Path-scoped. Loaded only when relevant.
Open a service handler → the right rules attach. Zero token cost the rest of the time.
What this pillar does for you.
Secret literals, weak JWT, missing rate-limits, naked req.body - caught before the file is saved.
Every API surface validates input shapes with zod. Errors carry safe, redacted context.
Auth-touching changes trigger the security-review skill. The AI cites OWASP-grade rules in the diff.
4 rules.
Each rule is a markdown file the AI loads when it edits a matching path. Click any to see related skills and where it's referenced.
Pre-commit checklist for every change touching input/auth/storage/network: no hardcoded secrets, parameterized SQL, schema-validated input, authz on every endpoint, restrictive CORS.
Supabase Auth + RLS before custom JWT, no tokens in localStorage, no secrets in VITE_ vars, no dangerouslySetInnerHTML without DOMPurify, refresh-token flow in api-client once.
httpOnly cookies or in-memory auth on web, reviewed secure-storage plugin only when native needs it. Deep links, push payloads, clipboard, file paths treated as untrusted.
expo-secure-store for tokens, no secrets in EAS public env, EXPO_PUBLIC_ for public config only, zod-validate deep links and push payloads, allowlist external URL schemes.
8 skills.
Skills are intent-triggered workflows. The AI router loads them by description; bodies on demand.
Django authn/authz, CSRF, SQL injection prevention, XSS prevention, and secure deployment configurations.
Implement or review JWT auth: token creation, validation, claims, signing algorithms, key rotation, refresh-token rotation, revocation, storage, transmission, tests.
Laravel security: authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
Perl security: taint mode, input validation, safe process execution, DBI parameterized queries, web XSS/SQLi/CSRF, and perlcritic security policies.
Hard gate before deploy/ship/release/store submission: secrets, Supabase RLS, authz, rate limits, uploads, CORS, SQLi/XSS, headers, deps, logging, crypto, mobile bundle.
Auto security review on auth-touching changes: blocks secret literals, weak JWT, missing rate-limits, dangerouslySetInnerHTML, naked req.body, exposed env vars.
Scan Claude Code configuration (.claude/, CLAUDE.md, settings.json, MCP servers, hooks, agent defs) for vulnerabilities, misconfigs, and injection risks via AgentShield.
Spring Security: authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
One plugin, eight pillars.
Every rule and skill is part of a system. Jump across pillars to see how they reinforce each other.
Use the AI you already pay for.
Add superpowers.
One plugin. Senior-engineer rules, security, a backend, and one-command deploys — inside the editor you already use.
Codex
Copilot