security-checklist

6

Zate

This skill should be used for OWASP, security review, authentication, XSS, SQL injection prevention, CSRF, input validation, secure coding, vulnerability scanning

Global Validation

6

coreyja

Implement secure, comprehensive input validation on both client and server sides using allowlists, type checking, and sanitization to prevent injection attacks. Use this skill when handling user input from forms, API requests, or any external data source. When implementing form validation logic with field-specific error messages. When validating data types, formats, ranges, and required fields. When sanitizing input to prevent SQL injection, XSS, or command injection. When validating business rules like sufficient balance or valid date ranges. When implementing both client-side validation for user experience and mandatory server-side validation for security.

input-validation

6

yanko-belov

Use when accepting user input. Use when handling request data. Use when trusting external data without validation.

form-patterns

6

spences10

DaisyUI v5 form patterns. Use for inputs, selects, textareas, validation, and form structure with fieldset/legend.

api-security-best-practices

5

agent-skills-hub

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Zod

5

oriolrius

Expert guidance for Zod schema validation including type inference, schema composition, parsing, refinements, transformations, error handling, and TypeScript integration. Use this when building type-safe validation, form validation, or API input validation.

mobile-security-coder

5

agent-skills-hub

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

effect-config-schema

5

mepuka

Config loading and Schema validation/transform. Use when defining configuration or validating inputs.

security-checklist

5

webdevtodayjason

Comprehensive security checklist covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, authorization, secrets management, input validation, and security headers. Use when scanning for vulnerabilities, reviewing security, implementing authentication/authorization, or handling sensitive data.

backend-security-coder

5

agent-skills-hub

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

security-review

5

sunnypatneedi

Conduct comprehensive security code reviews covering OWASP Top 10, vulnerability assessment, secure coding practices, input validation, authentication, authorization, and data protection.

sandboxing-security

4

gitwalter

Input validation and sanitization, output filtering, code execution safety, and permission management

api-security-testing

4

ngxtm

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

api-security-best-practices

4

ngxtm

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

trpc-api

4

gitwalter

tRPC router setup with Next.js App Router, procedures (query, mutation, subscription), input validation with Zod, middleware and context, React Query integration, error handling, and type inference.

building-trpc-api

4

gitwalter

tRPC router setup with Next.js App Router, procedures (query, mutation, subscription), input validation with Zod, middleware and context, React Query integration, error handling, and type inference.

secure-code-guardian

4

ngxtm

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention.

vibe-security

4

0x8506

Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.

harmonyos-review

3

CoreyLyn

HarmonyOS code review skill for auditing ArkTS projects against official Huawei development guidelines and security best practices. Use when reviewing HarmonyOS applications for: (1) Security compliance (hardcoded credentials, encryption, input validation), (2) ArkTS language standards (hilog usage, type safety, magic numbers), (3) Component lifecycle management (resource cleanup, event subscription handling), (4) State management (V1/V2 decorator consistency), (5) Database operations (ResultSet handling, transaction management, encryption), (6) Permission management (official permission patterns), (7) Performance issues (async forEach, resource leaks), (8) API version compatibility, (9) Kit usage best practices. Generates comprehensive markdown reports with prioritized fix recommendations.

pt-web-application-assessment

3

santosomar

Performs authorized web application and API penetration testing with focus on OWASP-style risks and business logic flaws. Use when assessing websites, web APIs, authentication flows, session handling, and input validation.

Developing R packages

3

akm-rs

Building robust R packages with modern tidyverse patterns. Use this skill when creating or maintaining R packages, designing APIs, choosing dependencies, implementing input validation, writing error messages, or deciding between internal and exported functions. Covers dependency strategy, tidyverse API design patterns, validation approaches, error handling with cli/rlang, testing levels, and documentation priorities.

zod-schema-generator

3

Nembie

Generate Zod validation schemas from Prisma models, TypeScript interfaces, or JSON examples. Use when asked to generate Zod schemas, create validation, bridge Prisma to Zod, validate API input/output, or generate runtime type checks.

pt-fuzzing-web-api

3

santosomar

Performs authorized fuzzing of web applications and APIs to discover input validation failures, parser bugs, and stability issues. Use when testing HTTP endpoints, request parameters, payload handling, and error behavior under malformed or unexpected inputs.

rlang-conditions

3

akm-rs

Use when developing R packages that need to handle errors, warnings, and conditions properly. Covers: (1) cli_abort/cli_warn/cli_inform for throwing conditions with formatting, (2) Error call context with caller_env() and caller_arg(), (3) Input validation helpers that report the right function, (4) Error chaining with try_fetch() and parent argument, (5) Testing error conditions with testthat snapshots.

blackbox-testing

3

sawrus

Automates end-to-end and system validation tests. Runs services via Docker, feeds inputs, executes scenarios, and verifies outputs.

testing-websocket-api-security

2

mukul975

Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.

