Claude Skills by jeffreytse

Use when auditing third-party dependencies for known vulnerabilities, license issues, or supply chain risks

Use when building an OAuth 2.0 authorization server or configuring CORS on OAuth endpoints — token, userinfo, revocation, and introspection endpoints each have different CORS requirements that differ from ordinary API CORS.

Use when designing or reviewing authentication and authorization flows for web, mobile, or API systems

Use when a public company needs board-level cybersecurity risk governance and disclosure meeting SEC requirements — establishing defined board oversight of cyber risk, a documented incident materiality-assessment process, and required disclosure of both governance practices and material incidents, rather than treating cybersecurity purely as a technical, management-level function with no board accountability structure.

Use when designing how errors, exceptions, and failures are surfaced to users and logged internally — ensuring error messages don't leak sensitive implementation details while providing enough context for debugging.

Use when adding multi-factor authentication to an application — implementing TOTP, WebAuthn/passkeys, recovery codes, and phishing-resistant options for high-value accounts.

Use when establishing or improving a software development lifecycle — embedding security requirements, threat modeling, and security testing at each phase to find vulnerabilities when they cost 10× less to fix.

Use when adding logging to authentication flows, authorization decisions, admin actions, or any security-sensitive operation — to enable detection, forensics, and incident response.

Use when implementing user authentication state — creating, storing, transmitting, and expiring session tokens or cookies in a web application.

Use when designing software supply chain security controls including SBOM generation, artifact signing, dependency management, and build pipeline integrity

Use when designing a new system, reviewing architecture for security, adding an external-facing feature, handling sensitive data, or before a security audit.

Use when designing or migrating a security architecture to the zero trust model where no user, device, or network is trusted by default

Use when building any web page that performs state-changing actions on click — login forms, payment buttons, delete confirmations, or settings toggles that could be exploited if framed by an attacker.

Use when building login endpoints — detecting and blocking automated credential stuffing attacks using breached password detection, device fingerprinting, and bot detection.

Use when building any server-side endpoint that performs state-changing operations (POST, PUT, PATCH, DELETE) and is accessible by a browser session.

Use when deserializing data from untrusted sources — user-submitted cookies, API request bodies, message queue payloads, or any format that reconstructs objects (pickle, Java serialization, YAML, PHP serialize).

Use when binding HTTP request parameters or JSON bodies directly to model objects, database records, or data transfer objects — any place where user-supplied fields are mapped to internal properties.

Use when building any endpoint that redirects users based on a URL parameter — login redirects, logout returns, OAuth callback handling, or any redirect-after-action flow.

Use when building file upload, file download, file serving, or any feature where user input influences a filesystem path — including filename parameters, directory parameters, or file include logic.

Use when writing or reviewing regular expressions that process user-controlled input — especially patterns with nested quantifiers, alternation with overlapping cases, or patterns applied to long strings.

Use when writing code that constructs database queries using any data that originates outside the application — user input, API parameters, headers, cookies, or environment variables.

Use when building features that fetch URLs or make HTTP requests based on user-supplied input — web scrapers, webhook receivers, URL preview services, import-from-URL features, or any server-side HTTP client.

Use when rendering user-supplied content in HTML, writing JavaScript that inserts data into the DOM, or building APIs whose responses are rendered in a browser.

Use when parsing XML in any context — file uploads, SOAP APIs, RSS/Atom feeds, SVG processing, document conversion, or any XML-based data exchange format.

Use when penetration testing or auditing authentication mechanisms — executing WSTG OTG-AUTHN test cases for username enumeration, brute force, default credentials, weak lockout, MFA bypass, and password reset flaws.

Use when auditing an API for security vulnerabilities, conducting a pre-launch security review, performing a penetration test on API endpoints, or assessing API security posture against the OWASP API Security Top 10 (2023).

Use when auditing a web application's security posture against a structured verification standard — applying OWASP ASVS Level 1, 2, or 3 requirements to find and document security gaps across authentication, session management, access control, cryptography, and input validation.

