Agent skill · security · personamanagmentlayer
security-expert
Expert-level application security, OWASP Top 10, penetration testing, and security best practices. Use when the user mentions OWASP, pentesting, appsec, vulnerability, encryption, or authentication, or when the task involves Security Principles, OWASP Top 10, Security Domains, or Broken Access Control.
Why this skill is useful
Provides detailed guidance on OWASP Top 10 vulnerabilities and secure coding practices that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-03-30. 41 stars on the source repository.
What this skill does
Security Expert Expert guidance for application security, vulnerability assessment, penetration testing, OWASP Top 10, secure coding practices, and security architecture. Core Concepts Security Principles Defense in depth Least privilege Secure by default Fail securely Complete mediation Separation of duties Zero trust architecture OWASP Top 10 (2021) 1. Broken Access Control 2. Cryptographic Failures 3. Injection 4. Insecure Design 5. Security Misconfiguration 6. Vulnerable and Outdated Components 7. Identification and Authentication Failures 8. Software and Data Integrity Failures 9. Security Logging and Monitoring Failures 10. Server-Side Request Forgery (SSRF) Security Domains Authentication & Authorization Cryptography Input validation Session management Error handling Secure communications Data protection Cryptography Encryption at Rest Secure Random Generation Input Validation Security Headers Secure Logging Best Practices Secure Development Lifecycle 1. Threat modeling 2. Security requirements 3. Secure coding standards 4. Code review 5. Security testing (SAST/DAST) 6. Vulnerability scanning 7. Penetration testing 8. Security monitoring Defense in Depth Multiple layers of security Assume breach mentality Principle of least privilege Input validation at every layer Output encoding Secure configuration Security Testing Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Interactive Application Security Testing (IAST) Software Composition Analysis (SCA) Penetration testing Bug bounty programs Anti-Patterns to Avoid ❌ Storing passwords in plaintext: Always hash with bcrypt/argon2 ❌ Rolling your own crypto: Use established libraries ❌ Trusting user input: Validate and sanitize everything ❌ Exposing sensitive errors: Use generic error messages ❌ No rate limiting: Implement rate limiting on all endpoints ❌ Weak session management: Use secure, httpOnly cookies ❌ No logging: Log security events for monitoring ❌ Hardcoded secrets: Us …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills personamanagmentlayer/security-expert