Skills backend-security-coder
📦

backend-security-coder

Content revision r2 Safe ⚙️ External commands

Build Secure Backend Services

Backend flaws can expose data, accounts, and infrastructure. This skill guides secure implementation and review using established defensive patterns.

Supports: Claude Codex Code(CC)
🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "backend-security-coder" from https://skillstore.io/skills/sickn33-backend-security-coder.md and its manifest at https://skillstore.io/api/skills/sickn33-backend-security-coder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-backend-security-coder.md Signed manifest GET /api/skills/sickn33-backend-security-coder/manifest Signed lockfile GET /api/skills/sickn33-backend-security-coder/lockfile

Test it

Using "backend-security-coder". Review a profile update endpoint that accepts account identifiers and editable fields.

Expected outcome:

  • High priority: derive the account identity from the authenticated session instead of trusting a request identifier.
  • Validate editable fields with explicit types, lengths, and allowlists. Reject unknown fields.
  • Return generic client errors while recording structured, sanitized audit events.
  • Add tests for cross-account updates, malformed values, oversized payloads, and unexpected properties.

Using "backend-security-coder". Plan secure requests to a user-provided webhook destination.

Expected outcome:

  • Allow only approved HTTPS destinations and resolve addresses before connecting.
  • Block loopback, private, link-local, metadata, and redirect destinations.
  • Apply connection timeouts, response size limits, minimal outbound credentials, and sanitized logs.
  • Test alternate address formats, DNS changes, redirects, slow responses, and oversized responses.

Using "backend-security-coder". Define security requirements for cookie-based login sessions.

Expected outcome:

  • Use encrypted transport and cookies with Secure, HttpOnly, and appropriate SameSite attributes.
  • Rotate the session identifier after authentication and privilege changes.
  • Require CSRF protection for state-changing requests and invalidate sessions during logout and credential reset.
  • Monitor failed authentication, session anomalies, recovery attempts, and administrative actions.

Security Audit

Safe
v5 • 8/14/2026 Open versioned report

The only static finding is a false positive because line 24 uses Markdown backticks around a resource path, not executable shell syntax. The prompt contains defensive security guidance and no evidence of executable behavior, data exfiltration intent, or prompt injection.

1
Files scanned
161
Lines analyzed
0
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (1)
SKILL.md:24
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-backend-security-coder/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-backend-security-coder/security.svg)](https://skillstore.io/skills/sickn33-backend-security-coder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-backend-security-coder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-backend-security-coder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-backend-security-coder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). backend-security-coder security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-backend-security-coder/audits/5

BibTeX citation

@techreport{sickn33-sickn33-backend-security-coder-2026, author = {sickn33}, title = {backend-security-coder security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-backend-security-coder/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "backend-security-coder security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-08-14" url: "https://skillstore.io/skills/sickn33-backend-security-coder/audits/5" identifiers: - type: other value: "skillstore:sickn33-backend-security-coder:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Harden a New API

Design validation, authentication, authorization, rate limiting, error handling, and logging before implementation begins.

Review a Service Change

Identify security weaknesses in an endpoint or data flow and receive prioritized remediation guidance.

Define Secure Delivery Criteria

Create practical security requirements and verification checks for backend work entering a release.

Try These Prompts

Check an Endpoint 
Review this backend endpoint for security risks. Focus on input validation, authorization, data exposure, and error handling. Explain each recommended change.
Design Secure Authentication 
Design authentication for this application using the provided framework and requirements. Cover credential storage, sessions, recovery, rate limits, and audit events.
Harden an External Integration 
Assess this outbound request flow for SSRF and data leakage. Propose destination validation, network restrictions, timeouts, response limits, and monitoring.
Implement a Threat-Driven Fix 
Use the architecture, threat model, and code context below to implement prioritized fixes. Include assumptions, residual risks, negative tests, and rollout checks.

Best Practices

  • Provide the language, framework, trust boundaries, data sensitivity, deployment model, and relevant code or configuration.
  • Ask for prioritized findings with assumptions, exploitation conditions, remediation steps, tests, and residual risks.
  • Validate recommendations through focused tests, framework documentation, peer review, and production monitoring.

Avoid

  • Do not request generic hardening advice without sharing architecture, code context, and attacker-controlled inputs.
  • Do not apply authentication or cryptography changes without migration, rollback, compatibility, and key-management planning.
  • Do not treat generated guidance as proof that a control is correctly implemented or deployed.

Frequently Asked Questions

Which backend technologies does this skill support?
The guidance is technology-neutral and can adapt to common languages and frameworks when you provide their details.
Can it write security fixes?
Yes. It can propose or implement scoped fixes when you provide code, requirements, framework conventions, and expected behavior.
Can it perform a penetration test?
No. It can plan tests and review evidence, but it does not independently execute a penetration test.
Does it cover authentication and authorization?
Yes. It covers passwords, sessions, JWT, OAuth, multifactor authentication, roles, attributes, scopes, and least-privilege access.
How should I verify its recommendations?
Use automated and manual tests, framework documentation, peer review, staging validation, and monitoring appropriate to the identified risks.
Is it suitable for compliance approval?
It can help prepare controls and evidence, but qualified reviewers must make compliance and production approval decisions.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/backend-security-coder

Ref

5a26d1d61d694db29af9b138c661c1981076d9df

Maintenance freshness

8/15/2026

Usage

18 downloads · 74 views

File structure

📄 SKILL.md