netxeo/skill-file-security

---

Install it. Right now.

Interactive mode (Smart 5-question setup):

npx @netxeo/security-skill

The interactive mode automatically detects your stack (Next.js, Supabase, Docker, etc.) and asks you 5 simple questions to install only the security rules you actually need.

Fast mode (Silent install, bypasses prompts and installs all rules):

npx @netxeo/security-skill --yes       # Installs everywhere (silent)
npx @netxeo/security-skill --all       # Same as --yes
npx @netxeo/security-skill --claude    # Claude only
npx @netxeo/security-skill --cursor    # Cursor only
npx @netxeo/security-skill --windsurf
npx @netxeo/security-skill --cline
npx @netxeo/security-skill --copilot

That’s it. Run this in any project. Then type /security-scan in your AI.

---

What just happened?

📦 Installing security-skill...

  ✅ Skill files installed → .skills/security/
  ✅ memory-security.md created
  ✅ .gitignore updated (6 security entries added)

  Configuring AI assistants...
  ✅ CLAUDE.md created              ← Claude / Antigravity
  ✅ .claude/commands/ created      ← Claude Code slash commands registered
  ✅ AGENTS.md created              ← OpenAI Codex CLI
  ✅ GEMINI.md created              ← Gemini Code Assist
  ✅ .cursorrules created           ← Cursor
  ✅ .cursor/rules/security.mdc     ← Cursor (new format)
  ✅ .windsurfrules created         ← Windsurf
  ✅ .clinerules created            ← Cline
  ✅ .github/copilot-instructions.md ← GitHub Copilot+
  ✅ .continue/config.yaml created  ← Continue.dev

  ⚡ Run /security-scan in your AI to get started!

Your AI now knows 25 security categories. It will flag vulnerabilities while you code, not after.

---

See it in action

You: /security-audit

╔══════════════════════════════════════════════════╗
║      🔐  SECURITY AUDIT — myproject              ║
║         Stack: Next.js · Supabase · Vercel        ║
╠══════════════════════════════════════════════════╣
║                                                   ║
║  SECURITY SCORE  :  61 / 100  🟠                  ║
║                                                   ║
╠══════════════════════════════════════════════════╣
║  🔴  Secrets & Files          12/20  ← FIX NOW   ║
║  🟢  Auth & Sessions          16/20              ║
║  🔴  Database (Supabase RLS)   8/20  ← FIX NOW   ║
║  🟡  HTTP Headers             12/20              ║
║  🟢  Source Code              18/20              ║
║  ...  20 more categories...                       ║
╠══════════════════════════════════════════════════╣
║  🔴 2 critical  🟠 3 high  🟡 4 medium           ║
╚══════════════════════════════════════════════════╝

🔴 CRITICAL #1 — Supabase service role key in frontend code
   Found: NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY in .env.local
   Risk:  Full database access exposed to browser
   Fix:   /security-fix supabase-key

🔴 CRITICAL #2 — RLS disabled on 3 tables
   Found: users, orders, messages (no row-level security)
   Risk:  Any authenticated user can read all data
   Fix:   /security-fix rls

📄 Full report → security-report.md

---

Commands

---

Coverage

100% of OWASP, 100% of CWE Top 25 — without installing a single extra tool.

---

Compatible with your AI

Works out-of-the-box with every major AI coding assistant. No manual setup.

---

How it works

1.  npx @netxeo/security-skill
    └─ installs 29 security instruction files to .skills/security/
    └─ creates memory-security.md (tracks your score over time)
    └─ creates AI config files for every assistant on your machine
    └─ hardens .gitignore

2.  /security-scan
    └─ AI reads skill.md
    └─ auto-detects your stack (Next.js? Express? Docker? Firebase?)
    └─ runs the right checks for YOUR specific setup
    └─ gives you a prioritized list, most critical first

3.  /security-fix
    └─ shows you the diff
    └─ always asks before modifying anything
    └─ zero breaking changes guaranteed

---

What developers say after their first scan

“Found a Supabase RLS misconfiguration that would have exposed all user data.”

“Caught a hardcoded OpenAI key that was about to go to production.”

“Finally understand what CSP headers actually do.”

---

Philosophy

🎯 Signal vs Noise — Highly selective. Prioritizes practical fixes and avoids overwhelming you with overly strict or theoretical noise.

🧠 Semantic Analysis — Catches business logic flaws and context-dependent vulnerabilities that static analysis tools (like SonarQube) completely miss.

🛡️ AI Blind Spot Override — Forces LLMs to check rate-limiting and complex session fixation (ASVS L3), which they naturally ignore.

🔧 Non-destructive — Never auto-applies changes. You approve every fix.

📚 Educational — Explains why something is risky in simple terms instead of blindly giving patches, helping you actually learn.

⚡ Zero setup — No config, no API keys, no cloud service. Pure AI instructions.

🔄 Living memory — memory-security.md tracks your score across sessions.

🌍 Stack-agnostic — Works on Next.js, Express, Django, Laravel, Rails, Spring Boot, and more.

---

Security Score

After your first audit, your score lives in memory-security.md:

| Date       | Score  | Critical | High | Notes              |
|------------|--------|----------|------|--------------------|
| 2025-05-01 | 61/100 | 2        | 3    | First audit        |
| 2025-05-03 | 84/100 | 0        | 1    | Fixed RLS + secret |
| 2025-05-10 | 97/100 | 0        | 0    | 🟢 Excellent        |

---

Updating & Custom Rules

To update to the latest security checks, simply re-run the installation:

npx @netxeo/security-skill@latest

⚠️ Important:

• This command will cleanly overwrite the .skills/security/ folder to provide the newest AI instructions.
• Do not modify files inside .skills/security/ manually.
• Your score history is safe. The installer will never overwrite your memory-security.md file.
• Custom Rules: If you need to add your own company-specific security rules, add them to the ## Custom Rules section inside your memory-security.md file. The AI will always read them from there.

---

Contributing

Found a missing vulnerability pattern? Open a PR.

The skill is 29 Markdown files. No build step. No TypeScript. Just knowledge.

instructions/
├── 01-secrets-management.md
├── 07-database-security.md
├── 22-ai-llm-security.md
└── ... 26 more

---

License

MIT — free forever.

---