mrdulasolutions/devlearn/devlearn-security

Name: devlearn-security
Author: mrdulasolutions

Claude Code and agent skill by mrdulasolutions/devlearn

Trust tier 3

community

Source check pending

Checking that the SKILL.md file is still in the repository.

Teaches application security while fixing real issues: secrets, auth, XSS, injection, dependencies, HTTPS, error leakage. Use when user asks security review, auth hardening, "is this safe", secrets in code, OWASP, or before shipping sensitive features. Pairs with devlearn-pre-ship, devlearn-apis, devlearn-devops. Proactively suggest when diff touches auth, .env, user input, crypto, or payments. Voice triggers: "security review", "is this secure", "OWASP".

Install

npx vskill@latest install mrdulasolutions/devlearn/devlearn-security

SKILL.md

DevLearn: Security

Iron law

Never repeat secrets in lessons. Teach patterns; redact values. Rotate live leaked credentials immediately.

Voice

Follow ../shared/voice.md. Security scares vibers — start from what could go wrong for users, then fix.

Context

Not a pentest or compliance audit. Teach maintainable security habits while building: secrets out of git, validate on server, least privilege, dependency hygiene.

Lifecycle position: after pre-ship triage or when diff signals risk. See ../shared/ship-lifecycle.md.

Prerequisites

Running app or diff to review
devlearn-apis for auth/CORS/session details

Before you start

Parse DEVLEARN.md lifecycle.security_pass
Scan diff + .env* + auth routes + user input surfaces
Redact any secret before quoting in chat or lessons

Phase 1: Triage

Scan for signals — full map in reference.md:

Signal	Risk	Teach
`.env` committed	secret leak	env + gitignore
API key in frontend bundle	stolen key	server-only
`innerHTML` + user text	XSS	textContent, sanitize
SQL string + user input	injection	parameterized queries
No HTTPS in prod	tampering	TLS
`npm audit` high/critical	supply chain	update/pin
Verbose errors in prod	info leak	generic user message
Missing auth on admin routes	broken access control	middleware

Output triage table: found / not found / n/a per category.

Phase 2: Fix + teach

Order: stop active leak → minimal fix → lesson block.

Viber lesson shape

What could go wrong for users → What we changed → Term (XSS, secret, token)

Seasoned decision shape

Decision → Alternatives (rate limit vs captcha) → Risk & verify

Append non-obvious choices to .devlearn/decisions.md when decisions: true.

One issue class per lesson block in vibe mode.

Phase 3: Pre-release security pass

Quick checklist (pairs with pre-ship):

[ ] No secrets in this commit or pasted in chat
[ ] Sensitive routes require auth
[ ] User input validated server-side
[ ] Prod errors don't expose stack traces to users
[ ] Dependencies audited (npm audit or equivalent)
[ ] HTTPS enforced on production URL
[ ] CORS not * with credentials (if applicable)

Document pass/fail in pre-ship checklist or standalone summary.

Phase 4: Auth teaching (on request)

Concept	Plain English
session	server remembers logged-in user via cookie
JWT	signed token client sends; server verifies signature
hash (bcrypt)	password stored irreversibly
CORS	browser cross-origin gate — not a substitute for auth
CSRF	malicious site triggers authenticated action — tokens/same-site help

Hand off HTTP/session implementation to devlearn-apis. Hand off pipeline secret storage to devlearn-devops.

Phase 5: Handoffs

Situation	Suggest
Checklist complete, ready live	`/devlearn-deploy`
Need CI audit gate	`/devlearn-devops`
After deploy	`/devlearn-post-ship`
User wants full release path	`/devlearn-pre-ship`

Persona integration

Persona	Tone
viber	User harm stories; one term; no fear mongering
seasoned	Threat model lite; verify commands; tradeoffs
autodetect	Escalate precision if user uses security vocabulary

Red flags — STOP

Situation	Action
Live leaked credential in prod	Rotate first; then teach
Disable auth on prod "temporarily"	Warn; dev-only pattern
Store password plain text	Block ship until hashed
User asks to commit `.env`	Refuse; teach `.env.example`

Common mistakes

Smell	Fix
Security through obscurity	Real auth + validation
Client-only validation	Duplicate on server
JWT in localStorage without understanding XSS	Teach tradeoff; httpOnly cookie alternative

Required footer

markdown

---
DevLearn status: DONE | BLOCKED
Issues found: N
Critical: N
Suggested next: /devlearn-pre-ship | /devlearn-deploy | /devlearn-devops | rotate secrets
---

Additional resources

OWASP-lite map → reference.md
Lifecycle → ../shared/ship-lifecycle.md
Example scenarios → examples.md

Security

Security scanPassed, 90 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingdevlearn-security/SKILL.md

Popularity

7-day trend score: 0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/mrdulasolutions/devlearn/devlearn-security/badge)](https://verified-skill.com/skills/mrdulasolutions/devlearn/devlearn-security)

Something wrong with this skill or its page? Tell us.