Agent skill · security · aiskillstore
security-fundamentals
Auto-invoke when reviewing authentication, authorization, input handling, data exposure, or any user-facing code. Enforces OWASP top 10 awareness and security-first thinking.
Why this skill is useful
Provides a comprehensive checklist and specific examples for enforcing OWASP top 10 security practices that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Fundamentals Review "Security is not a feature. It's a foundation. Build on sand, and the house falls." When to Apply Activate this skill when reviewing: Authentication/login flows Authorization checks User input handling Database queries File uploads API endpoints Data exposure in responses --- Review Checklist Input Validation (NEVER Trust the Client) [ ] All inputs validated: Is every user input checked before use? [ ] Server-side validation: Is validation done on the server, not just client? [ ] Type checking: Are expected types enforced? [ ] Length limits: Are string lengths bounded? [ ] Whitelist over blacklist: Are allowed values explicitly defined? Authentication [ ] Password hashing: Are passwords hashed (bcrypt, argon2), not encrypted? [ ] No plaintext secrets: Are secrets in env vars, not code? [ ] Token expiry: Do JWTs/sessions have reasonable expiration? [ ] Secure transmission: Is HTTPS enforced? Authorization [ ] Ownership checks: Can users only access THEIR data? [ ] Role verification: Are admin routes protected by role checks? [ ] No client-side auth: Is authorization enforced server-side? Data Exposure [ ] Minimal response: Does the API return only necessary fields? [ ] No sensitive data in URLs: Are tokens/IDs not in query strings? [ ] No sensitive data in logs: Are passwords/tokens excluded from logs? --- OWASP Top 10 Quick Check 1. Injection (SQL, NoSQL, Command) 2. Broken Authentication 3. Sensitive Data Exposure 4. Broken Access Control 5. Security Misconfiguration 6. Cross-Site Scripting (XSS) --- Socratic Questions Ask the junior these questions instead of giving answers: 1. Trust: "What stops a malicious user from sending anything they want here?" 2. Ownership: "How do you know this user owns this resource?" 3. Exposure: "What's the worst thing that could happen if this endpoint is exposed?" 4. Secrets: "If I git clone this repo, what secrets would I see?" 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-fundamentals