# Build Secure Backend Services

Backend flaws can expose data, accounts, and infrastructure. This skill guides secure implementation and review using established defensive patterns.

## Install

```bash
npx skillstore add sickn33/backend-security-coder
```

## Metadata

- Status: approved
- Slug: sickn33-backend-security-coder
- Skillstore revision: r2
- Version status: missing
- Tree hash: 90e9044d5512a36e78e286c1059fd5fc45541000e577020f7819f3ef120aef81
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/backend-security-coder
- Ref: 5a26d1d61d694db29af9b138c661c1981076d9df
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-backend-security-coder
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-backend-security-coder/manifest

## Capabilities

- Reviews backend designs and endpoints for common injection, authentication, authorization, session, CSRF, SSRF, and information disclosure risks.
- Guides allowlist validation, parameterized database access, context-aware output encoding, and secure error handling.
- Recommends secure JWT, OAuth, password, multifactor authentication, cookie, and session management patterns.
- Advises on API controls including rate limits, payload limits, content-type validation, CORS, and security headers.
- Guides safer outbound requests using destination allowlists, protocol restrictions, timeouts, response limits, and certificate validation.
- Produces implementation steps, review findings, verification guidance, and security-focused test recommendations.

## Use Cases

- Harden a New API: Design validation, authentication, authorization, rate limiting, error handling, and logging before implementation begins.
- Review a Service Change: Identify security weaknesses in an endpoint or data flow and receive prioritized remediation guidance.
- Define Secure Delivery Criteria: Create practical security requirements and verification checks for backend work entering a release.

## Prompt Templates

### Check an Endpoint

```
Review this backend endpoint for security risks. Focus on input validation, authorization, data exposure, and error handling. Explain each recommended change.
```

### Design Secure Authentication

```
Design authentication for this application using the provided framework and requirements. Cover credential storage, sessions, recovery, rate limits, and audit events.
```

### Harden an External Integration

```
Assess this outbound request flow for SSRF and data leakage. Propose destination validation, network restrictions, timeouts, response limits, and monitoring.
```

### Implement a Threat-Driven Fix

```
Use the architecture, threat model, and code context below to implement prioritized fixes. Include assumptions, residual risks, negative tests, and rollout checks.
```

## Limitations

- It does not execute scanners, penetration tests, dependency checks, or runtime verification by itself.
- Recommendations require adaptation to the selected language, framework, architecture, threat model, and deployment environment.
- It cannot confirm that deployed controls work without source code, configuration, logs, and test evidence.
- It does not replace specialist review for regulated systems, cryptographic design, or high-impact production changes.

## Best Practices

- Provide the language, framework, trust boundaries, data sensitivity, deployment model, and relevant code or configuration.
- Ask for prioritized findings with assumptions, exploitation conditions, remediation steps, tests, and residual risks.
- Validate recommendations through focused tests, framework documentation, peer review, and production monitoring.

## Anti Patterns

- Do not request generic hardening advice without sharing architecture, code context, and attacker-controlled inputs.
- Do not apply authentication or cryptography changes without migration, rollback, compatibility, and key-management planning.
- Do not treat generated guidance as proof that a control is correctly implemented or deployed.

## Security Audit

- Audited at: 2026-08-14T09:44:39.665\+00:00
- Summary: The only static finding is a false positive because line 24 uses Markdown backticks around a resource path, not executable shell syntax. The prompt contains defensive security guidance and no evidence of executable behavior, data exfiltration intent, or prompt injection.

## Stats

- Views: 74
- Downloads: 20
- Favorites: 0
- Popularity score: 0