Agent skill
appsec
Application security - OWASP, validation, secrets. Use when securing the app.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/appsec-sylphxai-flow
SKILL.md
AppSec Guideline
Tech Stack
- Rate Limiting: Upstash Redis
- Framework: Next.js (with Turbopack)
- Platform: Vercel
Non-Negotiables
- OWASP Top 10:2025 vulnerabilities must be addressed
- Security headers present (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- CSRF protection on state-changing requests
- No plaintext secrets in logs, returns, storage, or telemetry
- Required configuration must fail-fast at build/startup if missing
- Secrets must not be hardcoded or committed
Context
Security isn't a feature — it's a foundational property. A single vulnerability can compromise everything else. Think like an attacker: where are the weak points?
MFA and session security live in account-security. This skill focuses on application-level attack surface.
Driving Questions
- What would an attacker target first?
- Where is rate limiting missing or insufficient?
- How are secrets managed and what's the rotation strategy?
- What happens when a secret is compromised?
- Where does "security by obscurity" substitute for real controls?
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?