security-checklist
Apply OWASP Top 10 Security Best Practices
Applications often ship with critical security vulnerabilities. This skill provides AI agents with comprehensive security checklists based on OWASP Top 10. Agents can use it to identify and prevent vulnerabilities like injection attacks, broken authentication, and sensitive data exposure before code reaches production.
Télécharger le ZIP du skill
Importer dans Claude
Allez dans Paramètres → Capacités → Skills → Importer un skill
Activez et commencez à utiliser
Tester
Utilisation de "security-checklist". Review this authentication code for security issues
Résultat attendu:
- Password hashing uses bcrypt (strong algorithm)
- Session cookies missing HTTPOnly flag - add SESSION_COOKIE_HTTPONLY = True
- Rate limiting configured (5 attempts per 15 minutes)
- Generic error messages used (no username enumeration)
- MFA not implemented - recommend adding TOTP or SMS verification
Utilisation de "security-checklist". Check my API endpoints for broken access control
Résultat attendu:
- GET /api/users/:id missing authorization check - add ownership verification
- Admin routes require admin role (correct)
- All endpoints use parameterized queries (correct)
- Consider adding rate limiting to prevent enumeration
Audit de sécurité
SûrThis skill is a pure markdown knowledge base containing only security documentation and educational code examples. No executable code, network calls, filesystem access, or external commands are present. All static findings (194 patterns) are false positives triggered by educational examples showing both vulnerable and secure coding patterns for documentation purposes.
Facteurs de risque
⚡ Contient des scripts (2)
⚙️ Commandes externes (2)
🌐 Accès réseau (2)
Score de qualité
Ce que vous pouvez construire
Secure API Endpoints
Review authentication and authorization logic for protected endpoints. Prevent IDOR and privilege escalation.
Prevent Injection Attacks
Implement parameterized queries and output encoding. Block XSS, SQL injection, and command injection.
Dependency Vulnerability Scanning
Run npm audit, pip-audit, and other tools. Track critical findings and block deployments with vulnerabilities.
Essayez ces prompts
Review the following code for security vulnerabilities using the Security Checklist skill. Check for OWASP Top 10 issues including injection attacks, authentication weaknesses, and missing security headers.
Audit the authentication implementation. Verify password hashing, session management, MFA support, and rate limiting according to security best practices.
Run a dependency vulnerability scan. Use npm audit for JavaScript or pip-audit for Python projects. Report critical and high severity findings.
Review all API endpoints for broken access control. Verify authorization checks, IDOR prevention, and RBAC implementation for each protected route.
Bonnes pratiques
- Validate all user input using allowlists, not denylists
- Use parameterized queries for all database operations
- Implement defense in depth with multiple security layers
- Log security events without capturing sensitive data
Éviter
- Using string concatenation to build SQL queries
- Storing passwords with MD5 or SHA1 hashing
- Leaving debug mode enabled in production
- Exposing stack traces or error details to users