Menu
Universal security patterns based on OWASP Top 10 and security best practices. Framework-agnostic.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Compressed-prose response style for the orchestrator (opt-in via behavior.caveman_mode). Drops articles, fillers, and transitional prose; preserves code, paths, JSON/TOML, and quoted text verbatim.
Maestro project patterns — Rust CLI with ratatui TUI, tokio async, Claude CLI process management, and stream-json parsing.
TEMPLATE - Backend API development patterns. Copy and customize for your backend framework (Express, Django, Spring Boot, FastAPI, etc.)
TEMPLATE - Frontend web development patterns. Copy and customize for your frontend framework (React, Vue, Angular, Svelte, etc.)
Defensive patterns for GitHub (gh) and Azure DevOps (az) CLI interactions — error handling, idempotency, rate limits, missing resources.
API contract validation patterns for ensuring client-side models match backend JSON responses. Prevents decoding failures from schema mismatches. Tech-stack agnostic.
| name | security-patterns |
| version | 1.0.0 |
| description | Universal security patterns based on OWASP Top 10 and security best practices. Framework-agnostic. |
| allowed-tools | Read, Grep, Glob, WebSearch |
| # | Category | Key Check |
|---|---|---|
| A01 | Broken Access Control | Auth checks on every endpoint |
| A02 | Cryptographic Failures | No hardcoded secrets |
| A03 | Injection | Parameterized queries only |
| A04 | Insecure Design | Rate limiting, input validation |
| A05 | Security Misconfiguration | No debug in production |
| A06 | Vulnerable Components | Audit dependencies |
| A07 | Authentication Failures | Brute force protection |
| A08 | Data Integrity | Code signing, safe deserialization |
| A09 | Logging Failures | No sensitive data in logs |
| A10 | SSRF | Validate all URLs |
