Skills security-best-practices
📦
security-best-practices
Content revision r1 Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Harden Web Apps With Security Practices
Web applications often ship with weak headers, unchecked inputs, and unsafe secret handling. This skill guides Claude, Codex, and Claude Code through practical hardening steps for APIs and infrastructure.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "security-best-practices" from https://skillstore.io/skills/supercent-io-security-best-practices.md and its manifest at https://skillstore.io/api/skills/supercent-io-security-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "security-best-practices". Review an Express API before launch.
Expected outcome:
- Security headers and HSTS should be enabled for production traffic.
- Authentication endpoints need stricter rate limits than normal API routes.
- Input validation should reject malformed data before database access.
Using "security-best-practices". Plan secret handling for a hosted service.
Expected outcome:
- Keep database URLs and provider keys outside source control.
- Use managed secret storage or environment injection during deployment.
- Rotate secrets after exposure and document ownership for each credential.
Using "security-best-practices". Prepare an OWASP review summary.
Expected outcome:
- Broken access control requires route-level authorization checks.
- Injection risks require parameterized database access and strict validation.
- Security misconfiguration requires review of headers, CORS, and default credentials.
Security Audit
Medium Riskv4 • 7/7/2026 Open versioned report
Most static findings are false positives caused by Markdown fences, example snippets, placeholder secrets, and safety rules rather than executable behavior. No prompt injection, hidden exfiltration, or runtime command execution was found. The skill still needs content fixes because several security examples could teach weak production patterns.
2
Files scanned
304
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
Insecure Content Security Policy Example
The Helmet CSP example allows unsafe inline scripts and styles while presenting itself as XSS prevention guidance. This can normalize a weak CSP that fails to block common injected inline payloads.
The unsafe-inline directives are explicit in the CSP example and appear in a section about security headers. The risk is guidance quality rather than hidden code execution.
Medium
Host Header Trust in HTTPS Redirect
The HTTPS redirect example constructs the redirect target from req.headers.host. If copied directly, a forged Host header can produce untrusted redirect targets or poison generated URLs.
The redirect code directly interpolates req.headers.host without a trusted host allowlist. This is a known deployment risk, although the skill only presents example code.
Medium
Refresh Token Storage Without Hashing Guidance
The JWT example stores refresh tokens directly in the database and rotates them by exact token value. A database leak would expose valid bearer tokens unless tokens are hashed before storage.
The example clearly persists refreshToken values and does not mention hashing or token binding. Legitimate implementations vary, so confidence is high enough for remediation but not maximal.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (19)
SKILL.md:25-57 SKILL.md:57-81 SKILL.md:81-86 SKILL.md:86-105 SKILL.md:105-117 SKILL.md:117-122 SKILL.md:122-149 SKILL.md:149-154 SKILL.md:154-165 SKILL.md:165-168 SKILL.md:168-177 SKILL.md:177-179 SKILL.md:179-185 SKILL.md:185-190 SKILL.md:190-223 SKILL.md:223-243 SKILL.md:243-254 SKILL.md:254-280 SKILL.md:280
🌐 Network access (7)
📁 Filesystem access (2)
🔑 Env variables (9)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/supercent-io-security-best-practices/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/supercent-io-security-best-practices?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/supercent-io-security-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-security-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/supercent-io-security-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
supercent-io. (2026). security-best-practices security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-security-best-practices/audits/4BibTeX citation
@techreport{supercent-io-supercent-io-security-best-practices-2026,
author = {supercent-io},
title = {security-best-practices security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/supercent-io-security-best-practices/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-best-practices security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "supercent-io"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/supercent-io-security-best-practices/audits/4"
identifiers:
- type: other
value: "skillstore:supercent-io-security-best-practices:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Secure a New API
Add security headers, HTTPS enforcement, validation, CSRF protection, and rate limits before public launch.
Review Deployment Controls
Check secret handling, runtime configuration, HSTS settings, and production-safe security defaults.
Run an OWASP Checklist
Use the included OWASP Top 10 checklist to guide manual inspection and remediation planning.
Try These Prompts
Add Basic Protections
Use this skill to add HTTPS enforcement, security headers, and rate limiting to my web API. Explain each change in simple terms.
Review Input Handling
Use this skill to review my API input handling for SQL injection, XSS, and unsafe validation gaps. Prioritize concrete fixes.
Design Auth And Secrets
Use this skill to design secure JWT handling, refresh token rotation, and secret storage for my production service.
Audit Against OWASP
Use this skill to perform an OWASP Top 10 hardening review for my application. Return prioritized risks and remediation steps.
Best Practices
- Treat the examples as starting points and verify every setting against your production architecture.
- Use parameterized queries, strict validation, and output encoding for all user-controlled data.
- Store secrets outside source control and rotate credentials after suspected exposure.
Avoid
- Copying placeholder secrets, domains, or policies into production without review.
- Allowing inline scripts or broad origins when a strict CSP can be used.
- Building redirects, CORS rules, or trust decisions from unvalidated request headers.
Frequently Asked Questions
Does this skill scan my code automatically?
No. It provides guidance and review prompts for manual or AI-assisted security hardening.
Can I use it with Claude Code?
Yes. It is structured for Claude, Codex, and Claude Code workflows.
Is it enough for compliance?
No. Use it as preparation for formal compliance, audit, and penetration testing processes.
What frameworks does it cover?
The examples focus on Express, but the security principles apply to many web frameworks.
Does it include OWASP guidance?
Yes. It includes a concise OWASP Top 10 checklist for application review.
Should I copy the examples directly?
No. Adapt and harden each example for your framework, hosting setup, and threat model.
Developer Details
Author
supercent-ioLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/supercent-io/skills-template/tree/main/.agent-skills/security-best-practices/Ref
f93e9bb0daca99badb6a7e574b97737155d57cb3
Maintenance freshness
7/18/2026
Usage
11 downloads · 170 views
File structure
📄 SKILL.md