agentsclimarketplace
Sign in

Mern sec

Skill edfenton/claude-skills/mern/mern-sec

Security policy for MERN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations.From its SKILL.md

Install
npx -y skills add edfenton/claude-skills --skill mern-sec

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.2 KB, 239 tokens by cl100k_base, as published. Nobody here has run it

Purpose

Ensure MERN code is secure by default. For security output format and core refusal policy, see /shared-sec-baseline.

MERN-specific security concerns (always check)

  1. NoSQL injection — reject $-prefixed and dot-notation keys from user input
  2. Input validation — schema validation (Zod/Joi) at every API boundary
  3. XSS — React escapes by default; audit dangerouslySetInnerHTML and raw HTML rendering
  4. CSRF — required when using cookie-based auth; use tokens or SameSite=Strict
  5. Auth/authz gaps — verify authorization on every protected route handler, not just frontend
  6. Token storage — avoid localStorage for sensitive tokens without justification; prefer httpOnly cookies

Standard security (brief check)

  • Error responses: safe envelopes, no stack traces or internal details
  • Rate limiting: on auth endpoints, expensive operations, public APIs
  • Dependencies: lockfile committed, no known critical vulnerabilities

Reference

For detailed OWASP/CWE mitigation patterns, see reference/mern-sec-reference.md

What ships with it: 1 file

6.0 KB alongside SKILL.md

reference/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.