giuseppe-trisciuoglio avatar

Typescript Security Review

This one runs systematic security audits on TypeScript and Node.js codebases, checking for OWASP Top 10 issues like XSS, injection flaws, and auth problems. It works through a structured checklist: scanning for hardcoded secrets, verifying JWT configurations, checking that all database queries are parameterized, confirming input validation schemas exist for every endpoint, and running npm audit for dependency CVEs. The output is a severity-ranked report with code examples showing both vulnerable and fixed versions. Use it before production deploys, when reviewing auth implementations, or when you need to validate Express, NestJS, or Next.js security configurations. The checkpoint system keeps the review methodical rather than surface-level.

skills.sh installs
4.1K
GitHub stars
369
last updated
Aug 21, 2026

Install

$ npx -y skills add giuseppe-trisciuoglio/developer-kit --skill typescript-security-review --agent claude-code

Installs into .claude/skills of the current project.

Files

TypeScript Security Review

Overview

Security review for TypeScript/Node.js applications. Evaluates code against OWASP Top 10, framework-specific patterns, and production-readiness criteria. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples. Delegates to the typescript-security-expert agent for deep analysis.

When to Use

  • Performing security audits on TypeScript/Node.js codebases
  • Reviewing authentication and authorization implementations (JWT, OAuth2, Passport.js)
  • Checking for common vulnerabilities (XSS, injection, CSRF, path traversal)
  • Validating input validation and sanitization logic
  • Reviewing dependency security (npm audit, known CVEs)
  • Checking secrets management and environment variable handling
  • Assessing API security (rate limiting, CORS, security headers)
  • Reviewing Express, NestJS, or Next.js security configurations
  • Before deploying to production or after significant code changes
  • Compliance checks (GDPR, HIPAA, SOC2 data handling requirements)

Instructions

Sponsors

Details

Repository
github.com/giuseppe-trisciuoglio/developer-kit
Categories
Frontend Development, Backend & APIs, Security, Git & Pull Requests, Code Review & Quality
First seen
May 16, 2026

More from giuseppe-trisciuoglio/developer-kit

All 102
1zc277584121 avatarbrowser-screenshotzc277584121/marketing-skillsTake focused, region-specific screenshots from web pages using a dedicated headed Chrome profile with persistent login state. Navigates to the right page based 4.1Kskills.sh installs
2inngest avatarinngest-durable-functionsinngest/inngest-skillsUse when building functions that must survive process crashes, retry automatically on failure, run on a schedule, react to events, or maintain state across infr4Kskills.sh installs
3dotnet avatarmaui-app-lifecycledotnet/skills.NET MAUI app lifecycle guidance — the four app states, cross-platform Window lifecycle events (Created, Activated, Deactivated, Stopped, Resumed, Destroying), 4Kskills.sh installs
4sanity-io avatarcontent-experimentation-best-practicessanity-io/agent-toolkitContent experimentation and A/B testing guidance covering experiment design, hypotheses, metrics, sample size, statistical foundations, CMS-managed variants, an4Kskills.sh installs
5softaworks avatarplugin-forgesoftaworks/agent-toolkitCreate and manage Claude Code plugins with proper structure, manifests, and marketplace integration. Use when creating plugins for a marketplace, adding plugin 4Kskills.sh installs
6figma avatarfigma-implement-designfigma/mcp-server-guideTranslates Figma designs into production-ready application code with 1:1 visual fidelity. Use when implementing UI code from Figma files, when user mentions "im4Kskills.sh installs