Security Essentials Skill

Overview

This skill provides comprehensive security guidance following OWASP standards and industry best practices. It ensures secure code development and vulnerability prevention.

When to Use This Skill

• Implementing authentication/authorization
• Handling sensitive user data
• Security reviews before production
• API security hardening
• Compliance requirements (GDPR, SOC2)
• Vulnerability remediation

Critical Security Rules (Level 1 - Always Loaded)

🔴 MUST Requirements

SEC-1: Input Validation (CRITICAL)

// ✅ GOOD - Validate at boundaries
import { z } from 'zod';

const userSchema = z.object({
  email: z.string().email().max(255),
  password: z.string().min(8).max(128),
  name: z.string().min(1).max(100).regex(/^[a-zA-Z\s]+$/),
});

function createUser(input: unknown) {
  // Validation happens at system boundary
  const validated = userSchema.parse(input);
  return userService.create(validated);
}

// ❌ BAD - No validation
function createUser(input: any) {
  return userService.create(input); // Unsafe!
}

SEC-2: Output Sanitization (CRITICAL)

import DOMPurify from 'isomorphic-dompurify';

// ✅ GOOD - Sanitize before rendering
function displayUserContent(html: string) {
  const clean = DOMPurify.sanitize(html, {
    ALLOWED_TAGS: ['p', 'br', 'strong', 'em'],
    ALLOWED_ATTR: []
  });
  return <div dangerouslySetInnerHTML={{ __html: clean }} />;
}

// ❌ BAD - XSS vulnerability
function displayUserContent(html: string) {
  return <div dangerouslySetInnerHTML={{ __html: html }} />; // XSS!
}

SEC-3: Secrets Management (CRITICAL)

// ✅ GOOD - Environment variables
const config = {
  apiKey: process.env.API_KEY,
  dbPassword: process.env.DB_PASSWORD,
  jwtSecret: process.env.JWT_SECRET,
};

// Validate at startup
if (!config.apiKey || !config.dbPassword || !config.jwtSecret) {
  throw new Error('Missing required environment variables');
}

// ❌ BAD - Hardcoded secrets
const config = {
  apiKey: 'sk-1234567890abcdef', // NEVER DO THIS!
  dbPassword: 'admin123',
  jwtSecret: 'my-secret-key',
};

SEC-4: Never Log Sensitive Data (CRITICAL)

// ✅ GOOD - Redact sensitive fields
logger.info('User login attempt', {
  userId: user.id,
  email: user.email,
  // password is NOT logged
});

// ❌ BAD - Logging sensitive data
logger.info('User login', {
  email: user.email,
  password: user.password, // NEVER LOG PASSWORDS!
  creditCard: user.creditCard, // NEVER LOG PII!
});

SEC-5: Authentication Best Practices

import bcrypt from 'bcrypt';
import jwt from 'jsonwebtoken';

// ✅ GOOD - Secure password hashing
async function hashPassword(password: string): Promise<string> {
  const saltRounds = 12;
  return bcrypt.hash(password, saltRounds);
}

async function verifyPassword(password: string, hash: string): Promise<boolean> {
  return bcrypt.compare(password, hash);
}

// ✅ GOOD - Secure JWT generation
function generateToken(userId: string): string {
  return jwt.sign(
    { userId },
    process.env.JWT_SECRET!,
    {
      expiresIn: '1h',
      algorithm: 'HS256',
    }
  );
}

// ❌ BAD - Plain text password storage
function savePassword(password: string) {
  db.query('INSERT INTO users (password) VALUES (?)', [password]); // NEVER!
}

SEC-6: SQL Injection Prevention

// ✅ GOOD - Parameterized queries
async function getUserByEmail(email: string) {
  return db.query(
    'SELECT * FROM users WHERE email = $1',
    [email] // Parameterized
  );
}

// ❌ BAD - String concatenation (SQL injection!)
async function getUserByEmail(email: string) {
  return db.query(
    `SELECT * FROM users WHERE email = '${email}'` // SQL Injection!
  );
}

SEC-7: CSRF Protection

import csrf from 'csurf';
import cookieParser from 'cookie-parser';

// ✅ GOOD - CSRF tokens
app.use(cookieParser());
app.use(csrf({ cookie: true }));

app.get('/form', (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});

app.post('/submit', (req, res) => {
  // CSRF token automatically verified
  res.send('Data processed');
});

