auto-security

What problem does it solve?

Inconsistent security practices across authentication, sessions, cookies, and file uploads are a common risk in automation pipelines. This Skill codifies core security patterns to ensure consistent, safer defaults and to reduce security debt when building with Claude or Codex.

Core Features & Use Cases

• Enforces hashing of session tokens before storage and safe handling of tokens in cookies.
• Hides detailed authentication errors to avoid information leakage to attackers.
• Implements timing-safe flows to prevent user enumeration on login.
• Prevents session fixation by destroying old sessions on login and revoking other sessions on password changes.
• Enforces strict cookie attributes (httpOnly, secure, sameSite: 'strict') to reduce CSRF risk.
• Recommends stronger password hashing (bcrypt >= 12 or Argon2id) and multi-layer validation for file uploads.
• Provides a guardrail for dangerous patterns and a remediation checklist for secure design.

Quick Start

Enable the auto-security checks on auth and session flows and run the security review against your latest code changes.