skills.rest
Peterson-Benhame
Peterson-BenhameCOMMUNITY
Explore all skills by this author →
GitHub

security-best-practices

Reviews code against language and framework security best practices and generates prioritized vulnerability reports.

Updated Sep 15, 2026
Search Tags:#xss#owasp#secure coding#golang#security review#express#vulnerability report
One-click install
npx skills add https://github.com/Peterson-Benhame/agent-skills --skill security-best-practices-peterson-benhame
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/Peterson-Benhame/agent-skills/tree/main/packages/skills-catalog/skills/%28security%29/security-best-practices
Command: npx skills add https://github.com/Peterson-Benhame/agent-skills --skill security-best-practices-peterson-benhame

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Writing secure code requires deep knowledge of language- and framework-specific security pitfalls, and manually auditing a codebase for vulnerabilities like SQL injection, XSS, CSRF, and misconfigured servers is slow and error-prone. ## Core Features & Use Cases - Secure-by-Default Code Generation: Loads framework-specific security specs (Go, Express, frontend JavaScript/TypeScript) so new code follows normative MUST/SHOULD security requirements from the start. - Passive Vulnerability Detection: Flags critical security issues in code you are already working on, such as missing CSRF protection, unsafe cookie flags, or path traversal risks. - Prioritized Security Reports: Produces a structured Markdown report with severity-rated findings, numeric IDs, line-number references, and impact statements, then applies fixes one at a time with regression-safe changes. - Use Case: Ask for a security review of your Express backend and receive a report identifying missing Helmet headers, MemoryStore session usage, and unvalidated redirects, then have each finding fixed individually. ## Quick Start Ask the agent to perform a security best-practices review of your project and generate a prioritized vulnerability report.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my codebase?▼

Ask the agent for a security review or report of your project. It detects the languages and frameworks in use, loads the matching security reference specs, and produces a prioritized Markdown report with severity-rated findings and line-number references.

What languages and frameworks does this security review support?▼

It supports Python, JavaScript/TypeScript, and Go, with dedicated reference specs for Express backends, general frontend browser JavaScript, and Go net/http services. If no matching spec exists, it falls back to well-known security best practices for the detected stack.

Can it fix the vulnerabilities it finds automatically?▼

Yes, after you review the report you can ask it to apply fixes. It fixes one finding at a time with concise comments explaining the security rationale, follows your existing test and commit flows, and warns about changes that could cause regressions.

Does it work for both frontend and backend security issues?▼

Yes, for web applications it checks reference documentation for both the frontend and backend. Frontend coverage includes DOM XSS, CSP, postMessage validation, and storage risks, while backend coverage includes CSRF, injection, SSRF, and server misconfiguration.

When should I not use this security review skill?▼

Do not use it for general code review, debugging, or threat modeling, which require different approaches. It is designed specifically for security best-practice guidance, vulnerability detection, and secure-by-default coding.

Related Skills

Explore More Software Engineering Skills→
GuicedEEGuicedEE
5

security-best-practices

Load language-specific security rules and generate prioritized remediation steps.

Official
Advanced
alo-expalo-exp
6

gsd-review-fix

Apply atomic fixes with DCO sign-off and verify via tests and re-review.

Official
Advanced
zivtechzivtech

security-threat-model-planner

Map trust boundaries and assets to STRIDE-based risk assessments.

Official
Advanced
hoanghn61hoanghn61

source-code-scanning

Scan source code and dependencies for vulnerabilities, secrets, and malicious code.

Community
Advanced