security-checklist
This skill should be used for OWASP, security review, authentication, XSS, SQL injection prevention, CSRF, input validation, secure coding, vulnerability scanning
When & Why to Use This Skill
This Claude skill acts as a comprehensive security auditor and consultant, providing a structured checklist based on OWASP Top 10 principles to identify and mitigate critical software vulnerabilities. It streamlines the process of conducting security reviews, ensuring that applications adhere to industry-standard best practices for authentication, data protection, and input validation to prevent attacks like SQL injection and XSS.
Use Cases
- Security Code Audits: Systematically review source code to detect common vulnerabilities such as SQL injection, XSS, and CSRF before the production release.
- Authentication & Authorization Hardening: Evaluate and improve login mechanisms, session management, and permission controls using industry-standard protocols like bcrypt and principle of least privilege.
- Secure API Development: Ensure all API endpoints implement proper input validation, rate limiting, and secure communication headers to protect against unauthorized access.
- Penetration Testing Preparation: Use the checklist as a pre-audit tool to identify and fix security gaps before formal third-party security assessments or compliance audits.
| name | security-checklist |
|---|---|
| description | This skill should be used for OWASP, security review, authentication, XSS, SQL injection prevention, CSRF, input validation, secure coding, vulnerability scanning |
| whenToUse | Security review, auth security, vulnerability prevention, input validation, secure coding, OWASP Top 10, penetration testing prep, security audit |
| whenNotToUse | Non-security code review, general code quality |
| - skill | database-patterns |
| when | SQL injection prevention |
Security Checklist
Security review checklist based on OWASP Top 10.
Input Validation
- Validate all user input
- Use parameterized queries (no SQL concat)
- Sanitize HTML output (prevent XSS)
- Validate file uploads (type, size)
Authentication
- Hash passwords (bcrypt, argon2)
- Use secure session management
- Implement rate limiting
- Require strong passwords
Authorization
- Check permissions on every request
- Use principle of least privilege
- Validate ownership of resources
Data Protection
- Use HTTPS everywhere
- Don't log sensitive data
- Encrypt sensitive data at rest
- No secrets in source code
Headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000
Common Vulnerabilities
| Vuln | Prevention |
|---|---|
| SQL Injection | Parameterized queries |
| XSS | Output encoding |
| CSRF | CSRF tokens |
| Secrets | Environment variables |