What is the Security Mindset and why does it matter?

Security is a process, not a product. Always assume input is malicious, external systems can fail, attackers will find vulnerabilities, and defense in depth is essential.

How does this skill relate to OWASP Top 10?

It covers key areas like injection, broken authentication, XSS, CSRF, misconfiguration, and data exposure with practical controls.

What are the first steps for developers?

Audit authentication/authorization, enable TLS and security headers, implement input validation and encryption, and set up secrets management and monitoring.

security

skill

npx machina-cli add skill Fujigo-Software/f5-framework-claude/security --openclaw

Files (1)

SKILL.md

3.3 KB

Security Skills

Overview

Security knowledge essential for building secure applications, protecting user data, and preventing common vulnerabilities.

Security Layers

┌─────────────────────────────────────────────┐
│              Application Security            │
│  ┌─────────────────────────────────────────┐│
│  │         Authentication & AuthZ          ││
│  │  ┌───────────────────────────────────┐  ││
│  │  │        Input Validation           │  ││
│  │  │  ┌─────────────────────────────┐  │  ││
│  │  │  │    Data Protection          │  │  ││
│  │  │  └─────────────────────────────┘  │  ││
│  │  └───────────────────────────────────┘  ││
│  └─────────────────────────────────────────┘│
│              Infrastructure Security         │
└─────────────────────────────────────────────┘

Security Mindset

"Security is not a product, but a process." - Bruce Schneier

Always assume:

All input is malicious
External systems can be compromised
Attackers will find vulnerabilities
Defense in depth is essential

Quick Reference

Threat	Primary Defense	Secondary Defense
SQL Injection	Parameterized queries	Input validation
XSS	Output encoding	CSP headers
CSRF	CSRF tokens	SameSite cookies
Auth bypass	Strong authentication	Session management
Data breach	Encryption	Access control

Related Skills

API Design - Secure API patterns
Testing - Security testing
Architecture - Security architecture

Source

git clone https://github.com/Fujigo-Software/f5-framework-claude/blob/main/plugins/f5-core/skills/security/SKILL.mdView on GitHub

Overview

Security Skills cover essential practices for building secure apps, protecting user data, and preventing common vulnerabilities. It maps core areas like authentication, authorization, data protection, API security, and infrastructure hardening to actionable patterns.

How This Skill Works

It combines layered defense with practical controls. The skill references JWT/OAuth2 for authentication, RBAC/ABAC for authorization, encryption and secrets management for data protection, and HTTPS, security headers, and container/network security for infrastructure.

When to Use It

Designing a new web API or app that requires robust authentication and authorization
Securing sensitive user data with encryption, hashing, and access controls
Hardening deployments with TLS, security headers, and container/network security
Preparing security for compliance audits (GDPR, PCI-DSS) and ongoing security testing
Implementing security improvements after OWASP Top 10 findings or penetration tests

Quick Start

Step 1: Align requirements with OWASP Top 10, GDPR/PCI-DSS as applicable; map auth, data protection, and infra needs
Step 2: Implement core controls: parameterized queries/input validation, TLS, JWT/OAuth2, RBAC/ABAC, encryption, and secrets management
Step 3: Add automated checks and reviews: security tests, code reviews, and monitoring for breaches

Best Practices

Assume input is malicious and validate/sanitize everywhere
Apply defense in depth with layered controls from authentication to infrastructure
Use parameterized queries and strict input validation to prevent injections
Enforce TLS, strong session management, MFA, and secure cookie attributes
Manage secrets securely and perform regular security audits and testing

Example Use Cases

JWT-based authentication with refresh tokens and MFA
RBAC/ABAC coupled with scoped permissions for API endpoints
Input validation, output encoding, and CSP headers to mitigate XSS
Encryption at rest and in transit plus secure password hashing and key management
HTTPS/TLS configuration, security headers, and container/network hardening