Use when reviewing a new codebase for security, before a production launch, after a security incident, or during a compliance audit requiring OWASP Top 10 coverage.

Use when reviewing how secrets, credentials, API keys, or certificates are stored, rotated, and accessed in a system

Use when penetration testing or auditing session handling — executing WSTG OTG-SESS test cases for session token analysis, cookie attribute verification, CSRF, session fixation, and logout completeness.

Use when writing code that accepts data from outside the process boundary — HTTP requests, file uploads, database reads, CLI arguments, environment variables, or inter-service calls — to reject malformed, malicious, or out-of-range data before it reaches business logic.

Use when deciding whether to protect a behavior with a test, responding to an unexpected breakage, or reviewing code that depends on undocumented behavior — if a behavior matters enough to depend on, it needs a test; if it breaks without one, you have no standing to complain.

Use when writing UI automation or end-to-end tests to keep test logic decoupled from page implementation details, so tests remain maintainable when the UI changes.

Use when a function or module has an invariant that should hold across a wide range of inputs — not just the handful of specific cases an example-based test happens to cover — such as "encoding then decoding always returns the original value" or "sorting a list never changes its length"; generate many random inputs, assert the invariant holds for all of them, and let the framework automatically shrink any failing case to a minimal reproduction.

Use when deciding how much additional QA effort a specific code change warrants — route the decision through the change's actual risk profile (does it touch money, authentication, personal data, or concurrency?) to select which additional QA layers apply, rather than applying either a uniform minimum check to every change or an equally exhaustive review to changes with very different risk levels.

Use when implementing any business logic, fixing bugs, or when the correctness of a function's behavior under various inputs needs to be proved

Use when reporting the results of tests, checks, or any automated or manual verification step — explicitly label any result you have not actually observed running as unverified rather than presenting it as passing, and never weaken a test's assertion or scope just to make it pass, since a reporting discipline that silently conflates "unverified" with "passing" destroys the reliability of every report built on it.

Use when deciding how much test and verification code to write around a piece of core logic, now that AI can generate it at near-zero marginal cost — classify the logic by consequence-of-failure tier (disposable, hope-it-works, must-not-fail, could-kill-someone), then scale up generated, disposable stress tests, mutation tests, and edge-case harnesses for the higher tiers, inverting the older default of conserving test-writing effort because it used to be expensive.

Use when reviewing a pull request or code change for test adequacy — measure test coverage specifically on the lines changed in that diff, not whole-file or whole-codebase coverage, since a codebase can have high aggregate coverage while the specific lines just added or modified are completely untested.

Use when evaluating the adequacy of a test suite, identifying coverage gaps, or deciding where to add tests

Use when multiple teams maintain independent services that communicate via APIs, or when integration test environments are slow, expensive, or unavailable

Use when designing or running load, stress, or performance tests to validate system behavior under traffic

Use when establishing a testing strategy for a new project, when test suites are slow or flaky, or when the ratio of unit/integration/e2e tests is imbalanced

Use when starting a new project, onboarding a codebase, auditing test coverage quality, or deciding where to invest testing effort across unit, integration, and end-to-end layers.

Use when a test passes and fails non-deterministically without code changes — to identify the root cause category (timing, shared state, concurrency, external dependency, randomness) and eliminate the flakiness rather than retrying or skipping the test.

Use when a build or deployment has just completed and needs verification before being declared done — actually run the built artifact in a realistic environment and check the core paths work, rather than treating a passing automated test suite as proof the real system functions, since the test harness and the real runtime environment can diverge in ways only actual execution reveals.

Use when writing tests that verify the interaction between two or more components, services, or external systems

Use when writing a new unit test, reviewing tests for quality, adding tests to untested code, or when a test is fragile, slow, or hard to understand.

Use when quantifying greenhouse gas emissions for an organization, product, project, or activity to establish a baseline or report emissions.

Use when planning habitat restoration — applying reference ecosystem analysis, species selection criteria, site preparation sequencing, and monitoring protocols to establish self-sustaining native plant and wildlife communities.