Segurança de aplicações production-grade: OWASP Top 10, autenticação/autorização, gestão de segredos, threat modeling (STRIDE), validação de input e secure defaults. Use quando o usuário mencionar: "segurança", "vulnerabilidade", "OWASP", "autenticação", "autorização", "SQL injection", "XSS", "CSRF", "segredos", "threat model", "é seguro?", "hardening", "pentest". Não auxilia ataques maliciosos — foco em defesa e testes autorizados.
Audit de sécurité rapide pour projet PHP/Symfony. Analyse les fichiers modifiés ou un périmètre donné. Détecte injections SQL, XSS, CSRF, exposition de données, permissions manquantes. Basé sur OWASP Top 10. Utiliser avant un commit ou pour auditer un périmètre.
Security audits and threat modeling — find and reason about vulnerabilities in auth, input handling, data access, secrets, and dependencies. Use when reviewing code for security, threat-modeling a feature, hardening an endpoint, handling auth/authz, or checking for injection, secret leakage, or unsafe data exposure. For a focused review of the current diff, prefer the `/security-review` command.
Application security standards and hardening practices. Use when: reviewing code for vulnerabilities, implementing authentication, configuring CORS, adding input validation, managing secrets, scanning dependencies, setting CSP headers, reviewing IAM policies, auditing an existing application for OWASP top 10 vulnerabilities, or hardening an existing deployment. Covers OWASP top 10, secrets management, dependency auditing, and security headers.
Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.
STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.
Mandatory credential protection skill for all agents. Prevents reading, exposing, or leaking credentials, secrets, API keys, tokens, passwords, and auth-capable config files.
Security Auditor
Evaluate security implications of tools, configurations, plugins, and the intelligence hub itself.
## Input
`/security [target]`
Targets:
- No argument: full hub audit
- A tool name: evaluate that specific tool
Use when handling user input, authentication, authorisation, secrets, file uploads, or database queries. Also when adding a dependency, exposing an endpoint, or reviewing whether something is safe to ship.
Adversarial security gate. Reviews the change for vulnerabilities and tries to exploit them against a local environment. A confirmed exploit blocks the merge. Runs after merge-risk, before qa. Usage - /sous:security <change-id>
Implement secure coding practices against common vulnerabilities. Use when handling user input, file paths, subprocess calls, SQL queries, API keys, or building web endpoints. Covers input validation, injection prevention, secret management, and XSS/CSRF protection across Python, TypeScript, Go, and Rust. Do NOT use for general error handling (use error-handling skill) or for remediating dependency vulnerability scanner failures and CVE / GHSA advisories (use cve-remediation skill).
Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat detection architectures.
Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving.
Choose the next security skill for a new repository, a weekly sweep, or a leaked credential. Explains priorities, safeguards before each fix, and how to measure its result.
Use when auditing code, dependencies, or infrastructure for security issues (SAST, dependency scanning, secret leak detection, OWASP-style checks), or when checking that a project or change follows secure defaults before committing or deploying.
Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
BappozSkill
