version: 0.1.0

stack-security-coder

Overview

security-and-hardening audits cross-cutting trust boundaries (input validation, auth, OWASP) across all code. This skill goes one level deeper into the stack — for each of the three surfaces where AI-generated code most often drifts from secure defaults, what does the "secure default" actually look like?

The three surfaces:

Surface	Common drift
Frontend (DOM-touching code: React / Vue / Svelte / vanilla TS)	`dangerouslySetInnerHTML` with unsanitized input, missing CSP nonce, eval / Function from string, missing cross-origin checks on postMessage, missing Subresource Integrity on third-party scripts
Backend (HTTP-handling code: Node / Go / Python / Java)	String concatenation in SQL, missing authz check (after authn), webhook payloads trusted, SSRF on URL params, redirect to attacker-controlled host
Mobile (iOS / Android / RN / Flutter)	WebView addJavascriptInterface exposed to remote URLs, certificate validation skipped in NSURLSession / OkHttp, EncryptedSharedPreferences with hardcoded key, biometric fallback to insecure PIN, deep-link handler trusting query params

These are not the same as the cross-cutting checks (input / auth / integration). They are layer-specific landmines that the general audit forgets because the surface code doesn't look "insecure" on first read.

This skill is a peer / complement to security-and-hardening and ai-code-blindspots: