Implement secure coding practices against common vulnerabilities. Use when handling user input, file paths, subprocess calls, SQL queries, API keys, or building web endpoints. Covers input validation, injection prevention, secret management, and XSS/CSRF protection across Python, TypeScript, Go, and Rust. Do NOT use for general error handling (use error-handling skill) or for remediating dependency vulnerability scanner failures and CVE / GHSA advisories (use cve-remediation skill).
Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat detection architectures.
Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving.
Choose the next security skill for a new repository, a weekly sweep, or a leaked credential. Explains priorities, safeguards before each fix, and how to measure its result.
Use when you want a dedicated security review of staged or recently changed files — deeper than the security section in /review. Covers OWASP Top 10, secrets exposure, dependency vulnerabilities, and auth gaps. Run before opening a PR on security-sensitive changes.
Investigate security findings within an authorized scope, with bounded read-only investigation and explicit coverage and evidence limits. Covers code hunts and product-level review (standard coverage, harm to people, privacy, detection).
The single security skill — diff/PR audit method with a high-confidence bar (BOLA/IDOR, mass assignment, DTO validation, injection, secrets, rate limiting), STRIDE threat modeling before large features, backend auth hardening (guards, Passport, RBAC, CORS/CSRF, OWASP ASVS), and mobile hardening (MASVS: token storage, deep links, WebView, build config). Load the SKILL.md for routing, then read ONLY the references/ file matching the job.
Audits and hardens code against the OWASP Top 10 — input validation, authn/authz, secrets management, cryptography, and dependency scanning with CWE mapping. Trigger with "security review", "is this endpoint secure", "scan our dependencies", or "where do we store this secret".
Defensive security review of a repo, diff, PR, dependency set or config, using tiered subagents. Deterministic scanners run first, cheap models map the attack surface, a stronger model hunts by category, and a different model family tries to disprove each finding before it is reported. Use when the user types /security, or asks for a "security review", "security audit", "is this safe to merge", "check for vulns/secrets", or "threat model this". Defensive only, for code and systems the user owns or is authorized to assess.
Secure web and desktop application development. Use when writing authentication, authorization, API endpoints, form handling, database queries, file uploads, Electron apps, Tauri apps, IPC handlers, cryptography, secrets management, security headers, input validation, or when reviewing code for vulnerabilities. Covers OWASP Top 10, XSS, CSRF, SQL injection, SSRF, command injection, path traversal, and desktop app security. Also usable as a support sub-skill: other skills can invoke it by name mid-build to check code or a design for vulnerabilities before finalizing.
Multi-session defensive security coach: prompt injection, data leaks, agent safety, and incident response, taught with inert examples. Use only when asked to start or continue this course.
Security audit of Odoo addon code: access control (ir.access, field groups, sudo), injection (SQL, domain, eval, XSS via Markup/markup()), untrusted public methods/RPC, controller auth/CSRF, file access, deserialization, returning complex objects, getattr/setattr, timing attacks. Use when auditing an addon, or judging whether a specific construct (a sudo, raw SQL, a route, ...) is safe.
56k54d agoReviewMountCreate a free account to mount
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
Geoffe-GaSkill
