skills.rest
dicarsmtz
dicarsmtzCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-best-practices

Review code against language and framework security best practices and generate prioritized vulnerability reports.

1|Updated May 8, 2026
Search Tags:#xss#owasp#secure coding#security review#code audit#csrf#vulnerability report
One-click install
npx skills add https://github.com/dicarsmtz/product-engineering-kit --skill security-best-practices-dicarsmtz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/dicarsmtz/product-engineering-kit/tree/main/plugins/product-engineering/skills/security-best-practices
Command: npx skills add https://github.com/dicarsmtz/product-engineering-kit --skill security-best-practices-dicarsmtz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Writing secure code requires deep knowledge of language- and framework-specific vulnerabilities, and most teams lack time to audit every change. This Skill loads curated security guidance for your stack and uses it to write secure-by-default code, flag critical issues while editing, or produce a full prioritized security report. ## Core Features & Use Cases - Secure-by-default code generation: Automatically applies security best practices for Python, JavaScript/TypeScript, and Go when writing new code. - Passive vulnerability detection: Notices critical security issues in code you are already working on and flags them with safe fixes. - Prioritized security reports: On request, produces a severity-organized markdown report with numeric finding IDs, line-number references, and impact statements, then offers to fix findings one at a time. - Use Case: Ask for a security review of your Express backend; the Skill loads the Express security spec, audits middleware, sessions, CSRF, and CORS configuration, and writes a report to security_best_practices_report.md. ## Quick Start Ask the assistant to perform a security best practices review of this project and write a prioritized report of the findings.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my codebase?▼

Ask for a security best practices review or vulnerability report of your project. The Skill detects your languages and frameworks, loads the matching reference specs, and writes a severity-organized markdown report with line-numbered findings.

What languages and frameworks does this security review support?▼

It supports Python, JavaScript/TypeScript, and Go, with dedicated reference specs such as Express web server security, general frontend JavaScript security, and Go backend security. Unsupported stacks fall back to well-known general security practices.

Can it fix the vulnerabilities it finds?▼

Yes. After producing a report, it offers to fix findings one at a time with concise comments explaining the security rationale. It follows your existing testing and commit workflows to avoid regressions.

Does it work for both frontend and backend code?▼

Yes. For web applications it checks reference documents for both the frontend and backend. If the frontend framework is unspecified, it applies the general JavaScript web frontend security guidance.

What happens if my project intentionally bypasses a security best practice?▼

The Skill respects project-specific overrides documented in your repo and will not fight them. It may note the bypass and suggest documenting the reason so future work follows the same exception.

When should I not expect a full security audit from this Skill?▼

It is not a substitute for penetration testing or runtime scanning, and it only triggers on explicit security requests for supported languages. Controls enforced at proxies or infrastructure are reported as needing verification rather than confirmed.

Related Skills

Explore More Software Engineering Skills→
nixopusnixopus

github-onboarding

Connect GitHub to Nixopus by installing the GitHub App or configuring a manifest.

Official
Intermediate
alo-expalo-exp
6

gsd-review-fix

Apply atomic fixes with DCO sign-off and verify via tests and re-review.

Official
Advanced
a29paula29paul
1

cso

Audit infrastructure security across secrets, dependencies, CI/CD, and LLM integrations.

Community
Advanced
MeoBakaMeoBaka

security-scanning-security-sast

Identify security weaknesses in source code using automated SAST tooling.

Community
Advanced