backend-security-coder
Build Secure Backend Services
Backend flaws can expose data, accounts, and infrastructure. This skill guides secure implementation and review using established defensive patterns.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "backend-security-coder" from https://skillstore.io/skills/sickn33-backend-security-coder.md and its manifest at https://skillstore.io/api/skills/sickn33-backend-security-coder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "backend-security-coder". Review a profile update endpoint that accepts account identifiers and editable fields.
Expected outcome:
- High priority: derive the account identity from the authenticated session instead of trusting a request identifier.
- Validate editable fields with explicit types, lengths, and allowlists. Reject unknown fields.
- Return generic client errors while recording structured, sanitized audit events.
- Add tests for cross-account updates, malformed values, oversized payloads, and unexpected properties.
Using "backend-security-coder". Plan secure requests to a user-provided webhook destination.
Expected outcome:
- Allow only approved HTTPS destinations and resolve addresses before connecting.
- Block loopback, private, link-local, metadata, and redirect destinations.
- Apply connection timeouts, response size limits, minimal outbound credentials, and sanitized logs.
- Test alternate address formats, DNS changes, redirects, slow responses, and oversized responses.
Using "backend-security-coder". Define security requirements for cookie-based login sessions.
Expected outcome:
- Use encrypted transport and cookies with Secure, HttpOnly, and appropriate SameSite attributes.
- Rotate the session identifier after authentication and privilege changes.
- Require CSRF protection for state-changing requests and invalidate sessions during logout and credential reset.
- Monitor failed authentication, session anomalies, recovery attempts, and administrative actions.
Security Audit
SafeThe only static finding is a false positive because line 24 uses Markdown backticks around a resource path, not executable shell syntax. The prompt contains defensive security guidance and no evidence of executable behavior, data exfiltration intent, or prompt injection.
Risk Factors
⚙️ External commands (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-backend-security-coder/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-backend-security-coder?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-backend-security-coder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-backend-security-coder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-backend-security-coder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). backend-security-coder security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-backend-security-coder/audits/5BibTeX citation
@techreport{sickn33-sickn33-backend-security-coder-2026,
author = {sickn33},
title = {backend-security-coder security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-backend-security-coder/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "backend-security-coder security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-08-14"
url: "https://skillstore.io/skills/sickn33-backend-security-coder/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-backend-security-coder:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Harden a New API
Design validation, authentication, authorization, rate limiting, error handling, and logging before implementation begins.
Review a Service Change
Identify security weaknesses in an endpoint or data flow and receive prioritized remediation guidance.
Define Secure Delivery Criteria
Create practical security requirements and verification checks for backend work entering a release.
Try These Prompts
Review this backend endpoint for security risks. Focus on input validation, authorization, data exposure, and error handling. Explain each recommended change.
Design authentication for this application using the provided framework and requirements. Cover credential storage, sessions, recovery, rate limits, and audit events.
Assess this outbound request flow for SSRF and data leakage. Propose destination validation, network restrictions, timeouts, response limits, and monitoring.
Use the architecture, threat model, and code context below to implement prioritized fixes. Include assumptions, residual risks, negative tests, and rollout checks.
Best Practices
- Provide the language, framework, trust boundaries, data sensitivity, deployment model, and relevant code or configuration.
- Ask for prioritized findings with assumptions, exploitation conditions, remediation steps, tests, and residual risks.
- Validate recommendations through focused tests, framework documentation, peer review, and production monitoring.
Avoid
- Do not request generic hardening advice without sharing architecture, code context, and attacker-controlled inputs.
- Do not apply authentication or cryptography changes without migration, rollback, compatibility, and key-management planning.
- Do not treat generated guidance as proof that a control is correctly implemented or deployed.
Frequently Asked Questions
Which backend technologies does this skill support?
Can it write security fixes?
Can it perform a penetration test?
Does it cover authentication and authorization?
How should I verify its recommendations?
Is it suitable for compliance approval?
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/backend-security-coderRef
5a26d1d61d694db29af9b138c661c1981076d9df
Maintenance freshness
8/15/2026
Usage
18 downloads · 74 views
File structure
📄 SKILL.md