Claude Skills by emre-guler

Use when reviewing a web application for authorization flaws — object IDs or filenames taken from requests, admin or staff routes, role or permission checks, multi-step flows, tenant boundaries — or when asked to find IDOR, privilege escalation, broken access control, or "can user A reach user B's data" issues.

Use when starting a security review of a web application codebase, when a detection skill reports that architecture.md is missing, or when the codebase has changed enough that the existing architecture summary is stale.

Use when reviewing a REST or JSON API for surface the front end never exercises — undocumented or legacy endpoints, multiple live versions, catch-all or method-agnostic routes, request bodies bound wholesale onto models or entities, protected properties such as isAdmin or balance reachable through an update, or user input concatenated into an internal service URL, path, or JSON body — or when asked about mass assignment, auto-binding, hidden parameters, or parameter pollution.

Use when reviewing login, registration, logout, password reset or change, remember-me tokens, multi-factor challenges, or session and cookie configuration — or when asked about brute force, account lockout, credential stuffing, username enumeration, 2FA bypass, weak password hashing, forgeable session tokens, or session fixation.

Use when reviewing an application whose rules involve money, quantity, discounts, coupons, limits, quotas, refunds, credits, loyalty points, entitlements, or multi-step flows — or when prices, totals, or eligibility arrive from the client, when one endpoint changes behaviour depending on which parameters are present, or when asked to find logic flaws, workflow bypasses, price manipulation, or abuse-of-function bugs.

Use when sensitive pages may be loaded in a frame by another site — no `X-Frame-Options`, no CSP `frame-ancestors`, `frameguard` disabled, `@xframe_options_exempt`, `frameOptions().disable()`, headers set on only some routes — or when one-click state changes, forms prefilled from query parameters, or client-side frame-busting scripts appear; also when asked about clickjacking, UI redressing, framing protection, or whether a page can be embedded in an iframe.

Use when a server sets `Access-Control-Allow-Origin` from the request `Origin`, pairs it with `Access-Control-Allow-Credentials: true`, matches allowed origins with `startsWith`/`endsWith`/`includes` or loose regex, trusts the `null` origin or an `http://` origin, or wildcards authenticated or internal endpoints; also when asked to review cross-origin sharing configuration.

Use when a codebase hashes passwords, encrypts or decrypts stored data, generates tokens, salts, nonces or session identifiers, compares a signature or a MAC, derives a key from a passphrase, or sets certificate options on an HTTP client — or when asked about weak or missing encryption, ECB mode, reused IVs, insecure randomness, fast password hashes, timing-unsafe comparison, home-made ciphers, or disabled certificate checks.

Use when state-changing endpoints authenticate with session cookies — email or password change, role updates, transfers, deletions — or when anti-forgery middleware is disabled, exempted or unevenly mounted, tokens are compared against a cookie, `Referer` checks or method-override parameters appear, or cookies are set without `SameSite`; also when asked about CSRF or forged requests.

Use when the application rebuilds objects from bytes it received — serialized session cookies, hidden form state, cached or queued payloads, uploaded files, binary or type-carrying blobs — or when reviewing native object readers and polymorphic type handling, and when asked to find insecure deserialization, object injection, gadget chains, or untrusted pickle, marshal, or binary formatter usage.

Use when client-side JavaScript passes URL, `document.referrer`, `window.name`, cookie, storage or `postMessage` data into navigation, cookie, storage, request, socket, parser or DOM-property APIs — `location.href`, `window.open`, `document.cookie`, `setRequestHeader`, `new WebSocket`, `JSON.parse`, `document.evaluate`, `executeSql` — or when asked about client-side open redirection, web-message origin checks, or DOM clobbering.

Use when the application accepts files from users — multipart handlers, avatar or attachment endpoints, document and media import, "fetch from URL" imports, archive imports — or when reviewing where uploaded files are stored and served, and when asked to find unrestricted file upload, web shell upload, extension bypass, or unsafe attachment handling.

Use when a codebase serves a GraphQL endpoint — schema or SDL files, resolver maps, code-first type definitions, Apollo or similar server setup, a playground, or subscriptions — and especially when introspection or suggestions may be enabled in production, resolvers fetch objects straight from a client-supplied argument, private fields sit on client-facing types, or no depth, complexity, alias, or operation limits are configured.

Use when application code builds absolute URLs, password-reset or invitation links, redirects, or email content from the request's host, when forwarded-host or forwarded-scheme headers are honoured, when a proxy routes or names a backend from the client-supplied host, or when asked about reset-link poisoning, host-based access decisions, or unvalidated virtual-host routing.

Use when reviewing error handling, debug or diagnostic endpoints, framework debug flags, server banners, directory listing, what a build copies into a served directory, developer comments or credentials in shipped client code, or responses that differ by internal state — or when asked about leaked stack traces, exposed version-control directories, backup files, or verbose errors.

Use when a codebase issues or accepts JSON Web Tokens — bearer credentials, session cookies holding a signed token, identity tokens from a login provider, key-set endpoints, or kid, jwk and jku header handling — or when asked about token forgery, algorithm confusion, alg none, weak signing secrets, or missing claim checks.

Use when an application embeds a language model — chat endpoints, model SDK calls, prompt templates, retrieval or document context, agent loops — and especially when untrusted text is concatenated into a prompt, when tools or functions exposed to the model perform real actions or run with service credentials, or when model output is rendered into a page, executed, or used to build a query, command, or outbound request.

