skills.rest
JCETools-Petra
JCETools-PetraCOMMUNITY
Explore all skills by this author →
GitHub

security

Diagnose authentication, input validation, secrets handling, and web security weaknesses.

16|Updated Apr 30, 2026
Search Tags:#security#authentication#input validation#secrets management#csp#cors#vulnerability review
One-click install
npx skills add https://github.com/JCETools-Petra/JCE-Opencode-Tools --skill security-jcetools-petra
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/JCETools-Petra/JCE-Opencode-Tools/tree/main/config/skills/security
Command: npx skills add https://github.com/JCETools-Petra/JCE-Opencode-Tools --skill security-jcetools-petra

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you prevent and verify security weaknesses in authentication flows, input handling, secrets storage, and common web security controls so you can reduce risk instead of shipping vulnerabilities.

Core Features & Use Cases

  • Authentication Strategy Selection: Choose practical, modern auth patterns (passkeys, secure cookies, OAuth2+PKCE, mTLS) based on app type and threat model.
  • Secrets Management & Rotation Guidance: Implement safer secret storage and rotation approaches for local dev, CI/CD, production, and Kubernetes.
  • Vulnerability Prevention Playbooks: Apply defenses for injections, CORS/CSP misconfiguration, rate limiting, security headers, container hardening, and supply-chain controls (SBOM, CI scanning, dependency pinning).
  • Verification Checklist: Use an explicit checklist to confirm protections are actually in place (validation, parameterized queries, secure cookies, headers, audits, and scanning).

Quick Start

Ask the AI to review your auth and request-handling codebase for vulnerabilities related to JWT verification, input validation, CORS/CSP, and secrets handling, and to produce a prioritized remediation plan.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review my codebase for security vulnerabilities in authentication and input validation?▼

Securing authentication flows requires selecting modern patterns like passkeys, OAuth2+PKCE, or mTLS based on your threat model. Hardening also involves implementing secure cookies, explicit boundary validation, and proper JWT verification to prevent unauthorized access.

What is the best way to implement secrets management and rotation across CI CD and Kubernetes?▼

Secrets management and rotation requires safer storage approaches tailored for local dev, CI/CD, production, and Kubernetes environments. Implementing secure secret storage and rotation prevents exposure and satisfies production-grade security verification requirements.

How do I prevent CORS and CSP misconfiguration in web security controls?▼

Preventing CORS and CSP misconfiguration involves applying production-grade security headers and vulnerability prevention playbooks. Diagnosing likely weaknesses in these web security controls ensures cross-origin requests and content policies are properly restricted.

How do I prevent injection attacks and enforce rate limiting in middleware?▼

Preventing injection attacks and enforcing rate limiting requires boundary validation and parameterized queries in your middleware. Applying vulnerability prevention playbooks ensures input validation and request throttling protect against malicious payloads.

How do I verify that security controls for container hardening and supply-chain risks are actually in place?▼

Verifying security controls for container hardening and supply-chain risks requires an explicit checklist to confirm protections are deployed. Using SBOM, CI scanning, dependency pinning, and security audits ensures production-grade scanning guidance is satisfied.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

security-audit-context-building

Map architecture, trust boundaries, data flows, and threat models into an Audit Context Document.

Community
Advanced
ivanuserivanuser

sbom-supply-chain-security

Generate CycloneDX or SPDX SBOMs and verify signatures in CI pipelines.

Community
Advanced
EntroVyxEntroVyx
3

supply-chain-attack-recon

Identify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.

Community
Advanced
linardsblinardsb

security-engineering

Assess vulnerabilities and verify compliance across cloud and application systems.

Community
Advanced