# netsuite-owasp-secure-coding

Equips AI agents with OWASP Top 10 (2021) secure coding rules for JavaScript and SuiteScript 2.1. Useful for auditing RESTlets and stopping injections.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 771 installs · ★ 362
- Author: Oracle NetSuite
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/oracle/netsuite-suitecloud-sdk/tree/HEAD/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/netsuite-owasp-secure-coding

## What it does

This skill organizes 48 specific security pitfalls labeled `OSCP-001` through `OSCP-048`. Each entry contrasts insecure implementations against hardened fixes. Guidance covers context-aware output encoding across five HTML environments, along with CSP header templates.

It works beyond NetSuite. The assistant triggers these rules automatically when encountering topics like XSS or CSRF. It also watches for NetSuite API calls such as `query.runSuiteQL` or `N/https`.

Because this guidance focuses strictly on code implementation, platform-level role configuration and TBA authentication setup remain outside its core scope.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/netsuite-owasp-secure-coding/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/netsuite-owasp-secure-coding/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/netsuite-owasp-secure-coding/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/netsuite-owasp-secure-coding/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install oracle/netsuite-suitecloud-sdk netsuite-owasp-secure-coding
```

2. **Manually: put the files in place**
- File: `.github/skills/netsuite-owasp-secure-coding/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/oracle/netsuite-suitecloud-sdk --path packages/agent-skills/netsuite-owasp-secure-coding
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/netsuite-owasp-secure-coding/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/oracle/netsuite-suitecloud-sdk/tree/HEAD/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md

## When to use it
- audit RESTlets and Suitelets for code injection flaws
- build CSP headers and validate uploaded file types
- encode untrusted strings across five HTML contexts
- protect AI agent workflows from prompt injection risks

## Example prompts
- Review this RESTlet script for security vulnerabilities.
- Generate CSP header templates for my Suitelet.
- Show the recommended pattern to prevent SuiteQL injection.

## Similar
- [owasp-security](https://affpapa.org/en/nevibecode/skills/owasp-security.md) — skill · 3000 installs
- [secure-code-review](https://affpapa.org/en/nevibecode/skills/zebbern-secure-code-review.md) — skill · ★ 4676
- [Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened)](https://affpapa.org/en/nevibecode/prompts/python-security-vulnerability-auditor-owasp-mapped-production-hardened.md) — prompt · ★ 174597
- [owasp-top-10-testing](https://affpapa.org/en/nevibecode/skills/owasp-top-10-testing.md) — skill · 12800 installs
- [owasp-llm-top10](https://affpapa.org/en/nevibecode/skills/owasp-llm-top10.md) — skill · 390 installs

From the same set: [oracle/netsuite-suitecloud-sdk](https://affpapa.org/en/nevibecode/by/oracle/netsuite-suitecloud-sdk.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md