Use when reviewing an application backed by a document or key-value store — MongoDB, Mongoose, Couchbase, DynamoDB, Cassandra, Neo4j — where request JSON or query strings become query filters, where a login compares username and password in a single lookup, or where server-side JavaScript expressions are evaluated, or when asked to find NoSQL injection, operator injection, or query type-confusion problems.

Use when reviewing social or delegated sign-in, an authorization callback handler, state or nonce handling, redirect_uri matching, authorization-code exchange, id_token consumption, scope enforcement, PKCE, dynamic client registration, or an identity provider — or when asked about account takeover through a third-party login flow.

Use when reviewing a web application for redirects whose destination comes from the request — `next`, `returnUrl`, `redirect`, `url`, `continue`, `dest` parameters, post-login or post-action return targets, `Location` headers and framework redirect calls built from user input, allowlists compared with prefix, substring or suffix checks — or when asked to find open redirect, unvalidated redirect, or URL forwarding abused for phishing or token theft.

Use when reviewing code that runs external programs — image or document conversion, PDF generation, archive handling, network diagnostics such as ping or nslookup, backup and maintenance scripts, virus scanning, git or cloud CLI wrappers — or when a request value reaches a shell string, or when asked to find command injection, shell injection, or remote code execution through a spawned process.

Use when request data becomes part of a filesystem path — a filename, document key, template name, download or attachment parameter, archive entry, log or export destination — or when reviewing hand-rolled file serving, and when asked to find path traversal, directory traversal, arbitrary file read or write, local file inclusion, or zip slip issues.

Use when JavaScript or Node.js code recursively merges, clones, extends, or path-sets user-controllable objects — query and body parsers with nested key syntax, config merging, deep-copy helpers, option objects with optional fields — or when asked to find prototype pollution, `__proto__` injection, polluted inherited properties, or gadget-driven escalation to DOM scripting or command execution.

Use when reviewing code that checks a condition and then changes state in a separate step — redeeming coupons or gift cards, decrementing stock, transferring funds, enforcing per-user caps or rate limits, creating an object across several statements, or writing session, cache, and database state one field at a time — or when asked about concurrency bugs, TOCTOU gaps, double-spend, duplicate redemption, or limit overruns.

Use when one or more websec detection skills have produced results files and a single consolidated, severity-ranked security report is needed, or when asked to summarise or prioritise security findings across classes.

Use when a repository ships reverse-proxy, load-balancer, CDN, gateway, or ingress configuration in front of an application, when a front hop terminates HTTP/2 and speaks HTTP/1 upstream, when handlers respond without reading the request body, or when asked whether front-end security controls, forwarded identity headers, or connection reuse between hops could be desynchronised or bypassed.

Use when a full security review of a web application codebase is wanted in one step, when asked to "scan", "audit", or "check everything" for vulnerabilities, or when a first pass over an unfamiliar codebase is needed before deciding where to look closer.

Use when reviewing a repository for credentials in source, configuration, environment files, infrastructure manifests or pipeline definitions, for keys and tokens shipped in front-end bundles, mobile builds, source maps, templates or served assets, or for values deleted from the working tree but still present in an earlier commit — or when asked about hardcoded API keys, committed private keys, leaked cloud credentials, or connection strings in code.

Use when reviewing an application that talks to a relational database — raw SQL strings, concatenation or interpolation into query text, ORM raw escape hatches, dynamic ORDER BY or table names, search filters, report builders, login lookups — or when asked to find SQL injection, unsafe query construction, or "can this parameter change the query" issues.

Use when the application fetches a URL, host, or address that came from a request — link previews, webhooks, avatar or image import, "import from URL", PDF or thumbnail rendering, feed readers, proxy endpoints, health checks — or when asked to find SSRF, server-side request forgery, cloud metadata credential theft, or whether user input can make the server reach internal hosts.

Use when reviewing code that renders server-side templates from dynamic strings — a value concatenated into the template text, a template body or name taken from a request, a database column, or a CMS record, custom email and notification templates, user-editable themes — or when asked to find server-side template injection, unsafe render or compile calls, or template-driven code execution.

Use when a site sits behind a CDN, reverse proxy, or shared cache and serves authenticated pages — account, profile, settings, tokens, API keys — or when routing tolerates trailing path segments, matrix parameters, or encoded traversal, or when asked whether a victim's private page could end up in a shared cache and be read by someone else.

Use when a site sits behind a CDN, reverse proxy, or shared cache and its responses reflect request-derived values — forwarded host or scheme headers, cookies, query parameters — into HTML, script or stylesheet URLs, or redirects, or when cache-key configuration drops or rewrites parts of the request, or when asked whether one attacker request could make every later visitor receive a harmful response.

Use when a codebase opens or serves WebSocket connections — an upgrade handler, a socket.io, ws, SignalR, Django Channels, Phoenix or STOMP endpoint, server message handlers, or client-side connection and onmessage code — or when asked about cross-site WebSocket hijacking, origin checks on the handshake, or unvalidated socket messages.

Use when reviewing a web application that echoes request data or stored user data into HTML, templates or inline scripts — raw/unescaped interpolation, `dangerouslySetInnerHTML`, `v-html`, `|raw`, `.html_safe`, string-built markup, client code writing URL data into `innerHTML`/`document.write`/`eval` — or when asked to find XSS, cross-site scripting, HTML or script injection, or "can an attacker run JavaScript in another user's session".

Use when an application parses XML from untrusted sources — XML or SOAP request bodies, SAML assertions, RSS or sitemap imports, SVG and Office documents accepted as uploads, configuration or feed ingestion — or when XML parser factories appear without hardening options, or when asked to find XXE, external entity resolution, DTD processing, or XInclude issues.