القائمة
Battle-tested security checks for AI coding assistants — 29 categories covering OWASP Top 10, CWE Top 25, and ASVS Level 3
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/Aradotso/security-skills --skill skill-file-securityيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | skill-file-security |
| description | Battle-tested security checks for AI coding assistants — 29 categories covering OWASP Top 10, CWE Top 25, and ASVS Level 3 |
| triggers | ["install security skill","add security checks to my AI","run security audit on my project","scan my code for vulnerabilities","configure security skill","fix security issues in my codebase","check my project for OWASP violations","security scan with skill-file-security"] |
Skill by ara.so — Security Skills collection.
skill-file-security installs 29 battle-tested security instruction files into your project that teach AI coding assistants to identify and fix vulnerabilities across OWASP Top 10, CWE Top 25, ASVS Level 3, and more — without leaving your IDE.
skill-file-security is a CLI tool that:
.skills/security/ in your projectmemory-security.md to track your security score over time.gitignore with 6 security-focused entries/security-scan, /security-audit, /security-fix, /security-status, /security-history, /security-incidentThe AI assistant reads these instruction files and applies 29 security categories to YOUR specific stack (Next.js, Django, Laravel, Express, Docker, Supabase, Firebase, etc.).
npx @netxeo/security-skill
This launches a smart 5-question setup that:
# Install everywhere (all AI assistants)
npx @netxeo/security-skill --yes
# Install for specific assistants
npx @netxeo/security-skill --claude
npx @netxeo/security-skill --cursor
npx @netxeo/security-skill --copilot
npx @netxeo/security-skill --windsurf
npx @netxeo/security-skill --cline
npm install --save-dev @netxeo/security-skill
# Then run via package.json script
npx security-skill
your-project/
├── .skills/
│ └── security/
│ ├── skill.md # Main security orchestrator
│ ├── 01-secrets-and-files.md
│ ├── 02-network-and-cors.md
│ ├── 03-http-headers.md
│ ├── 04-auth-and-sessions.md
│ ├── 05-cryptography.md
│ ├── 06-jwt-security.md
│ ├── 07-database-security.md
│ ├── 08-deployment-ci-cd.md
│ ├── 09-docker-security.md
│ ├── 10-protocols-graphql-websocket.md
│ ├── 11-advanced-attacks.md
│ ├── 12-all-injections.md
│ ├── 13-race-conditions.md
│ ├── 14-file-upload.md
│ ├── 15-dns-email.md
│ ├── 16-supply-chain.md
│ ├── 17-mobile-security.md
│ ├── 18-compliance-gdpr.md
│ ├── 19-monitoring-honeytokens.md
│ ├── 20-serverless-edge.md
│ ├── 21-source-code-analysis.md
│ ├── 22-ai-llm-security.md
│ ├── 23-bot-ddos.md
│ ├── 24-browser-apis.md
│ └── 25-modern-security.md
├── memory-security.md # Score tracker
├── CLAUDE.md # Claude / Antigravity config
├── .cursorrules # Cursor config
├── .cursor/rules/security.mdc # Cursor new format
├── .github/copilot-instructions.md # GitHub Copilot config
├── .windsurfrules # Windsurf config
├── .clinerules # Cline config
├── AGENTS.md # OpenAI Codex CLI config
├── GEMINI.md # Gemini Code Assist config
└── .gitignore # Updated with security entries
After installation, use these slash commands in your AI coding assistant:
/security-scanQuick 30-second scan focusing on critical issues only.
// Example output:
// 🔴 CRITICAL #1 — Hardcoded Supabase service role key in .env.local
// 🔴 CRITICAL #2 — RLS disabled on 3 tables (users, orders, messages)
// 🟠 HIGH #3 — Missing rate limiting on /api/auth/login
// ⏱️ Scan completed in 28s
/security-auditFull audit that generates a security score (/100) and detailed report file.
