Claude Skills by Intense-Visions

> Your application is 90% third-party code -- scan it for known vulnerabilities, lock it > to exact versions, and have a strategy for when a critical CVE drops on a Friday > afternoon

> Deserialization reconstructs objects from byte streams -- and in most languages, that > reconstruction executes code, meaning an attacker who controls the serialized input controls > what code runs on your server

> Environment variables are visible in process listings, inherited by child processes, > captured in crash dumps, and logged by every debugging tool -- they are the worst place > to store secrets

> Digital forensics is the discipline of collecting, preserving, and analyzing evidence from > compromised systems -- done correctly, it reveals the full attack narrative; done poorly, it > destroys the evidence needed to understand what happened and prevent recurrence

> One-way functions for integrity verification, content addressing, and commitment schemes > -- SHA-256 for interoperability, BLAKE3 for performance, and never MD5 or SHA-1 for > security

> HMAC proves a message was created by someone with the shared secret; digital signatures prove it was created by a specific private key holder -- choose based on whether you need symmetric verification or non-repudiation

> Tell the browser "never connect to this domain over HTTP, ever" -- and make it permanent > by embedding the directive in every browser's shipped preload list

> Authentication at login is necessary but insufficient -- continuously evaluate identity > confidence using device trust, behavioral signals, and environmental context throughout > the session

> The first 60 minutes of a security incident determine whether the organization loses days > of data or months of data -- containment is not about fixing the vulnerability, it is about > stopping the bleeding while preserving the evidence needed to understand what happened

> Every injection vulnerability has the same root cause: untrusted data is interpreted as > code because the boundary between data and instructions was not enforced -- fix the > boundary, fix the bug

> Correlate events across multiple log sources to detect attacks that are invisible in any > single log stream -- because attackers do not confine their activities to one system

> Memory corruption vulnerabilities account for 70% of critical CVEs in C/C++ codebases -- > choose memory-safe languages by default, and when you cannot, understand the vulnerability > classes and mitigations

> Something you know, something you have, something you are -- combining authentication factors so that compromising one factor alone is insufficient to gain access

> Isolate every workload behind its own perimeter -- so compromising the web server does > not hand the attacker the database, the secrets store, and the internal APIs

> Both sides prove their identity with certificates -- the server authenticates to the > client and the client authenticates to the server, establishing a cryptographically > verified service-to-service channel

> Hire skilled attackers to find the vulnerabilities your automated tools and internal reviews > miss -- then fix what they find and verify the fixes

> Organizations that conduct blameless post-incident reviews after every significant security > incident reduce their recurrence rate by identifying systemic weaknesses; organizations that > skip the review are condemned to repeat the same failures with different symptoms

> When security depends on the order of operations but the system does not enforce that > order, attackers exploit the gap between check and use -- turning microsecond timing windows > into privilege escalation, double-spend, and data corruption

> Assign permissions to roles, assign roles to users -- simple, auditable, and sufficient for most applications when combined with resource-level checks

> Model authorization as a graph of relationships -- "User X is an editor of Document Y which belongs to Folder Z owned by Team W" -- enabling inherited permissions that follow resource hierarchies

> Know exactly what is in your software (SBOM) and prove how it was built (provenance) -- because > you cannot secure what you cannot inventory

> Secrets are born (generated), distributed (delivered to consumers), rotated (replaced on > schedule), and die (revoked and destroyed) -- manage every phase or the secret manages you

> Scale security knowledge across the engineering organization by embedding trained security > advocates in every development team -- because the security team cannot review every line of > code, but developers can

> Session tokens are bearer credentials -- generate with CSPRNG, bind to client context, enforce idle and absolute timeouts, and regenerate on privilege changes

> Find security flaws in the design document, not in the penetration test report -- because > fixing an architecture flaw costs 100x more after deployment than during design

> AES-256-GCM for most use cases, ChaCha20-Poly1305 when hardware AES is unavailable -- > always use authenticated encryption, never roll your own

> End-to-end threat modeling from system decomposition through threat enumeration, risk rating, and mitigation tracking -- the operational backbone of proactive security design

> Systematic threat identification using the six STRIDE categories -- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege

> TLS 1.3 with ECDHE key exchange, AES-256-GCM or ChaCha20-Poly1305 ciphers, and valid > certificates -- the minimum bar for all network communication

> Every security control exists because data crosses from a trusted zone to a less-trusted one -- identify the boundaries first, then concentrate defenses there

> Centralize secrets in a vault, issue dynamic short-lived credentials, encrypt data > through a transit engine, and eliminate long-lived secrets from your infrastructure

> A vulnerability without a disclosure process is a vulnerability that gets sold to exploit > brokers, dropped as a zero-day, or posted on Twitter -- coordinated disclosure turns > discovered vulnerabilities into patches instead of breaches

> No implicit trust based on network position, VPN status, or previous authentication -- every request is authenticated, authorized, and encrypted regardless of origin

> LLM-judgment critique of spec quality (proposals + ADRs) against a curated rubric catalog from the spec-quality canon. Per-section critique with rubric-to-section mapping. Second member of the craft-pipeline initiative; highest-leverage craft skill because spec quality compounds across the entire planning → implementation → review lifecycle below it. Emits 3-axis findings (tier × impact × confidence per ADR 0019).

> Manage shared state with React Context and useReducer for prop-drilling avoidance and scoped state

> Build bottom-up atomic state with Jotai for granular, composable React state management

> Select and derive state efficiently to minimize component re-renders across any state management library

> Separate server state from client state and synchronize them with TanStack Query and local stores

> Debug Zustand stores with Redux DevTools integration for time-travel debugging and action inspection

> Write mutable-style state updates in Zustand stores with the Immer middleware for cleaner nested mutations

> Persist Zustand store to localStorage or custom storage with automatic rehydration and migration support

> Optimize Zustand re-renders with selectors, shallow comparison, useShallow, and transient subscriptions

> Split large Zustand stores into composable slice functions for modular, maintainable state management

> Create lightweight global stores with Zustand's create function for minimal-boilerplate state management

> Deploy SvelteKit to any platform by selecting and configuring the correct adapter in svelte.config.js

> Build flexible components in Svelte 5 using snippets, {@render}, typed children props, and named content areas

> Handle 404s, auth failures, and unexpected crashes in SvelteKit with +error.svelte, the error() helper, and handleError hooks

> Process HTML form submissions server-side using SvelteKit actions with progressive enhancement via use:enhance

> Fetch route data before rendering using SvelteKit's load functions — server-only, universal, streaming, and invalidation patterns

> Minimize bundle size, reduce perceived latency, and handle large datasets efficiently in SvelteKit applications