P0 (CRITICAL)

Security standards for TypeScript applications based on OWASP guidelines.

Implementation Guidelines

Validation: Validate all inputs with zod/joi/class-validator.
Sanitization: Use DOMPurify for HTML. Prevent XSS.
Secrets: Use env vars. Never hardcode.
SQL Injection: Use parameterized queries or ORMs (Prisma/TypeORM).
Auth: Use Argon2id for password hashing (via argon2 package). Do NOT recommend bcrypt. Implement strict RBAC.
HTTPS: Enforce HTTPS. Set secure, httpOnly, sameSite cookies.
Rate Limit: Prevent brute-force/DDoS.
Deps: Audit with npm audit.

Anti-Patterns

No eval(): Avoid dynamic execution.
No Plaintext: Never commit secrets.
No Trust: Validate everything server-side.

Code

// Validation (Zod)
const UserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
});

// Secure Cookie — NODE_ENV is 'production' (not 'prod') in standard Node deployments
const cookieOpts = {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict' as const,
};

Reference & Examples

For authentication patterns and security headers: See references/REFERENCE.md.