Perform security testing with OWASP checks, dependency vulnerability scanning, secrets detection, and security header validation. [EXPLICIT] Trigger: "security test", "OWASP", "vulnerability scan", "secrets detection"
From jm-adknpx claudepluginhub javimontano/jm-adk-alfaThis skill is limited to using the following tools:
agents/guardian.mdagents/lead.mdagents/specialist.mdagents/support.mdevals/evals.jsonknowledge/body-of-knowledge.mdknowledge/knowledge-graph.mdprompts/meta.mdprompts/primary.mdprompts/variations/deep.mdprompts/variations/quick.mdtemplates/output.docx.mdtemplates/output.htmlSearches prompts.chat for AI prompt templates by keyword or category, retrieves by ID with variable handling, and improves prompts via AI. Use for discovering or enhancing prompts.
"Security is not a product — it's a process." — Bruce Schneier
Guides security testing practices — OWASP Top 10 checks, automated dependency scanning, secrets detection in code, security header validation, and penetration testing preparation. Use when auditing application security or establishing security testing in the development pipeline. [EXPLICIT]
npm audit to identify known vulnerabilities in dependenciesnpm audit or Snyk in CI pipeline for dependency scanningtextContent over innerHTMLAccess-Control-Allow-Origin: * in production)| Anti-Pattern | Why It's Bad | Do This Instead |
|---|---|---|
| Escape instead of strip | Escaped HTML can still render in edge cases | Strip tags, keep text content only |
| Client-only validation | Bypassable via DevTools | Mirror validation on server (Cloud Functions) |
| Static-only security checks | Misses runtime-injected content | Add runtime Playwright checks |
input-sanitization — Detailed strip-default implementation with DOMParserdual-layer-verification — Static + runtime verification methodologyfirestore-security-rules — Server-side rule enforcemente2e-testing — Playwright infrastructure for runtime verificationnpm audit warnings because "they're dev dependencies"dangerouslySetInnerHTML or innerHTML with user-provided contentfirestore-security-rules — Firestore rules are a key security layercode-review — security review should be part of every PR reviewExample invocations:
| Scenario | Handling |
|---|---|
| Empty or minimal input | Request clarification before proceeding |
| Conflicting requirements | Flag conflicts explicitly, propose resolution |
| Out-of-scope request | Redirect to appropriate skill or escalate |