Development
Skill
/security
Application security best practices and patterns
Claude Code
$ npx -y skills add Fujigo-Software/f5-framework-claude --skill security --agent claude-code
Codex
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a codex -y
Cursor
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a cursor -y
Gemini CLI
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a gemini-cli -y
GitHub Copilot
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a github-copilot -y
OpenCode
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a opencode -y
Windsurf
$ npx skills add Fujigo-Software/f5-framework-claude --skill security -a windsurf -y
SKILL.md
security.SKILL.mdname: security
description: Application security best practices and patterns
category: skill
allowed-tools: Read, Write, Glob, Grep, Bash
user-invocable: true
context: inject
Security Skills
Overview
Security knowledge essential for building secure applications, protecting user data, and preventing common vulnerabilities.
Security Layers
┌─────────────────────────────────────────────┐
│ Application Security │
│ ┌─────────────────────────────────────────┐│
│ │ Authentication & AuthZ ││
│ │ ┌───────────────────────────────────┐ ││
│ │ │ Input Validation │ ││
│ │ │ ┌─────────────────────────────┐ │ ││
│ │ │ │ Data Protection │ │ ││
│ │ │ └─────────────────────────────┘ │ ││
│ │ └───────────────────────────────────┘ ││
│ └─────────────────────────────────────────┘│
│ Infrastructure Security │
└─────────────────────────────────────────────┘
Categories
Authentication
- JWT tokens and refresh strategies
- OAuth 2.0 / OpenID Connect
- Session management
- Multi-factor authentication
- Passwordless authentication
Authorization
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Permission systems
- Access control patterns
OWASP Top 10
- Injection attacks
- Broken authentication
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Security misconfiguration
- Sensitive data exposure
API Security
- Rate limiting
- Input validation
- API key management
- CORS configuration
Data Protection
- Encryption at rest/transit
- Password hashing
- Secrets management
- Data masking/anonymization
Infrastructure
- HTTPS/TLS configuration
- Security headers
- Container security
- Network security
Compliance
- GDPR requirements
- PCI-DSS standards
- Security auditing
Security Mindset
> "Security is not a product, but a process." - Bruce Schneier
Always assume:
- All input is malicious
- External systems can be compromised
- Attackers will find vulnerabilities
- Defense in depth is essential
Quick Reference
| Threat | Primary Defense | Secondary Defense | |--------|-----------------|-------------------| | SQL Injection | Parameterized queries | Input validation | | XSS | Output encoding | CSP headers | | CSRF | CSRF tokens | SameSite cookies | | Auth bypass | Strong authentication | Session management | | Data breach | Encryption | Access control |
Related Skills
- [API Design](../api-design/) - Secure API patterns
- [Testing](../testing/) - Security testing
- [Architecture](../architecture/) - Security architecture
Read more
name: security description: Application security best practices and patterns category: skill allowed-tools: Read, Write, Glob, Grep, Bash user-invocable: true context: inject
Security Skills
Overview
Security knowledge essential for building secure applications, protecting user data, and preventing common vulnerabilities.
Security Layers
┌─────────────────────────────────────────────┐ │ Application Security │ │ ┌─────────────────────────────────────────┐│ │ │ Authentication & AuthZ ││ │ │ ┌───────────────────────────────────┐ ││ │ │ │ Input Validation │ ││ │ │ │ ┌─────────────────────────────┐ │ ││ │ │ │ │ Data Protection │ │ ││ │ │ │ └─────────────────────────────┘ │ ││ │ │ └───────────────────────────────────┘ ││ │ └─────────────────────────────────────────┘│ │ Infrastructure Security │ └─────────────────────────────────────────────┘
Categories
Authentication
- JWT tokens and refresh strategies
- OAuth 2.0 / OpenID Connect
- Session management
- Multi-factor authentication
- Passwordless authentication
Authorization
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Permission systems
- Access control patterns
OWASP Top 10
- Injection attacks
- Broken authentication
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Security misconfiguration
- Sensitive data exposure
API Security
- Rate limiting
- Input validation
- API key management
- CORS configuration
Data Protection
- Encryption at rest/transit
- Password hashing
- Secrets management
- Data masking/anonymization
Infrastructure
- HTTPS/TLS configuration
- Security headers
- Container security
- Network security
Compliance
- GDPR requirements
- PCI-DSS standards
- Security auditing
Security Mindset
> "Security is not a product, but a process." - Bruce Schneier
Always assume:
- All input is malicious
- External systems can be compromised
- Attackers will find vulnerabilities
- Defense in depth is essential
Quick Reference
| Threat | Primary Defense | Secondary Defense | |--------|-----------------|-------------------| | SQL Injection | Parameterized queries | Input validation | | XSS | Output encoding | CSP headers | | CSRF | CSRF tokens | SameSite cookies | | Auth bypass | Strong authentication | Session management | | Data breach | Encryption | Access control |
Related Skills
- [API Design](../api-design/) - Secure API patterns
- [Testing](../testing/) - Security testing
- [Architecture](../architecture/) - Security architecture
Stats
24
Stars
8
Forks
Quiet
Maintenance
Python
Language
MIT
License
Last commit
Created
2434 skills104 agents
Stars on GitHub
Momentum
- stars in total
- 24
Other skills on f5-framework.
architecture
Software architecture patterns, principles, and best practices
@fujigo-softwareInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about security.
- Which coding agents can use security?
- security installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.