What problem does it solve? Code submissions often ship with hardcoded secrets, insecure JWT handling, permissive CORS, SQL injection vectors, and sensitive data in logs. This Skill automatically scans every piece of code for these risks before responding, then audits or implements security controls aligned with your organization's security standard. ## Core Features & Use Cases - Automatic Security Scan: On every invocation, detects hardcoded secrets, insecure fallbacks, sensitive data in logs, JWT algorithm vulnerabilities, insecure token storage, permissive CORS, SQL injection, and PII in URLs, each mapped to a severity and standard section. - Three Operating Modes: Review mode produces severity-ranked findings with copy-pasteable fixes and SLAs; Implement mode writes secure-by-default code (fail-fast secret bootstrap, RS256/JWKS JWT validation, HttpOnly cookies, rate limiting, Zod input validation); Checklist mode validates phase readiness with PASS/FAIL evidence. - Use Case: Paste an Express authentication module and receive a scan report flagging a hardcoded JWT secret (CRITICAL, 24h SLA), a wildcard CORS config (HIGH), and tokens in localStorage (HIGH), each with the exact corrected code and the violated standard section. ## Quick Start Ask the agent to review your authentication code for security issues and provide fixes for any findings.
