skills.rest
scsm-unrestrict
scsm-unrestrictCOMMUNITY
Explore all skills by this author →
GitHub

secure-code-guardian

Implements authentication, input validation, and OWASP Top 10 defenses in Node.js and TypeScript code.

1|Updated Aug 18, 2026
Search Tags:#security#authentication#input validation#jwt#owasp#express#bcrypt
One-click install
npx skills add https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent --skill secure-code-guardian-scsm-unrestrict
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-code-guardian
Source: https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent/tree/main/frontend-engineer/skills/secure-code-guardian
Command: npx skills add https://github.com/scsm-unrestrict/dsh-frontend-engineer-agent --skill secure-code-guardian-scsm-unrestrict

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications frequently ship with preventable vulnerabilities like SQL injection, weak password hashing, missing security headers, and broken access control. This Skill guides the implementation of secure authentication, authorization, and input handling so these flaws are addressed during development rather than after a breach. ## Core Features & Use Cases - Authentication & Session Security: Implements bcrypt/argon2 password hashing, JWT access/refresh token flows, account lockout, and rate-limited login endpoints. - Input Validation & Injection Prevention: Applies Zod schema validation, parameterized SQL queries, path traversal checks, and command injection avoidance. - OWASP Top 10 & Headers Hardening: Configures Helmet security headers, CSP, CORS allowlists, CSRF tokens, and XSS sanitization with DOMPurify. - Use Case: When building an Express login endpoint, use this Skill to produce a complete flow with rate limiting, Zod input validation, bcrypt verification, generic error messages, and an httpOnly JWT cookie. ## Quick Start Use the secure-code-guardian skill to implement a hardened login endpoint with bcrypt password hashing, rate limiting, and JWT tokens.

Frequently Asked Questions about secure-code-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hash passwords securely in Node.js?▼

Use bcrypt with at least 12 salt rounds via bcrypt.hash(password, 12), and verify with bcrypt.compare. Never use MD5, SHA-1, or unsalted hashes, and never store passwords in plaintext or reversibly encrypted form.

How to prevent SQL injection in Node.js queries?▼

Use parameterized queries that pass values separately from the SQL string, such as pool.query('SELECT ... WHERE email = $1', [email]) with the pg library. ORMs like Prisma and query builders like Knex also parameterize inputs by default.

What security headers should an Express app set?▼

Use Helmet to set CSP, HSTS, X-Frame-Options, and X-Content-Type-Options with secure defaults. You can also configure directives manually, such as defaultSrc 'self' for CSP and max-age 31536000 for HSTS.

Does JWT validation need algorithm allowlisting?▼

Yes, always pass an explicit algorithms array to jwt.verify, such as algorithms: ['HS256'], along with issuer and audience checks. This prevents algorithm-confusion attacks where a token signed with an unexpected method is accepted.

When should I use a different skill instead of secure-code-guardian?▼

This Skill covers custom security implementations during coding. For pre-built OAuth or SSO integrations, or for standalone security audits of existing codebases, a more specialized integration or audit skill is a better fit.

Related Skills

Explore More Software Engineering Skills→
Nandansai08Nandansai08
1

authn-authz-design

Designs authentication and authorization architecture covering sessions, JWTs, RBAC, ABAC, and tenancy isolation.

Community
Advanced
Fabric-ProFabric-Pro
3

threat-hunting

Detect security threats, vulnerabilities, and suspicious patterns in applications and infrastructure.

Official
Basic
M-Abdullah07M-Abdullah07
1

security-scanning-security-hardening

Coordinate specialized agents to scan and remediate application security vulnerabilities.

Community
Advanced
catalystbyzohocatalystbyzoho
32

catalyst-authentication

Manage user authentication and OAuth tokens for Catalyst applications.

Official
Advanced