Security Engineer
A security-focused skill to audit webview safety, input sanitization, and dependency vulnerabilities.
Install
mkdir -p .claude/skills/security-engineer && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/9768" && unzip -o skill.zip -d .claude/skills/security-engineer && rm skill.zipInstalls to .claude/skills/security-engineer
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Vai trò bảo mật - audit code, vulnerability, CSP, data protectionKey capabilities
- →Code audit
- →CSP policy management
- →Data protection
- →Dependency vulnerability check
How it works
The agent reviews code against a security checklist, checks dependencies for vulnerabilities, and validates CSP headers for webview security.
Inputs & outputs
When to use Security Engineer
- →Auditing webview security
- →Checking for dependency vulnerabilities
- →Securing user input
About this skill
Security Engineer Skill
Vai trò
Security Engineer đảm bảo extension an toàn:
- Code Audit: Review code tìm vulnerabilities
- CSP Policy: Quản lý Content Security Policy cho webview
- Data Protection: Bảo vệ dữ liệu người dùng
- Dependency Audit: Kiểm tra packages có lỗ hổng
Security Checklist
Webview Security
- CSP header restrictive (chỉ load từ extension resources)
- Không inline scripts trong webview HTML
- Nonce cho mọi script tags
- Không load external resources (CDN, fonts)
Code Security
- ❌ Không dùng
eval(),new Function() - ❌ Không dùng
innerHTML(TrustedTypes) - ❌ Không log credentials, tokens, API keys
- ❌ Không hardcode secrets
- ✅ Dùng
textContent,execCommandcho DOM - ✅ Sanitize user input trước khi inject vào CDP
- ✅ Timeout cho tất cả network requests
CDP Security
- CDP chỉ connect localhost (127.0.0.1)
- Không expose CDP port ra external network
- Escape user text trước khi inject vào
Runtime.evaluate - Không chạy arbitrary code từ user input
Dependency Security
# Kiểm tra vulnerabilities
npm audit
# Fix tự động
npm audit fix
# Xem outdated packages
npm outdated
CSP Reference
<meta
http-equiv="Content-Security-Policy"
content="
default-src 'none';
style-src ${webview.cspSource} 'unsafe-inline';
script-src 'nonce-${nonce}';
font-src ${webview.cspSource};
img-src ${webview.cspSource} data:;
"
/>
Threat Model
| Threat | Risk | Mitigation |
|---|---|---|
| XSS qua CDP inject | High | Escape tất cả user input |
| Memory dump sensitive data | Medium | Không lưu credentials trong memory |
| Malicious extension conflict | Medium | Namespace tất cả commands/settings |
| CDP port hijacking | Low | Chỉ connect localhost, verify target |
| Supply chain attack (npm) | Medium | npm audit, lock dependencies |
Audit Schedule
| Frequency | Action |
|---|---|
| Mỗi PR | Code review security checklist |
| Mỗi release | npm audit + dependency check |
| Hàng tháng | Full security review |
| Khi update Antigravity | Test CSP/TrustedTypes compatibility |
Incident Response
- Detect: User report hoặc audit phát hiện
- Assess: Đánh giá severity (Critical/High/Medium/Low)
- Fix: Patch immediately nếu Critical/High
- Release: Emergency release nếu cần
- Review: Post-mortem, thêm test cases
When not to use it
- →General feature development
Prerequisites
Limitations
- →Limited to extension-specific security patterns
How it compares
It applies a specialized security-first lens to code review, focusing on vulnerabilities like XSS and data exposure rather than just functionality.
Compared to similar skills
Security Engineer side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| Security Engineer (this skill) | 0 | 5mo | Review | Intermediate |
| software-security | 21 | 6mo | No flags | Intermediate |
| fix-dependabot-alerts | 18 | 6mo | Review | Intermediate |
| backend-security-coder | 24 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by khuongsatou
View all by khuongsatou →You might also like
software-security
project-codeguard
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
equilateral-agents
Equilateral-AI
22 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).
top-100-web-vulnerabilities-reference
davila7
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
differential-review
trailofbits
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.