Agent skill · security · daffy0208
Security Engineer
Implement security best practices across the application stack. Use when securing APIs, implementing authentication, preventing vulnerabilities, or conducting security reviews. Covers OWASP Top 10, auth patterns, input validation, encryption, and security monitoring.
Why this skill is useful
Provides domain-specific knowledge on security best practices, including authentication patterns and input validation techniques that the AI wouldn't reliably generate on its own.
What it needs
About 9k tokens when loaded. Last updated 2025-12-25. 33 stars on the source repository.
What this skill does
Security Engineer Security is not optional - build it in from day one. Core Principle Security is built-in, not bolted-on. Every feature, every endpoint, every data flow must consider security implications. Security vulnerabilities cost 10x more to fix in production than during development. 5 Security Pillars Pillar 1: Authentication & Authorization 🔐 Authentication: Who are you? Authorization: What can you do? Authentication Strategies JWT (JSON Web Tokens): When: Stateless APIs, mobile apps, microservices How: Sign tokens with secret, store in httpOnly cookies or Authorization header Security: Use RS256 (not HS256), short expiry (15min access, 7d refresh) Session-Based: When: Traditional web apps, server-side rendering How: Server stores session ID in encrypted cookie Security: HttpOnly, Secure, SameSite=Strict cookies OAuth 2.0 / OIDC: When: Social login, third-party integrations How: Use NextAuth.js, Passport.js, or Auth0 Security: Validate state parameter, use PKCE for mobile Authorization Patterns RBAC (Role-Based Access Control): ABAC (Attribute-Based): More granular: user can edit resource if they created it Example: User can delete post only if post.authorId === user.id Key Principles: ✅ Always verify authentication before authorization ✅ Default deny (whitelist, not blacklist) ✅ Check permissions on server, never trust client ✅ Re-verify permissions before critical actions --- Pillar 2: Input Validation & Sanitization 🛡️ Never trust user input - validate, sanitize, escape everything. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills daffy0208/security-engineer