security-review-openai

name	security-review-openai
title	Security Best Practices
description	Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
author	OpenAI
author_url	https://lawve.ai/en/skills/security-review-openai
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	general
language	en
sources	[{"title":"Golang General Backend Security","path":"references/golang-general-backend-security.md"},{"title":"Javascript Express Web Server Security","path":"references/javascript-express-web-server-security.md"},{"title":"Javascript General Web Frontend Security","path":"references/javascript-general-web-frontend-security.md"},{"title":"Javascript Jquery Web Frontend Security","path":"references/javascript-jquery-web-frontend-security.md"},{"title":"Javascript Typescript Nextjs Web Server Security","path":"references/javascript-typescript-nextjs-web-server-security.md"},{"title":"Javascript Typescript React Web Frontend Security","path":"references/javascript-typescript-react-web-frontend-security.md"},{"title":"Javascript Typescript Vue Web Frontend Security","path":"references/javascript-typescript-vue-web-frontend-security.md"},{"title":"Python Django Web Server Security","path":"references/python-django-web-server-security.md"},{"title":"Python Fastapi Web Server Security","path":"references/python-fastapi-web-server-security.md"},{"title":"Python Flask Web Server Security","path":"references/python-flask-web-server-security.md"}]

Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.

Then check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is <language>-<framework>-<stack>-security.md. You should also check if there is a <language>-general-<stack>-security.md which is agnostic to the framework you may be using.

If working on a web application which includes a frontend and a backend, make sure you have checked for reference documents for BOTH the frontend and backend!

If you are asked to make a web app which will include both a frontend and backend, but the frontend framework is not specified, also check out javascript-general-web-frontend-security.md. It is important that you understand how to secure both the frontend and backend.

If no relevant information is available in the skill's references directory, think a little bit about what you know about the language, the framework, and all well known security best practices for it. If you are unsure you can try to search online for documentation on security best practices.

From there it can operate in a few ways.

1. The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.

2. The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.

3. The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe anyways the project fails to follow security best practices guidance. The report should be prioritized and have clear sections of severity and urgency. Then offer to start working on fixes for these issues. See #fixes below.