Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新
免费在 GitHub 公开
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
中文简介正在准备中。当前显示原文说明。
查看安装方法包含的文件（3）
- SKILL.md2.9 KB
- assets/security-checklist.md3.2 KB
- references/vulnerability-patterns.md8.0 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
Security Review Skill
Ensures all code follows security best practices and identifies potential vulnerabilities.
When to Activate
- Implementing authentication or authorization
- Handling user input or file uploads
- Creating new API endpoints
- Working with secrets or credentials
- Implementing payment features
- Storing or transmitting sensitive data
- Integrating third-party APIs
Security Checklist Categories
Review each category. See references/vulnerability-patterns.md for WRONG/CORRECT code examples.
- Secrets Management -- No hardcoded secrets; all in env vars;
.env*gitignored - Input Validation -- Schema validation; file upload size/type/extension checks
- SQL Injection -- Parameterized queries only; no string concatenation
- Auth & Authorization -- httpOnly cookies; RBAC; row-level/object-level authorization where needed
- XSS Prevention -- DOMPurify for user HTML; CSP headers configured
- CSRF Protection -- CSRF tokens on state-changing ops; SameSite=Strict cookies
- Rate Limiting -- All endpoints rate-limited; stricter on expensive operations
- Data Exposure -- No secrets in logs; generic error messages to users
- High-Risk Integrations -- Payments, wallets, third-party APIs, and webhooks validated when present
- Dependencies --
npm auditclean; lock files committed; Dependabot enabled
Full checkbox checklist: assets/security-checklist.md
Pre-Deployment Checklist
Before ANY production deployment, confirm ALL of the following:
- No hardcoded secrets, all in env vars
- All user inputs validated
- All queries parameterized
- User content sanitized (XSS)
- CSRF protection enabled
- Proper token handling (httpOnly cookies)
- Authorization role checks in place
- Rate limiting on all endpoints
- HTTPS enforced
- Security headers configured (CSP, X-Frame-Options)
- No sensitive data in error messages or logs
- Dependencies up to date, no vulnerabilities
- CORS properly configured
- File uploads validated (size, type)
References
references/vulnerability-patterns.md-- All WRONG/CORRECT code examples by vulnerability typeassets/security-checklist.md-- Full security review checklist (markdown checkboxes)- OWASP Top 10
- Next.js Security
- Web Security Academy
Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
ClickHouse database patterns, query optimization, analytics, and data engineering best practices for high-performance analytical workloads.
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新
日本語の業務文書を作成・修正するときに使用する共通品質基準。事実性、確度、論理、簡潔さ、自然な日本語を守る。提案書、報告、技術説明、議事録、メール、Slack、要約、レビューに適用する。創作、広告コピー、コードや構造化データだけの生成には使用しない。
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新
Universal coding standards, best practices, and patterns for TypeScript, JavaScript, React, and Node.js development.
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新
Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles.
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新
Frontend development patterns for React, Next.js, state management, performance optimization, and UI best practices.
中文简介正在准备中。当前显示原文说明。
cloudnative-co/claude-code-starter-kit1542026年10月12日 更新