Skip to main content
security-review Comprehensive security checklist and patterns to catch vulnerabilities in application code. USE WHEN adding authentication or authorization, handling user input or file uploads, creating API endpoints, working with secrets or credentials, implementing payment features, or storing and transmitting sensitive data.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/Sheshiyer/skill-clusters --skill security-reviewO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Mais deste repositório Arcplume runs Grok through the Grok Build CLI's own OAuth-authenticated session (grok login) for image generation, with strict preflight validation, secret-safe handling, and headless CLI-driven execution -- no separate XAI_API_KEY billing. Video falls back to the billed xAI API. USE WHEN a user wants to generate an image via a locally logged-in Grok Build CLI session, e.g. 'generate an image with grok', 'use grok build', or 'use my logged-in grok session'.
Shared reference for the Selemene cluster: the two report surfaces (deterministic Rust reports vs. narrative witness-pipeline readings), the @selemene/bridge CLI contract, the output manifest format, and non-prescriptive witnessing tone. USE WHEN deciding which Selemene surface to invoke or when routing between birth/compatibility/transit reports and solo/dyadic readings.
Route Selemene Engine tasks to the right surface: deterministic reports (birth/compatibility/transit) via selemene-core and the @selemene/bridge CLI, or narrative witness readings via selemene-report. USE WHEN the user wants anything under the Selemene/Noesis umbrella but has not named the exact surface.
Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
Explorador de arquivos
2 arquivos cloud-infrastructure-security.md 9.9 KB name security-review description Comprehensive security checklist and patterns to catch vulnerabilities in application code. USE WHEN adding authentication or authorization, handling user input or file uploads, creating API endpoints, working with secrets or credentials, implementing payment features, or storing and transmitting sensitive data. cluster security version 1.0.0
Security Review Skill
This skill ensures all code follows security best practices and identifies potential vulnerabilities.
When to Activate
Implementing authentication or authorization
Handling user input or file uploads
Creating new API endpoints
Working with secrets or credentials
Implementing payment features
Storing or transmitting sensitive data
Integrating third-party APIs
Security Checklist
1. Secrets Management
FAIL: NEVER Do This
const apiKey = "sk-proj-xxxxx"
const dbPassword = "password123"
PASS: ALWAYS Do This
const apiKey = process.env
OPENAI_API_KEY
const
env
DATABASE_URL
if
throw
new
Error
'OPENAI_API_KEY not configured'
Verification Steps
2. Input Validation
Always Validate User Input import { z } from 'zod'
const CreateUserSchema = z.object ({
email : z.string ().email (),
name : z.string ().min (1 ).max (100 ),
age : z.number ().int ().min (0 ).max (150 )
})
export async function createUser (input : unknown try {
const validated = CreateUserSchema .parse (input)
return await db.users .create (validated)
} catch (error) {
if (error instanceof z.ZodError ) {
return { success : false , errors : error.errors }
}
throw error
}
}
File Upload Validation function validateFileUpload (file : File const maxSize = 5 * 1024 * 1024
if (file.size > maxSize) {
throw new Error ('File too large (max 5MB)' )
}
const allowedTypes = ['image/jpeg' , 'image/png' , 'image/gif' ]
if (!allowedTypes.includes (file.type )) {
throw new Error ('Invalid file type' )
}
const allowedExtensions = ['.jpg' , '.jpeg' , '.png' , '.gif' ]
const extension = file.name .toLowerCase ().match (/\.[^.]+$/ )?.[0 ]
if (!extension || !allowedExtensions.includes (extension)) {
throw new Error ('Invalid file extension' )
}
return true
}
Verification Steps
3. SQL Injection Prevention
FAIL: NEVER Concatenate SQL
const query = `SELECT * FROM users WHERE email = '${userEmail} '`
await db.query (query)
PASS: ALWAYS Use Parameterized Queries
const { data } = await supabase
.from ('users' )
.select ('*' )
.eq ('email' , userEmail)
await db.query (
'SELECT * FROM users WHERE email = $1' ,
[userEmail]
)
Verification Steps
4. Authentication & Authorization
JWT Token Handling
localStorage .setItem ('token' , token)
res.setHeader ('Set-Cookie' ,
`token=${token} ; HttpOnly; Secure; SameSite=Strict; Max-Age=3600` )
Authorization Checks export async function deleteUser (userId : string , requesterId : string const requester = await db.users .findUnique ({
where : { id : requesterId }
})
if (requester.role !== 'admin' ) {
return NextResponse .json (
{ error : 'Unauthorized' },
{ status : 403 }
)
}
await db.users .delete ({ where : { id : userId } })
}
Row Level Security (Supabase)
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
CREATE POLICY "Users view own data"
ON users FOR SELECT
USING (auth.uid() = id);
CREATE POLICY "Users update own data"
ON users FOR UPDATE
USING (auth.uid() = id);
Verification Steps
5. XSS Prevention
Sanitize HTML import DOMPurify from 'isomorphic-dompurify'
function renderUserContent (html : string const clean = DOMPurify .sanitize (html, {
ALLOWED_TAGS : ['b' , 'i' , 'em' , 'strong' , 'p' ],
ALLOWED_ATTR : []
})
return <div dangerouslySetInnerHTML ={{ __html: clean }} />
Content Security Policy Start strict and loosen only with a documented removal plan. Do not default to
'unsafe-inline' or 'unsafe-eval'; they neutralize much of CSP's protection
and should be treated as temporary compatibility debt.
const securityHeaders = [
{
key : 'Content-Security-Policy' ,
value : `
default-src 'self';
base-uri 'self';
object-src 'none';
frame-ancestors 'none';
script-src 'self';
style-src 'self';
img-src 'self' data: https:;
font-src 'self';
connect-src 'self' https://api.example.com;
` .replace (/\s{2,}/g , ' ' ).trim ()
}
]
Verification Steps
6. CSRF Protection
CSRF Tokens import { csrf } from '@/lib/csrf'
export async function POST (request : Request const token = request.headers .get ('X-CSRF-Token' )
if (!csrf.verify (token)) {
return NextResponse .json (
{ error : 'Invalid CSRF token' },
{ status : 403 }
)
}
}
SameSite Cookies res.setHeader ('Set-Cookie' ,
`session=${sessionId} ; HttpOnly; Secure; SameSite=Strict` )
Verification Steps
7. Rate Limiting
API Rate Limiting import rateLimit from 'express-rate-limit'
const limiter = rateLimit ({
windowMs : 15 * 60 * 1000 ,
max : 100 ,
message : 'Too many requests'
})
app.use ('/api/' , limiter)
Expensive Operations
const searchLimiter = rateLimit ({
windowMs : 60 * 1000 ,
max : 10 ,
message : 'Too many search requests'
})
app.use ('/api/search' , searchLimiter)
Verification Steps
8. Sensitive Data Exposure
Logging
console .log ('User login:' , { email, password })
console .log ('Payment:' , { cardNumber, cvv })
console .log ('User login:' , { email, userId })
console .log ('Payment:' , { last4 : card.last4 , userId })
Error Messages
catch (error) {
return NextResponse .json (
{ error : error.message , stack : error.stack },
{ status : 500 }
)
}
catch (error) {
console .error ('Internal error:' , error)
return NextResponse .json (
{ error : 'An error occurred. Please try again.' },
{ status : 500 }
)
}
Verification Steps
9. Blockchain Security (Solana)
Wallet Verification import { verify } from '@solana/web3.js'
async function verifyWalletOwnership (
publicKey : string ,
signature : string ,
message : string
) {
try {
const isValid = verify (
Buffer .from (message),
Buffer .from (signature, 'base64' ),
Buffer .from (publicKey, 'base64' )
)
return isValid
} catch (error) {
return false
}
}
Transaction Verification async function verifyTransaction (transaction : Transaction if (transaction.to !== expectedRecipient) {
throw new Error ('Invalid recipient' )
}
if (transaction.amount > maxAmount) {
throw new Error ('Amount exceeds limit' )
}
const balance = await getBalance (transaction.from )
if (balance < transaction.amount ) {
throw new Error ('Insufficient balance' )
}
return true
}
Verification Steps
10. Dependency Security
Regular Updates
npm audit
npm audit fix
npm update
npm outdated
Lock Files
git add package-lock.json
npm ci
Verification Steps
Security Testing
Automated Security Tests
test ('requires authentication' , async () => {
const response = await fetch ('/api/protected' )
expect (response.status ).toBe (401 )
})
test ('requires admin role' , async () => {
const response = await fetch ('/api/admin' , {
headers : { Authorization : `Bearer ${userToken} ` }
})
expect (response.status ).toBe (403 )
})
test ('rejects invalid input' , async () => {
const response = await fetch ('/api/users' , {
method : 'POST' ,
body : JSON .stringify ({ email : 'not-an-email' })
})
expect (response.status ).toBe (400 )
})
test ('enforces rate limits' , async () => {
const requests = Array (101 ).fill (null ).map (() =>
fetch ('/api/endpoint' )
)
const responses = await Promise .all (requests)
const tooManyRequests = responses.filter (r =>status === 429 )
expect (tooManyRequests.length ).toBeGreaterThan (0 )
})
Pre-Deployment Security Checklist Before ANY production deployment:
Resources
Remember : Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.
