skills.rest
lciacci
lciacciCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security

Review JavaScript, TypeScript, and Python projects for security vulnerabilities and secret exposure.

Updated Jun 19, 2026
Search Tags:#authentication#input validation#owasp#security testing#secrets management#application security#dependency auditing
One-click install
npx skills add https://github.com/lciacci/tessera --skill security-lciacci
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/lciacci/tessera/tree/main/skills/security
Command: npx skills add https://github.com/lciacci/tessera --skill security-lciacci

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps prevent security vulnerabilities, accidental secret exposure, unsafe input handling, and weak authentication practices during software development.

Core Features & Use Cases

  • Secrets Management: Configure gitignore rules, environment variables, startup validation, and secret-scanning checks to keep credentials out of source code and client bundles.
  • Secure Coding Patterns: Apply protections against SQL injection, XSS, path traversal, weak JWT handling, insecure password storage, excessive authentication attempts, and unsafe CORS settings.
  • Security Testing: Set up pre-commit checks, dependency audits, static analysis, GitHub Actions workflows, and release-readiness checklists for JavaScript, TypeScript, and Python projects.
  • Use Case: Use this Skill when reviewing an API that accepts user input and handles authentication tokens, ensuring its queries are parameterized, inputs are validated, secrets remain server-side, and automated security checks are configured.

Quick Start

Ask the security skill to review the authentication API for secret exposure, injection risks, input-validation gaps, dependency vulnerabilities, and missing security tests.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent secrets and API keys from leaking into my source code?▼

Secrets management prevents credential exposure by configuring gitignore rules, environment variables, startup validation, and secret-scanning checks to keep API keys out of client bundles and repositories.

How do I secure authentication APIs against injection and weak token handling?▼

Securing authentication APIs requires applying parameterized queries, input validation, and secure JWT handling to protect against SQL injection, XSS, path traversal, and excessive authentication attempts.

What is the best way to automate dependency auditing and security testing in CI?▼

Automating dependency auditing in CI involves setting up pre-commit checks, static analysis, and GitHub Actions workflows to continuously evaluate JavaScript, TypeScript, and Python project dependencies for vulnerabilities.

Does this security review tool support both Python and web applications?▼

Yes, security review processes support JavaScript, TypeScript, Python, and web applications, applying OWASP-aligned validation, secure credential handling, and rate limiting across these environments.

How do I validate user input to prevent path traversal and XSS vulnerabilities?▼

Validating user input to prevent path traversal and XSS involves applying OWASP-aligned validation patterns that sanitize incoming data and block malicious payloads before processing.

Why do I need to configure rate limiting and security headers for my application?▼

Configuring rate limiting and security headers is essential to prevent excessive authentication attempts and mitigate unsafe CORS settings, strengthening overall application security posture.

Related Skills

Explore More Software Engineering Skills→
kivo360kivo360
1

moai-cc-settings-privacy

Configure Claude Code settings.json with permission controls and environment variables.

Community
Advanced
joshuakesselljoshuakessell

security

Enforce OWASP security patterns and automated security testing in CI/CD pipelines.

Community
Advanced
ils15ils15
10

security-audit

Automate security audits to detect OWASP Top 10 vulnerabilities and produce remediation plans.

Community
Intermediate
SkobynSkobyn

hunt-sqli

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced