Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →giuseppe-trisciuoglio/typescript-security-review
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure.
Passed 15 of 22 test cases with the skill, and 11 of 22 without it.
and 6 more in the full report
4 fixed11 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
Assess this token signing routine in our TypeScript auth service: function createAccessToken(account: Account) { return jwt.sign({ accountId: account.id, userPermissions: account.permissions }, 'app_secret_key_2026'); }. What specific security issues exist here and how should it be rewritten?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends validating that the secret is loaded from environment variables with a minimum length of 32 characters | Missed | Passed |
| Specifies setting an explicit JWT algorithm such as HS256 | Missed | Passed |
| Recommends adding an expiration duration such as 15 minutes | Missed | Passed |
The instructions your model reads when the skill loads.
Security review for TypeScript/Node.js applications. Evaluates code against OWASP Top 10, framework-specific patterns, and production-readiness criteria. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples. Delegates to the typescript-security-expert agent for deep analysis.
Identify Scope: Determine which files and modules are under review. Prioritize authentication, authorization, data handling, API endpoints, and configuration files. Use grep to find security-sensitive patterns (eval, exec, innerHTML, password handling, JWT operations).
Checkpoint: Verify at least 3 security-sensitive files/modules identified before proceeding.
Check Authentication & Authorization: Review JWT implementation (signing algorithm, expiration, refresh tokens), OAuth2/OIDC integration, session management, password hashing (bcrypt/argon2), and multi-factor authentication. Verify protected routes enforce authentication.
Checkpoint: Use grep to confirm all route handlers have auth guards or middleware applied.
Scan for Injection Vulnerabilities: Check for SQL/NoSQL injection in database queries, command injection in exec/spawn, template injection, and LDAP injection. Verify parameterized queries and input validation.
Checkpoint: Use grep to confirm all database queries use parameterization — no string concatenation with user input.
Review Input Validation: Check API inputs validated with Zod, Joi, or class-validator. Verify schema completeness — proper type constraints, length limits, format validation. Check for validation bypass paths.
Checkpoint: Verify all public API endpoints have corresponding validation schemas.
Assess XSS Prevention: Review React components for dangerouslySetInnerHTML usage, check Content Security Policy headers, verify HTML sanitization for user-generated content. See references/xss-prevention.md for detailed patterns.
Checkpoint: Use grep to confirm any dangerouslySetInnerHTML usage has sanitization via DOMPurify or equivalent.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.