typescript-security-review

This is a defensive security-review skill for TypeScript and Node.js codebases. It solves the problem of running a consistent, OWASP-aligned audit over an application before deployment: instead of ad hoc checks, it walks a structured review covering authentication and authorization, injection, input validation, XSS, secrets management, dependency risk, and security headers. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples, and the skill can delegate deeper analysis to a dedicated security-expert agent.

The workflow is a numbered checklist with verification checkpoints at each stage. It uses grep and read to locate security-sensitive patterns, confirms that route handlers enforce auth guards, checks database queries for parameterization, verifies input validation with Zod/Joi/class-validator, inspects React components for unsanitized dangerouslySetInnerHTML, scans for hardcoded secrets and gitignored env files, runs npm audit for dependency CVEs, and reviews helmet/CORS/rate-limiting/cookie-flag configuration. Reference files expand on XSS prevention, dependency and supply-chain security (typosquatting, install-script attacks, dependency confusion), security headers, input validation, common vulnerabilities, and OWASP guidance for Express, NestJS, and Next.js.

It targets application security engineers and TypeScript developers preparing for production releases, code reviews of auth flows, or compliance checks (GDPR, HIPAA, SOC2 data handling). The guidance is entirely protective in intent: it teaches how to find and fix weaknesses, recommends secure patterns like DOMPurify sanitization and startup env-var validation, and explicitly steers toward least-privilege credential handling. No offensive tooling or exploit automation is present.