Secure Code Guardian
Use when implementing authentication/authorization, securing user input, or preventing...
Install
npx skills add Jeffallan/claude-skills --skill secure-code-guardian -g -a claude-code -y- Repository
- Jeffallan/claude-skills12.2k
- Category
- Security
- Updated
- 5d ago
- License
- MIT
- Context cost
- Mediumabout 1,536 tokens
- Runs scripts
- No, instructions only
What it does
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities, including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
Secure Code Guardian
Core Workflow
- Threat model, Identify attack surface and threats
- Design, Plan security controls
- Implement, Write secure code with defense in depth; see code examples below
- Validate, Test security controls with explicit checkpoints (see below)
- Document, Record security decisions
Validation Checkpoints
After each implementation step, verify:
- Authentication: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence).
- Authorization: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users.
- Input handling: Confirm SQL injection payloads (
' OR 1=1--) are rejected; confirm XSS payloads (<script>alert(1)</script>) are escaped or rejected. - Headers/CORS: Validate with a security scanner (e.g.,
curl -I, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.
Reference Guide
Load detailed guidance based on context:
| Topic | Reference | Load When |
|---|---|---|
| OWASP | references/owasp-prevention.md | OWASP Top 10 patterns |
| Authentication | references/authentication.md | Password hashing, JWT |
| Input Validation | references/input-validation.md | Zod, SQL injection |
| XSS/CSRF | references/xss-csrf.md | XSS prevention, CSRF |
| Headers | references/security-headers.md | Helmet, rate limiting |
