netsuite-owasp-secure-coding

What this skill does

# OWASP Secure Coding Practices

## 1. Description

This skill provides **implementation-depth OWASP secure coding coverage** for JavaScript
and SuiteScript 2.1 development. It is the primary security reference for writing,
reviewing, and auditing code.

**What This Skill Covers:**

- Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
- 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
- Platform-agnostic JavaScript security patterns applicable beyond NetSuite
- SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
- Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
- CSP header construction and deployment
- File upload/download validation pipelines
- API and RESTlet hardening patterns
- AI agent security considerations for tool-assisted development
- DRY security architecture: shared validation modules, centralized encoding, single-source configs
- A mandatory security review checklist for every code review

**Relationship to Existing Security Content:**

If available, the `netsuite-sdf-leading-practices` skill contains two security-related principles from
the SAFE Guide:

- **Principle 5 (`05-security-privacy.md`)** -- Owns NetSuite-specific security topics:
  roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness,
  credential storage via script parameters, and SuiteCloud platform security features.
- **Principle 11 (`11-security-best-practices.md`)** -- Owns OWASP awareness-level
  guidance: the core security principles list, a high-level OWASP Top 10 overview,
  basic input sanitization patterns, and parameterized query awareness.

**This skill** (`netsuite-owasp-secure-coding`) provides everything below the awareness
level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific
encoding, CSP templates, file security, API hardening, client-side defenses, logging safety,
and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather
than duplicating their NetSuite-specific content.

---

## 2. How to Use

### Invocation

Use this skill whenever you need a security review, threat analysis, or implementation
guidance for SuiteScript or JavaScript security concerns.

If your client supports explicit skill activation by name, activate
`netsuite-owasp-secure-coding` and request the topic you need.

### Auto-Activation Triggers

This skill auto-activates when the agent detects security-relevant context in the
conversation. See Section 3 for the complete trigger list.

### Reference Files

All deep-dive content is in the local `references/` directory. The skill loads the
appropriate reference files based on the detected security topic. You can also request a
specific reference directly:

```
Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.
```

---

## 3. When to Use

### Keyword Triggers

The skill activates when any of the following keywords or phrases appear in the
conversation or code context:

**Injection and Input:**
`injection`, `sanitize`, `sanitise`, `validate input`, `SQL concatenation`,
`string concatenation query`, `parameterized`, `prepared statement`, `user input`

**XSS and Output:**
`XSS`, `cross-site scripting`, `encode`, `output encoding`, `innerHTML`,
`textContent`, `dangerouslySetInnerHTML`, `template literal injection`

**Authentication and Session:**
`auth`, `authentication`, `session`, `CSRF`, `token`, `TBA`, `OAuth`,
`credential`, `password`, `login`, `logout`, `session fixation`

**Headers and Browser:**
`CSP`, `Content-Security-Policy`, `CORS`, `X-Frame-Options`, `HSTS`,
`security header`, `postMessage`, `clickjacking`

**Cryptography:**
`crypto`, `hash`, `encrypt`, `decrypt`, `MD5`, `SHA-1`, `SHA-256`,
`Math.random`, `nonce`, `HMAC`, `AES`, `secret key`

**File Operations:**
`file upload`, `file download`, `path traversal`, `MIME type`, `magic bytes`,
`zip bomb`, `filename sanitization`

**API and Network:**
`RESTlet`, `Suitelet`, `API security`, `rate limit`, `SSRF`, `webhook`,
`schema validation`, `request validation`

**General Security:**
`security`, `vulnerability`, `OWASP`, `pentest`, `hardening`, `exploit`,
`attack surface`, `threat model`, `security review`, `security audit`

**AI and Agent:**
`prompt injection`, `AI security`, `agent security`, `tool poisoning`,
`AI output validation`, `data exfiltration`

### Code Context Triggers

The skill also activates when the agent detects these code patterns:

- Writing or reviewing RESTlet scripts (`@NScriptType Restlet`)
- Writing or reviewing Suitelets that generate HTML (`response.write`, `INLINEHTML`)
- Client scripts with DOM manipulation (`innerHTML`, `document.write`, `eval`)
- SuiteQL queries being constructed (`query.runSuiteQL`, `query.runSuiteQLPaged`, `N/query`)
- File operations (`N/file`, `file.create`, `file.load`)
- External HTTP calls (`N/https`, `https.post`, `https.get`)
- Cryptographic operations (`N/crypto`, `createHash`, `createCipher`)
- Any code review or security audit request

---

## 4. Companion Reference Map

This skill is self-contained. To avoid content duplication, this map distinguishes what
this skill owns from optional companion references that may exist in a broader NetSuite
guidance set.

| Source | Owns | Relationship to This Skill |
|--------|------|----------------------------|
| `netsuite-owasp-secure-coding` (This skill) | Full OWASP Top 10 implementation depth, all 48 OSCP pitfalls, five-context output encoding, CSP header construction, file upload/download validation pipeline, API/RESTlet hardening, client-side defenses (postMessage, DOM XSS, CSRF), logging safety, AI agent security, DRY security module patterns | Primary and authoritative source for implementation guidance in this package |
| `05-security-privacy.md` (`netsuite-sdf-leading-practices`, optional companion reference) | NS roles and permissions, TBA authentication patterns, N/crypto module overview, PCI-DSS awareness, credential storage via Script Parameters, SuiteCloud platform security features | Supplemental background only; not required for this skill |
| `11-security-best-practices.md` (`netsuite-sdf-leading-practices`, optional companion reference) | OWASP awareness list, core security principles, basic sanitize pattern, basic parameterized query mention, defense-in-depth overview | Supplemental background only; not required for this skill |

**Cross-Reference Rules:**

1. Use this skill as the authoritative source for code-level implementation guidance.
2. If optional companion references are available, use them only for adjacent background
   such as role setup, token rotation, or high-level principles.
3. Do not assume companion references are installed; answer from this skill's local
   content first.

---

## 5. OWASP Top 10 (2021) Quick Map

Each OWASP Top 10 category is mapped to the reference files in this skill that
provide detailed coverage.

| Category | ID | Reference Files | Key Topics |
|----------|----|--------------------|------------|
| Broken Access Control | A01:2021 | `04-access-control.md` | RBAC, IDOR, privilege escalation, runasrole, deployment audience |
| Cryptographic Failures | A02:2021 | `06-cryptography-data-protection.md` | SHA-256+, AES-256, key management, PII masking, CSPRNG |
| Injection | A03:2021 | `01-injection-prevention.md`, `03-xss-output-encoding.md` | SuiteQL params, LDAP escape, CRLF, XSS, DOM sinks |
| Insecure Design | A04:2021 | (Covered across multiple) | Threat modeling, defense in depth, least privilege |
| Security Misconfiguration | A05:2021 | `05-security-misconfiguration.md` | Error messages, debug mode, headers, default creds, SDF manifest |
| Vulnerable Components | A06:2021 | `05-security-misconfiguration.md` | Dependency audit, feature minimization, unused endpoints |
| Authentication Failures | A07:2021 | `02-