security

name	security
description	OWASP Top 10 checks, CSP headers, secrets scanning, dependency audit. Use when auditing security, adding CSP, or reviewing for vulnerabilities. Triggers: "security", "owasp", "csp", "xss", "injection", "headers".
category	web-ui

Skill: security

OWASP Top 10 Checklist

• XSS prevention: escapeHtml at all untrusted boundaries
• No eval(), no new Function(), no inline event handlers
• No hardcoded secrets
• CSP via <meta http-equiv> or response headers
• Input validation at system boundaries
• Secure headers present

Commands

# Run security audit
bash scripts/security-audit.sh

# Check for secrets
grep -rE "AKIA|sk-|ghp_|password.*=|api.*key.*=" src/

# Check for unsafe patterns
grep -rE "eval\(|new Function\(|innerHTML\s*=" src/ --include='*.js'

Security Headers

Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()

Rules

• Never hardcode secrets in source code
• Always use escapeHtml for user-controlled text
• CSP must be set on every HTML page
• Run security audit before every release