Security

Security Skill

Use this skill when writing any code that handles user input, authentication, authorization, or external data. Security rules apply to all features, not just auth-related ones.

When to Use

• Writing or reviewing route handlers that accept user input
• Implementing authentication or authorization logic
• Querying databases or calling external services with user-supplied data
• Handling file uploads or user-provided file paths
• Returning error messages to clients
• Setting HTTP headers or cookies

Rules

1. [rules/input-validation.md](rules/input-validation.md) — Validate and sanitize all input at the boundary using Fastify JSON Schema.
2. [rules/injection.md](rules/injection.md) — Prevent SQL, NoSQL, command, and path injection.
3. [rules/auth.md](rules/auth.md) — Authentication patterns: JWT verification, session hygiene, and authorization checks.
4. [rules/error-handling.md](rules/error-handling.md) — Safe error responses that never leak internals.
5. [rules/headers.md](rules/headers.md) — Secure HTTP headers and cookie attributes.

Quick Reference

• Always define a schema — Fastify rejects non-conforming input automatically
• Never expose internal errors to the client
• Authorization — always check ownership, not just authentication

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: jesus-seijas-sp
• Source: jesus-seijas-sp/claude-node-setup
• License: MIT

Install and usage instructions live in the source repository linked above.