security-best-practices

Implement security best practices for web applications and infrastructure. Use when securing APIs, preventing common vulnerabilities, or implementing security policies. Handles HTTPS, CORS, XSS, SQL Injection, CSRF, rate limiting, and OWASP Top 10.

1.49x

Quality

82%

Does it follow best practices?

Impact

100%

1.49x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Evaluation results

100%

37%

Secure an Express.js API for Production Launch

Express.js security middleware setup

Criteria

Without context

With context

Helmet usage

100%

CSP defaultSrc

100%

CSP objectSrc none

100%

CSP frameSrc none

100%

HSTS maxAge

100%

HSTS includeSubDomains

100%

HSTS preload

100%

HTTPS redirect condition

50%

100%

HTTPS 301 redirect

100%

General rate limiter

100%

Rate limiter headers

100%

Auth rate limiter

50%

100%

skipSuccessfulRequests

100%

express-rate-limit package

100%

60%

Implement Secure User Registration Endpoint

Input validation and injection prevention

Criteria

Without context

With context

Joi validation library

100%

Email validation

100%

Password min length

100%

Password pattern

100%

Name length bounds

100%

Parameterized queries

100%

No string interpolation in SQL

100%

DOMPurify usage

100%

No eval() usage

100%

No direct innerHTML

100%

Joi in package.json

100%

DOMPurify in package.json

100%

Implement Secure JWT Authentication with Token Refresh

JWT auth with refresh token rotation

Criteria

Without context

With context

Access token 15m expiry

100%

Refresh token 7d expiry

100%

Refresh token stored in DB

100%

Separate JWT secrets

100%

Secrets from env vars

100%

No hardcoded secrets

100%

Old token invalidated

100%

New tokens issued on refresh

100%

New refresh token stored

100%

jsonwebtoken package

100%

Repository: supercent-io/skills-template
Commit: c033769

Evaluated: 28 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Secure an Express.js API for Production Launch Implement Secure User Registration Endpoint Implement Secure JWT Authentication with Token Refresh

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.