Stats
Actions
Tags
From shared-security-auth-security
Secrets management, XSS prevention, CSRF protection, dependency scanning, DOMPurify sanitization, CSP headers, CODEOWNERS, HttpOnly cookies
How this skill is triggered — by the user, by Claude, or both
Slash command
/shared-security-auth-security:shared-security-auth-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
> **Quick Guide:** Managing secrets? Use .env.local (gitignored), CI secrets, rotate on compromise or team changes. Dependency security? Enable automated scanning (Dependabot), patch critical vulns within 24hrs. XSS prevention? Modern frameworks auto-escape output by default - never bypass with raw HTML injection unless sanitized with DOMPurify. Set CSP headers. CODEOWNERS? Require security tea...
Quick Guide: Managing secrets? Use .env.local (gitignored), CI secrets, rotate on compromise or team changes. Dependency security? Enable automated scanning (Dependabot), patch critical vulns within 24hrs. XSS prevention? Modern frameworks auto-escape output by default - never bypass with raw HTML injection unless sanitized with DOMPurify. Set CSP headers. CODEOWNERS? Require security team review for auth/, .env.example, workflows.
Detailed Resources:
Additional Examples:
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering,
import type, named constants)
(You MUST NEVER commit secrets to the repository - use .env.local and CI secrets only)
(You MUST sanitize ALL user input before rendering raw HTML - use DOMPurify before any HTML injection)
(You MUST patch critical/high vulnerabilities within 24 hours - use Dependabot for automated scanning)
(You MUST use HttpOnly cookies for authentication tokens - NEVER localStorage or sessionStorage)
(You MUST configure CODEOWNERS for security-sensitive files - require security team approval)
</critical_requirements>
Auto-detection: security, secrets management, XSS prevention, CSRF protection, Dependabot, vulnerability scanning, authentication, DOMPurify, CSP headers, CODEOWNERS, HttpOnly cookies
When to use:
When NOT to use:
Key patterns covered:
Security is not a feature - it's a foundation. Every line of code must be written with security in mind. Defense in depth means multiple layers of protection, so if one fails, others catch the attack.
When to use security patterns:
When NOT to compromise:
Core principles:
Never commit secrets to the repository. Use environment variables in .env.local (gitignored) for development, and CI/CD secret managers for production. Rotate secrets quarterly or on team member departure.
Secrets include: API keys, tokens, passwords, database credentials, private keys, certificates, OAuth client secrets, encryption keys, JWT secrets.
Development:
.env.local (gitignored)CI/CD:
Production:
Note: NIST SP 800-63-4 (2025) recommends against mandatory periodic password rotation for users. Instead, use event-based rotation (on compromise, team member departure, or security incident). Periodic rotation is still recommended for service accounts and privileged access.
| Secret Type | Rotation Frequency |
|---|---|
| Service account credentials | 90 days (quarterly) |
| API keys | 365 days (annually) or on compromise |
| User passwords | On compromise only (NIST 2025 guidance) |
| Privileged account passwords | 90 days (quarterly) |
| Certificates | 30 days warning before expiry |
| All secrets | Immediately on team member departure |
See examples/core.md for code examples.
Enable automated vulnerability scanning with Dependabot to catch security issues in dependencies. Patch critical vulnerabilities within 24 hours, high within 1 week, medium within 1 month.
Security updates:
Regular updates:
See examples/dependency-security.md for Dependabot configuration and CI security check scripts.
Modern UI frameworks auto-escape user input by default. Never bypass this protection with raw HTML injection unless sanitized with DOMPurify. Configure Content Security Policy (CSP) headers to block unauthorized scripts.
Most frameworks escape text content automatically. Only explicit HTML injection APIs (e.g., dangerouslySetInnerHTML, v-html, {@html}) bypass this protection.
When HTML rendering is required, use DOMPurify with a whitelist of allowed tags and attributes.
Configure CSP headers to prevent unauthorized script execution even if XSS occurs.
See examples/xss-prevention.md for DOMPurify and CSP code examples.
This skill addresses the following OWASP Top 10:2025 categories:
| OWASP Category | Coverage |
|---|---|
| A01: Broken Access Control | CODEOWNERS, branch protection, rate limiting |
| A02: Security Misconfiguration | CSP headers, security headers, Dependabot |
| A03: Software Supply Chain Failures | Dependabot, CI security audits, dependency review |
| A04: Cryptographic Failures | HttpOnly/Secure cookies, HTTPS enforcement |
| A05: Injection | DOMPurify, framework auto-escaping, CSP |
| A07: Authentication Failures | HttpOnly cookies, session management |
| A10: Mishandling of Exceptional Conditions | Fail securely principle, error handling |
Defense in depth layers:
<red_flags>
High Priority Issues:
Medium Priority Issues:
Gotchas & Edge Cases:
.env.local is gitignored by default in some frameworks but not all - verify your .gitignore<style> and <form> tags - use explicit whitelistSee reference.md for common mistakes, anti-patterns with code examples, and decision frameworks.
</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST NEVER commit secrets to the repository - use .env.local and CI secrets only)
(You MUST sanitize ALL user input before rendering raw HTML - use DOMPurify before any HTML injection)
(You MUST patch critical/high vulnerabilities within 24 hours - use Dependabot for automated scanning)
(You MUST use HttpOnly cookies for authentication tokens - NEVER localStorage or sessionStorage)
(You MUST configure CODEOWNERS for security-sensitive files - require security team approval)
Failure to follow these rules will create security vulnerabilities enabling XSS attacks, token theft, CSRF attacks, and data breaches.
</critical_reminders>
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub agents-inc/skills --plugin shared-security-auth-security