Agent skill
security-check
Automatic OWASP security checks on generated code. Use when: any code is generated in the pipeline. Triggers: internal use only.
Install this agent skill to your Project
npx add-skill https://github.com/timequity/plugins/tree/main/vibe-coder/skills/security-check
SKILL.md
Security Check
OWASP validation on every code generation. User doesn't see.
Checks
Input Validation
- All user inputs sanitized
- No raw SQL queries (use parameterized)
- No eval() or dynamic code execution
- File uploads validated (type, size)
Authentication
- Passwords hashed (bcrypt/argon2)
- Sessions properly managed
- CSRF protection enabled
- Rate limiting on auth endpoints
Authorization
- Protected routes check auth
- API endpoints verify permissions
- No direct object references exposed
Data Exposure
- No secrets in code
- Sensitive data not logged
- API responses don't leak internals
- Error messages don't expose stack
Headers
- HTTPS enforced
- Security headers set (CSP, HSTS)
- Cookies secure + httpOnly
Auto-Fix
For common issues:
| Issue | Auto-Fix |
|---|---|
| Raw SQL | Convert to parameterized |
| Missing sanitization | Add input validation |
| Exposed secrets | Move to env vars |
| Missing auth check | Add middleware |
Automation Script
Run OWASP checks programmatically:
python scripts/security_scan.py --path /project/path
python scripts/security_scan.py --path /project/path --json # JSON output
python scripts/security_scan.py --fail-on high # Fail on high+ severity
Checks: SQL injection, hardcoded secrets, unsafe eval, command injection, insecure HTTP.
Reporting
| Result | Action |
|---|---|
| All pass | Continue silently |
| Auto-fixed | Continue, log internally |
| Can't fix | Block + ask user to clarify |
User sees nothing unless there's an unfixable security issue.
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
timequity/plugins
claude-code-course
Learn Claude Code in 5 hands-on lessons. From basics to building applications. Use when: user wants to learn Claude Code, asks "how do I...", or is new. Triggers: "learn", "teach me", "how does this work", "I'm new", "course".
timequity/plugins
foundations
Claude Code basics for new users. Covers essential concepts and commands. Use when: user is new to Claude Code or routed here by learning-path assessment.
timequity/plugins
advanced
Claude Code mastery for power users. Build agents, MCP servers, publish plugins. Use when: user wants to create agents, build integrations, or publish plugins.
timequity/plugins
lessons
Lesson content for Claude Code Course. Use when: loading lesson content. Internal skill - contains lesson files.
timequity/plugins
intermediate
Claude Code customization for comfortable users. Covers skills, commands, MCP, hooks. Use when: user knows basics and wants to customize Claude Code.
timequity/plugins
course-help
Help and navigation for Claude Code Course. Use when: user asks about the course, lessons, or progress. Triggers: "help", "course help", "what lessons", "my progress".
Didn't find tool you were looking for?