OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add giuseppe-trisciuoglio/developer-kit --skill typescript-security-review
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for Express, NestJS, and Next.js. Triggers on "security review", "check for security issues", "TypeScript security audit".
npx skills add giuseppe-trisciuoglio/developer-kit --skill typescript-security-review
Security review for TypeScript/Node.js applications. Evaluates code against OWASP Top 10, framework-specific patterns, and production-readiness criteria. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples. Delegates to the typescript-security-expert agent for deep analysis.
Identify Scope: Determine which files and modules are under review. Prioritize authentication, authorization, data handling, API endpoints, and configuration files. Use grep to find security-sensitive patterns (eval, exec, innerHTML, password handling, JWT operations).
Checkpoint: Verify at least 3 security-sensitive files/modules identified before proceeding.
Check Authentication & Authorization: Review JWT implementation (signing algorithm, expiration, refresh tokens), OAuth2/OIDC integration, session management, password hashing (bcrypt/argon2), and multi-factor authentication. Verify protected routes enforce authentication.
Checkpoint: Use grep to confirm all route handlers have auth guards or middleware applied.
Scan for Injection Vulnerabilities: Check for SQL/NoSQL injection in database queries, command injection in exec/spawn, template injection, and LDAP injection. Verify parameterized queries and input validation.
Checkpoint: Use grep to confirm all database queries use parameterization — no string concatenation with user input.
Review Input Validation: Check API inputs validated with Zod, Joi, or class-validator. Verify schema completeness — proper type constraints, length limits, format validation. Check for validation bypass paths.
Checkpoint: Verify all public API endpoints have corresponding validation schemas.
Assess XSS Prevention: Review React components for dangerouslySetInnerHTML usage, check Content Security Policy headers, verify HTML sanitization for user-generated content. See references/xss-prevention.md for detailed patterns.
Checkpoint: Use grep to confirm any dangerouslySetInnerHTML usage has sanitization via DOMPurify or equivalent.
Check Secrets Management: Scan for hardcoded credentials, API keys, secrets in source code. Verify .env files are gitignored, secrets accessed through proper management services.
Checkpoint: Run grep -r "password\|secret\|api.*key\|token" --include="*.ts" to identify potential secrets in code.
Review Dependency Security: Run npm audit or check package-lock.json for known vulnerabilities. Identify outdated dependencies with CVEs. Check for unnecessary dependencies.
Checkpoint: Verify npm audit results are reviewed and critical vulnerabilities addressed.
Evaluate Security Headers & Configuration: Check helmet.js or manual security header configuration. Review CORS policy, rate limiting, HTTPS enforcement, cookie security flags (HttpOnly, Secure, SameSite), and CSP. See references/security-headers.md for configuration examples.
Checkpoint: Use grep to confirm helmet or equivalent security headers are applied globally.
Produce Security Report: Generate structured report with severity-classified findings, remediation guidance with code examples, and security posture summary.
Feedback Loop: If Critical or High vulnerabilities found, re-scan related modules for similar patterns before finalizing. Use grep to identify if the same vulnerability pattern exists elsewhere.
See references/xss-prevention.md for XSS patterns and references/security-headers.md for security headers configuration.
Structure all security review findings as follows:
Overall security assessment score (1-10) with key observations and risk level.
Issues that can be exploited to compromise the system, steal data, or cause unauthorized access.
Security misconfigurations, missing protections, or vulnerabilities requiring near-term remediation.
Issues that reduce security posture but have mitigating factors or limited exploitability.
Security improvements, hardening recommendations, and defense-in-depth enhancements.
Well-implemented security patterns and practices to acknowledge.
Prioritized action items with code examples for the most critical fixes.
HttpOnly, Secure, SameSite=Strictnpm audit in CI pipelines to catch dependency vulnerabilitiesSee the references/ directory for detailed security documentation:
references/owasp-typescript.md — OWASP Top 10 mapped to TypeScript/Node.js patternsreferences/common-vulnerabilities.md — Common vulnerability patterns and remediationreferences/dependency-security.md — Dependency scanning and supply chain securityreferences/xss-prevention.md — XSS prevention patterns for React and server-sidereferences/security-headers.md — Security headers and CORS configuration examplesreferences/input-validation.md — Input validation patterns with Zod and class-validator// ❌ Critical: SQL injection vulnerability
async function findUser(email: string) {
const result = await db.query(
`SELECT * FROM users WHERE email = '${email}'`
);
return result.rows[0];
}
// ✅ Secure: Parameterized query
async function findUser(email: string) {
const result = await db.query(
'SELECT id, name, email FROM users WHERE email = $1',
[email]
);
return result.rows[0];
}
// ✅ Secure: ORM with type-safe queries (Drizzle example)
async function findUser(email: string) {
return db.select({
id: users.id,
name: users.name,
email: users.email,
})
.from(users)
.where(eq(users.email, email))
.limit(1);
}