What problem does it solve? Code that touches user input, authentication, API routes, or sensitive data often ships with preventable vulnerabilities like SQL injection, XSS, CSRF gaps, leaked secrets, and unsafe error logging. This Skill gives the AI a non-negotiable security floor and concrete remediation patterns so these issues are caught and prevented during code generation and review. ## Core Features & Use Cases - Injection and XSS prevention: Enforces parameterized queries, framework auto-escaping, and DOMPurify sanitization with explicit tag/attribute allow-lists before rendering user-supplied HTML. - Auth, session, and CSRF hardening: Validates sessions on every protected path, sets secure cookie flags (httpOnly, secure, sameSite), and requires origin checks or anti-CSRF tokens on state-changing requests. - Secret and input safety: Blocks hardcoded or client-exposed secrets, mandates server-side whitelist validation, safe error logging without PII, upload MIME/size checks, and schema validation of external API responses. - Use Case: While building a login endpoint with file upload, the Skill ensures the session is validated, the upload is checked for MIME type and size, no secrets leak into client env vars, and only generic errors reach the user. ## Quick Start Review this API route for injection, XSS, auth, and secret-handling vulnerabilities using the security skill.
