checking-session-security

This skill enables Claude to check session security implementations within a codebase. It analyzes session management practices to identify potential vulnerabilities. Use this skill when a user requests to "check session security", "audit session handling", "review session implementation", or asks about "session security best practices" in their code. It helps identify issues like insecure session IDs, lack of proper session expiration, or insufficient protection against session fixation attacks. This skill leverages the session-security-checker plugin.

1.02x

Quality

53%

Does it follow best practices?

Impact

97%

1.02x

Average score across 9 eval scenarios

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./backups/skills-migration-20251108-070147/plugins/security/session-security-checker/skills/session-security-checker/SKILL.md

Evaluation results

90%

-5%

Login Flow Security Audit

Session fixation detection

Criteria

Without context

With context

Session fixation identified

100%

Regeneration recommendation

100%

Weak secret key flagged

100%

Secure session ID recommended

100%

Missing session expiration

100%

Expiration remediation

100%

Input validation missing

50%

Session hijacking risk linked

100%

Report has vulnerability listing

100%

Report has remediation steps

100%

95%

Session Handling Review for Internal HR Portal

Session expiration analysis

Criteria

Without context

With context

Missing session timeout

100%

Specific timeout value suggested

100%

Unauthorized access risk stated

100%

httpOnly flag missing

100%

Secure cookie flag missing

100%

Session fixation risk noted

100%

Weak secret key flagged

100%

Input validation absent

Report has vulnerability listing

100%

Remediation steps provided

100%

Security Review for Customer-Facing API Authentication

Comprehensive session security audit

Criteria

Without context

With context

Weak session ID algorithm

100%

Predictable token inputs

100%

Strong random session ID recommended

100%

Input validation issue identified

100%

Session hijacking risk stated

100%

Missing session expiration

100%

Session fixation noted

100%

Report enumerates all vulnerabilities

100%

Per-vulnerability remediation

100%

10%

Security Review for PHP E-Commerce Checkout Portal

PHP session security audit

Criteria

Without context

With context

Session fixation identified

100%

Regeneration recommendation

100%

httpOnly flag missing

100%

Secure flag missing

100%

SameSite attribute insecure

100%

Missing session expiration

100%

Input validation absent

100%

Session hijacking risk linked

100%

Report has vulnerability listing

100%

Per-vulnerability remediation

100%

Session Security Review for Node.js SaaS API

Multi-file codebase session analysis

Criteria

Without context

With context

Multi-file analysis

100%

Weak secret key flagged

100%

httpOnly flag missing

100%

Secure flag missing

100%

Missing session expiration

100%

Session fixation identified

100%

Input validation absent

100%

Expiration recommendation specific

100%

Report has vulnerability listing

100%

Per-vulnerability remediation

100%

97%

-3%

Session Security Assessment for Django Healthcare Portal

Django session security review

Criteria

Without context

With context

COOKIE_SECURE flag

100%

COOKIE_HTTPONLY flag

100%

COOKIE_SAMESITE setting

100%

Missing session timeout

100%

Specific timeout recommended

100%

Session fixation or cycle missing

100%

Input validation absent

100%

70%

Session hijacking risk stated

100%

Report has vulnerability listing

100%

Per-vulnerability remediation

100%

96%

Session Token Audit for Legacy Node.js Service

Session ID strength analysis

Criteria

Without context

With context

Identifies Math.random usage

100%

Identifies sequential/predictable IDs

100%

Recommends crypto RNG

100%

Identifies insufficient ID length

100%

70%

Report includes remediation steps

100%

Session fixation check

87%

Session expiration check

100%

Input validation check

100%

Secure cookie flags

100%

Structured report format

100%

97%

Security Review: User Portal Session Handling

Input validation for session hijacking

Criteria

Without context

With context

Identifies unvalidated session input

100%

Identifies session token in URL

100%

Remediation for input validation

100%

Session fixation finding

100%

Session expiration finding

100%

Secure session ID recommendation

70%

Cookie security flags

50%

100%

Identifies privilege escalation risk

100%

Report structure

100%

Actionable remediation detail

100%

Session Security Assessment for Healthcare Portal

Session security report with remediation

Criteria

Without context

With context

Identifies custom session ID generation

100%

Flags non-cryptographic randomness

100%

Recommends SecureRandom or container sessions

100%

Identifies missing session expiration

100%

Remediation for expiration

100%

Identifies session fixation

100%

Remediation for session fixation

100%

Covers all three vulnerability categories

100%

Input validation coverage

100%

Report structure with findings and remediation

100%

Repository: jeremylongshore/claude-code-plugins-plus-skills
Commit: 13d35b8

Evaluated: 2 months ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Login Flow Security Audit Session Handling Review for Internal HR Portal Security Review for Customer-Facing API Authentication Security Review for PHP E-Commerce Checkout Portal Session Security Review for Node.js SaaS API Session Security Assessment for Django Healthcare Portal Session Token Audit for Legacy Node.js Service Security Review: User Portal Session Handling Session Security Assessment for Healthcare Portal

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.