How do I install the Security skill?

Run npx skillmds@latest add diegosouzapw/security-3 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security?

diegosouzapw (@diegosouzapw) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security by diegosouzapw — Agent Skill

Name: Security
Rating: 4.2 (5 reviews)
Author: diegosouzapw

File contents

Security Audit

Identify vulnerabilities and implement secure coding practices.

When to Use

Security review of code or architecture
Implementing authentication/authorization
Before deploying to production
User asks about security best practices
Handling sensitive data

OWASP Top 10 Checklist

Injection - Parameterized queries, input sanitization
Broken Auth - Strong sessions, MFA, secure password storage
Sensitive Data - Encryption at rest and transit, minimal exposure
XXE - Disable external entities, use JSON over XML
Broken Access Control - RBAC, deny by default
Misconfiguration - Secure defaults, remove debug info
XSS - Output encoding, CSP headers
Insecure Deserialization - Validate input, avoid native serialization
Vulnerable Components - Dependency scanning, updates
Logging - Audit logs, no sensitive data in logs

Security Headers

Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

Auth Implementation

// Password hashing
const hash = await bcrypt.hash(password, 12);

// JWT with short expiry
const token = jwt.sign({ userId }, secret, { expiresIn: "15m" });

// Refresh token rotation
const refreshToken = crypto.randomBytes(32).toString("hex");

Audit Output Format

## Security Audit Report

**Severity Levels:** Critical | High | Medium | Low

### Critical

- [Issue]: [Description] → [Fix]

### High

- [Issue]: [Description] → [Fix]

### Recommendations

- [Improvement suggestion]

Examples

Input: "Review auth implementation" Action: Check password storage, session management, token handling, report findings

Input: "Make this API secure" Action: Add input validation, auth checks, rate limiting, security headers

---name: security-3description: Security audits, vulnerability detection, and secure coding. Use for security reviews, auth implementation, or OWASP compliance.--- # Security Audit Identify vulnerabilities and implement secure coding practices. ## When to Use - Security review of code or architecture - Implementing authentication/authorization - Before deploying to production - User asks about security best practices - Handling sensitive data ## OWASP Top 10 Checklist 1. **Injection** - Parameterized queries, input sanitization 2. **Broken Auth** - Strong sessions, MFA, secure password storage 3. **Sensitive Data** - Encryption at rest and transit, minimal exposure 4. **XXE** - Disable external entities, use JSON over XML 5. **Broken Access Control** - RBAC, deny by default 6. **Misconfiguration** - Secure defaults, remove debug info 7. **XSS** - Output encoding, CSP headers 8. **Insecure Deserialization** - Validate input, avoid native serialization 9. **Vulnerable Components** - Dependency scanning, updates 10. **Logging** - Audit logs, no sensitive data in logs ## Security Headers ``` Content-Security-Policy: default-src 'self' X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains ``` ## Auth Implementation ```javascript // Password hashing const hash = await bcrypt.hash(password, 12); // JWT with short expiry const token = jwt.sign({ userId }, secret, { expiresIn: "15m" }); // Refresh token rotation const refreshToken = crypto.randomBytes(32).toString("hex"); ``` ## Audit Output Format ```markdown ## Security Audit Report **Severity Levels:** Critical | High | Medium | Low ### Critical - [Issue]: [Description] → [Fix] ### High - [Issue]: [Description] → [Fix] ### Recommendations - [Improvement suggestion] ``` ## Examples **Input:** "Review auth implementation" **Action:** Check password storage, session management, token handling, report findings **Input:** "Make this API secure" **Action:** Add input validation, auth checks, rate limiting, security headers

Frequently asked questions

Security