validate-piles-notation

2

pjt222

Parse and validate PILES (Puzzle Input Line Entry System) notation for specifying piece fusion groups in jigsawR. Covers syntax validation, parsing into group lists, plain-language explanation, adjacency verification against puzzle results, and round-trip serialization. Use when validating user-supplied PILES strings before passing to generate_puzzle(), debugging fusion group issues, explaining the notation to users, or testing round-trip parse/serialize fidelity.

security-patterns

2

Unson-LLC

brainbaseのセキュリティパターン（XSS Prevention、CSRF Protection、Input Validation）への準拠をチェックし、脆弱性を検出して修正提案する3 Phase Orchestrator Skill。

security-implementation-guide

2

organvm-iv-taxis

Comprehensive security patterns for authentication, authorization, input validation, and common vulnerability prevention

securing-serverless-functions

2

mukul975

This skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.

implementing-api-schema-validation-security

2

mukul975

Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.

validate-piles-notation

2

pjt222

Parse and validate PILES (Puzzle Input Line Entry System) notation for specifying piece fusion groups in jigsawR. Covers syntax validation, parsing into group lists, plain-language explanation, adjacency verification against puzzle results, and round-trip serialization. Use when validating user-supplied PILES strings before passing to generate_puzzle(), debugging fusion group issues, explaining the notation to users, or testing round-trip parse/serialize fidelity.

performing-web-application-penetration-test

2

mukul975

Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.

exploiting-api-injection-vulnerabilities

2

mukul975

Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection testing, SQLi in APIs, NoSQL injection, SSRF testing, or API input validation assessment.

dream

2

pjt222

AI unconstrained creative exploration — deliberately dropping structure to let associations form freely. The one skill that inverts the standard procedure format: instead of inputs, steps, and validation, dream opens space for emergence without evaluation. Use before design work, before naming things, before choosing between approaches, or anywhere that premature structure kills the best option.

form-validation

2

joabgonzalez

Form and schema validation across libraries. Trigger: When validating forms, API input, schemas, or runtime data.

fail-early-pattern

2

pjt222

Apply the fail-early (fail-fast) pattern to detect and report errors at the earliest possible point. Covers input validation with guard clauses, meaningful error messages, assertion functions, and anti-patterns that silently swallow failures. Primary examples in R with general/polyglot guidance. Use when writing functions that accept external input, adding input validation before CRAN submission, refactoring code that silently produces wrong results, reviewing PRs for error-handling quality, or hardening internal APIs against invalid arguments.

fail-early-pattern

2

pjt222

Apply the fail-early (fail-fast) pattern to detect and report errors at the earliest possible point. Covers input validation with guard clauses, meaningful error messages, assertion functions, and anti-patterns that silently swallow failures. Primary examples in R with general/polyglot guidance. Use when writing functions that accept external input, adding input validation before CRAN submission, refactoring code that silently produces wrong results, reviewing PRs for error-handling quality, or hardening internal APIs against invalid arguments.

performing-http-parameter-pollution-attack

2

mukul975

Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.

conducting-api-security-testing

2

mukul975

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

security-hardening

2

frankxai

Security best practices for web applications. Covers OWASP Top 10, authentication, authorization, input validation, CSP, and secure headers.

dream

2

pjt222

AI unconstrained creative exploration — deliberately dropping structure to let associations form freely. The one skill that inverts the standard procedure format: instead of inputs, steps, and validation, dream opens space for emergence without evaluation. Use before design work, before naming things, before choosing between approaches, or anywhere that premature structure kills the best option.

python-error-handling

1

mattmre

Python error handling patterns including input validation, exception hierarchies, and partial failure handling. Use when implementing validation logic, designing exception strategies, handling batch processing failures, or building robust APIs.

validate-before-process

1

jimmc414

For input validation: check format and constraints before processing, fail fast with clear errors, defensive parsing.

secure-coding-cybersecurity

1

B4san

Expert guidance on secure coding practices, focusing on preventing common security errors made by AI during code generation. Use for: auditing AI-generated code, implementing secure design patterns, and ensuring code follows OWASP Top 10 standards. Covers input validation, authentication, cryptography, file handling, secure configuration, and business logic security.

web-security-hardening

1

dtsong

Security audit checklist for web applications. Use when reviewing, auditing, or hardening a web app's security posture. Covers rate limiting, auth headers, IP blocking, CORS, security middleware, input validation, file upload limits, ORM usage, and password hashing. Triggers on requests like "review security", "harden this app", "security audit", "check for vulnerabilities", or when building/reviewing API endpoints.

dotnet input validation

1

wshaddix

Validating HTTP request inputs. .NET 10 AddValidation, FluentValidation, ProblemDetails.

fuzzing-apis

1

agent-arc-744

This skill enables Claude to perform automated fuzz testing on APIs to discover vulnerabilities, crashes, and unexpected behavior. It leverages malformed inputs, boundary values, and random payloads to generate comprehensive fuzz test suites. Use this skill when you need to identify potential SQL injection, XSS, command injection vulnerabilities, input validation failures, and edge cases in APIs. Trigger this skill by requesting fuzz testing, vulnerability scanning, or security analysis of an API. The skill is invoked using the `/fuzz-api` command.