Netsuite Suitescript Secure Code Review Skill

Flashlight skill for static security review of SuiteScript 2.x code against OWASP Top 10 (2021) pitfall patterns (OSCP-001 through OSCP-048), extended with Vanguard severity taxonomy mapping and CI pipeline gate recommendations. Adapted from Oracle netsuite-owasp-secure-coding (UPL-1.0). T0 static review — no live account connection required. TRIGGER when: user submits SuiteScript 2.x code for security review, asks about SuiteQL injection prevention, output encoding in Suitelets or RESTlets, CSRF in SuiteScript, file upload security, RESTlet hardening, DOM XSS in client scripts, postMessage origin validation, or AI prompt-injection in SuiteScript. Trigger phrases: SuiteScript security review, OWASP SuiteScript, SuiteQL injection, XSS in Suitelet, RESTlet hardening, CSRF token SuiteScript, file upload SuiteScript, OSCP vulnerability, secure coding SuiteScript. DO NOT TRIGGER when: request is for SuiteScript 1.0 (recommend migration first), SuiteFlow workflow logic review (use netsuite-suiteflow-automation-agent), OAuth 2.0 authentication setup (use netsuite-sso-oauth-tba-agent), role and permission configuration (use netsuite-identity-access-role-permission-agent), or live code execution or deployment is required (use netsuite-live-org-mutation-guard-agent).

mkdir -p ~/.claude/skills/netsuite-suitescript-secure-code-review-skill
curl -L https://claudskills.com/skills/netsuite-suitescript-secure-code-review-skill/SKILL.md \
  -o ~/.claude/skills/netsuite-suitescript-secure-code-review-skill/SKILL.md

@misc{netsuite-suitescript-secure-code-review-skill-2026,
  author    = {Raishin},
  title     = {Netsuite Suitescript Secure Code Review Skill [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/netsuite-suitescript-secure-code-review-skill/}
}