// Example output:
// ╔══════════════════════════════════════════════════╗
// ║ 🔐 SECURITY AUDIT — myproject ║
// ║ Stack: Next.js · Supabase · Vercel ║
// ╠══════════════════════════════════════════════════╣
// ║ SECURITY SCORE : 61 / 100 🟠 ║
// ╠══════════════════════════════════════════════════╣
// ║ 🔴 Secrets & Files 12/20 ← FIX NOW ║
// ║ 🟢 Auth & Sessions 16/20 ║
// ║ 🔴 Database (Supabase RLS) 8/20 ← FIX NOW ║
// ║ 🟡 HTTP Headers 12/20 ║
// ...
// 📄 Full report → security-report.md
/security-fixApplies fixes with your approval. Always shows diffs before modifying code.
// Example interaction:
// You: /security-fix rls
// AI: I'll enable RLS on 3 tables. Here's what will change:
//
// --- a/supabase/migrations/add_rls.sql
// +++ b/supabase/migrations/add_rls.sql
// @@ -0,0 +1,12 @@
// +ALTER TABLE users ENABLE ROW LEVEL SECURITY;
// +ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
// +ALTER TABLE messages ENABLE ROW LEVEL SECURITY;
//
// Apply these changes? (y/n)
/security-statusShows your score history from memory-security.md.
// Example output:
// | Date | Score | Critical | High | Notes |
// |------------|--------|----------|------|--------------------|
// | 2025-05-01 | 61/100 | 2 | 3 | First audit |
// | 2025-05-03 | 84/100 | 0 | 1 | Fixed RLS + secret |
// | 2025-05-10 | 97/100 | 0 | 0 | 🟢 Excellent |
/security-historyShows before→after comparison to prove value.
/security-incidentFull incident response playbook for when something goes wrong.
# Install security skill
npx @netxeo/security-skill
# In your AI assistant:
# You: /security-scan
AI Response:
🔴 CRITICAL #1 — Supabase service role key exposed in frontend
File: .env.local:3
Found: NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY=eyJhbG...
Risk: Full database access exposed to browser
Fix: Move to server-only env var (no NEXT_PUBLIC_ prefix)
🔴 CRITICAL #2 — RLS disabled on users table
File: supabase/migrations/001_create_users.sql
Risk: Any authenticated user can read all user data
Fix: /security-fix rls
🟠 HIGH #3 — Missing rate limiting on auth endpoints
File: app/api/auth/login/route.ts
Risk: Brute force attacks on login
Fix: Add @upstash/ratelimit middleware
Apply a fix:
// You: /security-fix rls
// AI shows diff and asks for approval:
// --- a/supabase/migrations/002_enable_rls.sql
// +++ b/supabase/migrations/002_enable_rls.sql
// +ALTER TABLE users ENABLE ROW LEVEL SECURITY;
// +
// +CREATE POLICY "Users can read own data"
// + ON users FOR SELECT
// + TO authenticated
// + USING (auth.uid() = id);
// +
// +CREATE POLICY "Users can update own data"
// + ON users FOR UPDATE
// + TO authenticated
// + USING (auth.uid() = id);
// You: yes
// AI: ✅ Applied RLS policy. Run migration with: supabase db push
// You: /security-audit
// AI detects SQL injection vulnerability
// 🔴 CRITICAL — SQL Injection in user search endpoint
// File: routes/users.js:23
// Code: db.query(`SELECT * FROM users WHERE name = '${req.query.name}'`)
// Fix: Use parameterized queries
// You: /security-fix sql-injection routes/users.js:23
// AI shows the fix:
// --- a/routes/users.js
// +++ b/routes/users.js
// @@ -20,7 +20,7 @@
// router.get('/search', async (req, res) => {
// - const results = await db.query(`SELECT * FROM users WHERE name = '${req.query.name}'`);
// + const results = await db.query('SELECT * FROM users WHERE name = $1', [req.query.name]);
// res.json(results.rows);
// });
// You: yes
// AI: ✅ Fixed. SQL injection prevented using parameterized query.