SEC-8: Secure Headers

import helmet from 'helmet';

// ✅ GOOD - Security headers
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
}));

// Cookie security
app.use(session({
  secret: process.env.SESSION_SECRET!,
  cookie: {
    secure: true, // HTTPS only
    httpOnly: true, // No JavaScript access
    sameSite: 'strict', // CSRF protection
    maxAge: 3600000, // 1 hour
  },
}));

Security Checklist (Quick Reference)

Before deploying to production:

• All inputs validated at system boundaries
• All outputs sanitized (XSS prevention)
• No hardcoded secrets (use env vars/vault)
• Passwords hashed with bcrypt (saltRounds >= 12)
• SQL queries parameterized (no string concatenation)
• CSRF protection enabled
• Security headers configured (Helmet.js)
• HTTPS enforced (TLS 1.2+)
• Rate limiting implemented
• Authentication tokens expire
• Sensitive data never logged
• Dependency vulnerabilities checked
• Error messages don't leak info

OWASP Top 10 Quick Reference

1. Broken Access Control → Implement proper authorization checks
2. Cryptographic Failures → Use strong encryption, TLS everywhere
3. Injection → Parameterized queries, input validation
4. Insecure Design → Security by design, threat modeling
5. Security Misconfiguration → Secure defaults, minimal permissions
6. Vulnerable Components → Keep dependencies updated
7. Authentication Failures → MFA, secure session management
8. Data Integrity Failures → Verify data integrity, use signatures
9. Logging Failures → Log security events, protect logs
10. SSRF → Validate URLs, whitelist allowed domains

Detailed Patterns (Level 2 - Load on Request)

See companion files:

• owasp-guide.md - Detailed OWASP Top 10 implementations
• auth-patterns.md - JWT, OAuth2, MFA implementations
• encryption-guide.md - Encryption at rest and in transit

Security Tools (Level 3 - Load When Needed)

See scripts directory:

• scripts/security-scan.sh - Run comprehensive security scan
• scripts/dependency-check.sh - Check for vulnerable dependencies
• scripts/secret-scan.sh - Scan for exposed secrets

Integration with Agents

security-specialist:

• Primary agent for security reviews
• Uses this skill for all security assessments
• Read-only access (no code modification)

senior-fullstack-developer:

• Uses this skill when implementing auth/security features
• References patterns for secure implementation

qa-testing-engineer:

• Uses this skill for security test cases
• Validates against security checklist

Common Vulnerabilities & Fixes

XSS (Cross-Site Scripting)

// Vulnerable
function renderHTML(userInput: string) {
  document.innerHTML = userInput; // XSS!
}

// Fixed
import DOMPurify from 'isomorphic-dompurify';
function renderHTML(userInput: string) {
  const clean = DOMPurify.sanitize(userInput);
  document.innerHTML = clean;
}

Path Traversal

// Vulnerable
app.get('/file/:filename', (req, res) => {
  const file = path.join(__dirname, req.params.filename);
  res.sendFile(file); // Path traversal: ../../etc/passwd
});

// Fixed
app.get('/file/:filename', (req, res) => {
  const filename = path.basename(req.params.filename); // Remove path
  const file = path.join(__dirname, 'uploads', filename);

  // Ensure file is within allowed directory
  if (!file.startsWith(path.join(__dirname, 'uploads'))) {
    return res.status(403).send('Forbidden');
  }

  res.sendFile(file);
});

NoSQL Injection

// Vulnerable
function findUser(username: string) {
  return db.users.findOne({ username }); // Can inject: {$ne: null}
}

// Fixed
function findUser(username: string) {
  if (typeof username !== 'string') {
    throw new ValidationError('Username must be a string');
  }
  return db.users.findOne({ username });
}

Emergency Response

If a security vulnerability is discovered:

1. Contain: Disable affected feature if critical
2. Assess: Determine scope and impact
3. Fix: Apply patch immediately
4. Test: Verify fix doesn't break functionality
5. Deploy: Emergency deployment with monitoring
6. Notify: Inform stakeholders if data breach
7. Postmortem: Document incident and prevention

Version 1.0.0 | OWASP Top 10 Compliant | GDPR Aware