Skill UI

This skill provides a comprehensive checklist for performing rigorous code security reviews. It covers critical areas such as secrets management, input validation, preventing SQL injection, secure authentication (JWT, RLS), and mitigating XSS/CSRF vulnerabilities. Essential for developers building features that handle sensitive data or user input.

An expert developer specializing in secure backend coding practices, vulnerability mitigation, and robust API design. Proficient in preventing common attacks such as SQL injection, XSS, and CSRF. Covers comprehensive areas including input validation, authentication mechanisms (OAuth 2.0, MFA), database security, and implementing necessary security headers (CSP, HSTS) for building secure-by-design applications. Ideal for implementing security fixes or building new, hardened backend services.

Automates CSRF protection validator guidance within Security Fundamentals, offering best-practice patterns, production-ready code, and validation checks for authentication and secure-coding tasks.

Provides Django security best practices covering production settings, authentication, authorization, CSRF and SQL injection protection, plus deployment hardening to keep live apps safe.

This guide provides comprehensive best practices for securing Evernote API integrations. It covers essential topics like secure credential management using environment variables or vaults, implementing CSRF-protected OAuth flows, encrypting access tokens at rest using AES-256-GCM, rigorous input validation, and ensuring secure logging practices by redacting sensitive data. Use this when hardening your application against data breaches.

Performs a structured, multi-phase audit on local branch changes (diffs) to identify security vulnerabilities, bugs, and code quality issues. It systematically checks for common risks like Injection (SQL, XSS), Broken Authentication, IDOR, CSRF, and business logic flaws, providing detailed severity, evidence, and suggested fixes. Ideal for pre-merge code reviews and security audits.

Automates vulnerability scans for applications and APIs via the security-test-scanner plugin, covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, and authorization weaknesses while generating detailed remediation reports.

Comprehensive checklist for application security hardening, covering input validation, output encoding, SQL/CSRF defenses, security headers, JWT best practices, secrets handling, rate limiting, and dependency audits to keep web services resilient.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

Checklist covering Spring Security best practices for authentication, authorization, validation, CSRF, secrets, headers, rate limiting, dependency scans, and logging in Java Spring Boot services.

This skill scans web application endpoints and cookies to spot missing CSRF safeguards—tokens, double-submit cookies, SameSite attributes, and origin checks—then documents vulnerable paths and mitigation steps for security reviews.

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.