# You: /security-scan
# AI finds Docker security issues:
# 🔴 CRITICAL — Running as root in production container
# File: Dockerfile:15
# Code: USER root
# Fix: Create non-root user
# 🟠 HIGH — Secrets in environment variables
# File: .github/workflows/deploy.yml:34
# Code: DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
# Fix: Use secret management service (AWS Secrets Manager, Vault)
# You: /security-fix dockerfile
# AI rewrites Dockerfile:
# --- a/Dockerfile
# +++ b/Dockerfile
# @@ -12,5 +12,8 @@
# COPY . .
# RUN npm run build
#
# -USER root
# +RUN addgroup -S appgroup && adduser -S appuser -G appgroup
# +RUN chown -R appuser:appgroup /app
# +USER appuser
# +
# CMD ["npm", "start"]
No environment variables required. skill-file-security works entirely through instruction files.
Add custom security rules by creating .skills/security/26-custom.md:
---
name: custom-security-rules
category: Custom
priority: high
---
# Custom Security Rules
## Rule 1: No console.log in production
- Check all `console.log()` calls
- Verify `NODE_ENV === 'production'` removes them
- Suggest using structured logging (winston, pino)
## Rule 2: API keys must be rotated every 90 days
- Check `memory-security.md` for last rotation date
- Alert if > 90 days since rotation
skill-file-security auto-detects your stack from:
package.json (Next.js, Express, React, Vue)requirements.txt / Pipfile (Django, Flask)composer.json (Laravel, Symfony)Gemfile (Rails)pom.xml / build.gradle (Spring Boot)Dockerfile (Docker)supabase/ directory (Supabase)firebase.json (Firebase)No manual configuration needed.
All 25 covered, including:
Cause: AI assistant config file not properly loaded.
Fix:
# Reinstall for specific AI
npx @netxeo/security-skill --claude
# or
npx @netxeo/security-skill --cursor
# Restart your AI assistant after installation
Cause: AI hasn't written to memory file yet.
Fix:
// You: Update my security score after this audit
// AI will append new row to memory-security.md
Cause: Context-specific code patterns that are actually safe.
Fix:
// You: /security-scan --ignore-false-positives
// Or add exception comment in code:
const html = userInput; // security-skill-ignore: sanitized by DOMPurify on line 12
Cause: Installation didn't complete or files were deleted.
Fix:
# Reinstall
npx @netxeo/security-skill --yes
# Verify installation
ls -la .skills/security/
# Should show 25+ .md files
Cause: You already have custom AI instructions.
Fix:
# Backup existing files
cp .cursorrules .cursorrules.backup
cp CLAUDE.md CLAUDE.md.backup
# Reinstall (will merge with existing)
npx @netxeo/security-skill --cursor
# Manually merge if needed
Add security checks to GitHub Actions:
# .github/workflows/security.yml
name: Security Audit
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npx @netxeo/security-skill --yes
- run: |
# Use AI CLI to run audit
# (requires AI with CLI support like aider or continue.dev)
echo "/security-audit" | npx continue
# .husky/pre-commit
#!/bin/sh
npx @netxeo/security-skill --yes
echo "/security-scan" | npx aider --yes-always
Extend with your own categories:
# Create custom category
cat > .skills/security/26-internal-compliance.md << 'EOF'
---
name: internal-compliance
category: Custom
priority: high
---
# Internal Compliance Rules
## PCI DSS Requirements
- Credit card numbers must be masked in logs
- Payment forms must use tokenization
- No credit card data in URLs or GET requests
## SOC 2 Requirements
- All database queries must be logged
- User actions must be auditable
- Access controls must be reviewed quarterly
EOF
# AI will now check these rules during scans
skill-file-security complements (doesn't replace):
skill-file-security focuses on semantic security analysis that understands business logic and context — things static analyzers miss.
Made by developers who got tired of pushing secrets to production. 🔐