Tailor: Skill for Claude Code

Security Engineering & Fortification Skill

Activate this skill when designing or implementing authentication, authorization, database access, file systems, external networking, API endpoints, cryptographic routines, or conducting security audits (/security-audit).

Zero-Trust Security Law: Never trust client input, never assume identity without server validation, parameterize all queries, and enforce least-privilege defense-in-depth across every boundary.

---

1. Automated Secret & Pattern Scanner

Before committing code or completing any task, run the automated security scanner:

# Run deterministic secret and vulnerability checks
node skills/security/scripts/scan-secrets.js

---

2. Universal Threat Matrix & Defense Implementations

A. Zero Hardcoded Secrets & Cryptographic Randomness (CRITICAL)

• Insecure Anti-Pattern:

  const API_KEY = "sk_live_98327498234";
  const token = Math.random().toString(36).substring(2); // Insecure PRNG
  

• Secure Standard:

  import crypto from 'node:crypto';
  
  const API_KEY = process.env.API_KEY;
  if (!API_KEY) throw new Error("CRITICAL: API_KEY is required.");
  
  // Cryptographically secure token generation
  const secureToken = crypto.randomBytes(32).toString('hex');
  

---

B. Injection Defense: SQL, NoSQL & OS Commands (CRITICAL)

1. SQL Injection (SQLi)

• Insecure (String Interpolation):

  db.query(`SELECT * FROM users WHERE email = '${email}' AND status = '${status}'`);
  

• Secure (Parameterized Queries):

  db.query('SELECT * FROM users WHERE email = $1 AND status = $2', [email, status]);
  

2. NoSQL Operator Injection

• Insecure: Directly passing unvalidated request body into MongoDB queries:

  db.collection('users').findOne({ email: req.body.email, password: req.body.password });
  // Attacker sends: { email: "[email protected]", password: { "$gt": "" } }
  

• Secure: Validate schema strictly (e.g. Zod) to ensure values are primitive strings, never objects.