Review web applications for CSRF, XSS, CSP, CORS, and OAuth 2.1 security risks.
npx skills add https://github.com/tgautier/dotfiles --skill web-security-tgautier
Please help me install this Agent Skill. Skill: web-security Source: https://github.com/tgautier/dotfiles/tree/main/claude/skills/web-security Command: npx skills add https://github.com/tgautier/dotfiles --skill web-security-tgautier
Browser-facing and API security guidance for production web applications, helping teams design secure architectures and avoid common web vulnerabilities.
Run an OWASP-aligned security review across browser and API endpoints to harden configurations.
High-intent search queries and answers about installing and using this skill.
Configuring CSP headers prevents XSS by restricting approved script execution sources. This Skill provides defense-in-depth guidance for CSP configuration, input validation, and browser security hardening aligned with OWASP cheat sheets.
Implementing OAuth 2.1 and JWT token rotation securely requires PKCE for all clients and proper token lifetimes. This Skill guides authentication patterns, token revocation, and session management aligned with RFC 9700 guidance.
Hardening API endpoints against OWASP API Security Top 10 requires addressing CSRF, CORS, and SSRF risks. This Skill applies threat modeling to review security posture and configure browser-facing protections for production web applications.
Yes, you can use this to review cookie security and CORS configurations. It provides cross-cutting web security guidance for production web apps, covering cookie attributes, CORS policies, and security headers across Rust and TypeScript stacks.
PKCE is required for all OAuth clients to prevent authorization code interception and token theft. This Skill aligns with OAuth 2.1 considerations, enforcing PKCE requirements and best-practice token rotation patterns for secure authentication.
Relying only on input validation leaves threats like CSRF, XSS, and SSRF unmitigated. This Skill applies defense-in-depth, combining CSP configuration, dependency scanning, security headers, and session management to harden production web applications.
appliedailearnerGuide Azure resiliency planning, security posture, and vault configuration.
BagelHoleScan project dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.
copilot-ldSecure Hono HTTP APIs with JWT, CORS, and validation middleware.
summarybotngScan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.
