Agent skill · security · aiskillstore
security-best-practices
Implement security best practices for web applications and infrastructure. Use when securing APIs, preventing common vulnerabilities, or implementing security policies. Handles HTTPS, CORS, XSS, SQL Injection, CSRF, rate limiting, and OWASP Top 10.
Why this skill is useful
Adds specific implementation patterns for securing web applications that the AI wouldn't reliably generate on its own.
What it needs
Requires cookie-parser, csurf, express, express-rate-limit, helmet, isomorphic-dompurify, joi installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Best Practices When to use this skill New project: consider security from the start Security audit: inspect and fix vulnerabilities Public API: harden APIs accessible externally Compliance: comply with GDPR, PCI-DSS, etc. Instructions Step 1: Enforce HTTPS and security headers Express.js security middleware: Step 2: Input validation (SQL Injection, XSS prevention) Joi validation: Step 3: Prevent CSRF CSRF Token: Step 4: Manage secrets .env (never commit): Kubernetes Secrets: Step 5: Secure API authentication JWT + Refresh Token Rotation: Constraints Required rules (MUST) 1. HTTPS Only: HTTPS required in production 2. Separate secrets: manage via environment variables; never hardcode in code 3. Input Validation: validate all user input 4. Parameterized Queries: prevent SQL Injection 5. Rate Limiting: DDoS prevention Prohibited items (MUST NOT) 1. No eval(): code injection risk 2. No direct innerHTML: XSS risk 3. No committing secrets: never commit .env files OWASP Top 10 checklist Best practices 1. Principle of Least Privilege: grant minimal privileges 2. Defense in Depth: layered security 3. Security Audits: regular security reviews References OWASP Top 10 helmet.js Security Checklist Metadata Version Current version: 1.0.0 Last updated: 2025-01-01 Compatible platforms: Claude, ChatGPT, Gemini Related skills authentication-setup deployment Tags #security #OWASP #HTTPS #CORS #XSS #SQL-injection #CSRF #infrastructure Examples Example 1: Basic usage <!-- Add example content here --> Example 2: Advanced usage <!-- Add advanced example content here -->
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-best-practices