security-expert

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security Expert

## Overview

Security Expert provides a systematic approach to identifying and preventing security vulnerabilities in code. It covers OWASP Top 10, common vulnerability patterns, secure coding practices, and remediation strategies for building secure applications.

## When to Use

Use this skill when:

- Conducting security reviews
- Analyzing code for vulnerabilities
- The user mentions "security", "vulnerability", or "secure coding"
- Checking for OWASP Top 10 issues
- Reviewing authentication and authorization
- Validating input handling
- Investigating potential CVEs

## Security Review Process

### Phase 1: Threat Modeling

Before writing code, understand potential threats:

1. **Identify Assets**
   - User data (PII, credentials)
   - Financial information
   - Intellectual property
   - System access

2. **Map Attack Surface**
   - User inputs (forms, APIs, URLs)
   - External services
   - File uploads
   - Configuration files

3. **Identify Attack Vectors**
   - SQL injection
   - Cross-site scripting (XSS)
   - Cross-site request forgery (CSRF)
   - Authentication bypass
   - Authorization flaws

### Phase 2: Input Validation

All user input is evil until proven otherwise.

#### SQL Injection

**The Problem:**

```sql
-- User input directly concatenated
SELECT * FROM users WHERE id = ${userId}

-- Attacker input: 1; DROP TABLE users;--
```

**The Solution - Parameterized Queries:**

```javascript
// ❌ BAD: String concatenation
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ GOOD: Parameterized query
const query = "SELECT * FROM users WHERE id = ?";
db.query(query, [userId]);
```

```python
# ❌ BAD: String formatting
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

# ✅ GOOD: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
```

#### Command Injection

```javascript
// ❌ BAD: User input in shell command
const cmd = `ls ${userDirectory}`;
exec(cmd);

// ✅ GOOD: Avoid shell when possible, or use safe alternatives
const files = fs.readdirSync(userDirectory);
```

```python
# ❌ BAD: shell=True with user input
subprocess.run(f"ls {directory}", shell=True)

# ✅ GOOD: list form without shell
subprocess.run(["ls", directory])
```

#### Path Traversal

```javascript
// ❌ BAD: User input in file path
const file = path.join uploadsDir, req.body.filename;
fs.readFile(file);

// ✅ GOOD: Validate and sanitize
const filename = req.body.filename;
if (!isValidFilename(filename)) {
  throw new Error('Invalid filename');
}
const file = path.join(uploadsDir, filename);
if (!file.startsWith(uploadsDir)) {
  throw new Error('Path traversal detected');
}
```

### Phase 3: Authentication & Authorization

#### Password Security

```javascript

From ntk148v/skills, MIT.

More from ntk148v/skills