KevinZai $ccc-security — Security domain hub
Load ONE skill. Get the entire application security domain. 8 skills in one.
Integration note: This skill invokes Claude Code's built-in /security-review command as the entry point, then routes to specialist sub-skills for deeper analysis. It does not reimplement the security review — it extends it.
Sub-Skills
| # | Skill | Focus |
|---|---|---|
| 1 | security-audit | Comprehensive security audit — SAST, DAST, manual review |
| 2 | prompt-injection-defense | Defend AI-powered apps against prompt injection attacks |
| 3 | dependency-audit | Audit npm/pip/cargo dependencies for known vulnerabilities |
| 4 | secrets-scanner | Scan codebase for hardcoded secrets, API keys, tokens |
| 5 | owasp-top-10 | Check application against OWASP Top 10 vulnerabilities |
| 6 | codeql-integration | Set up CodeQL for automated security analysis in CI |
| 7 | variant-analysis | Find variants of known vulnerabilities across codebase |
| 8 | incident-response | Security incident response playbook and remediation |
No expressed intent? Present the top 3 sub-skills + "More…" as an AskUserQuestion picker (≤4 options).
Routing Matrix
| Your Intent | Route To |
|---|---|
| "Security audit" / "Review for vulnerabilities" | /security-review → security-audit + owasp-top-10 |
| "Prompt injection" / "AI app security" | prompt-injection-defense |
| "Vulnerable dependencies" / "npm audit" | dependency-audit |
| "Hardcoded secrets" / "API key scan" | secrets-scanner |
| "OWASP" / "Top 10 check" | owasp-top-10 |
| "CodeQL" / "Automated security CI" | codeql-integration |
| "Find all variants of this bug" | variant-analysis |
| "Security incident" / "We were breached" | incident-response |
Protocol
- Always start with
/security-reviewbuilt-in — it provides the initial scan surface - Route to specialist skills for deeper analysis per domain
secrets-scanneranddependency-auditon every new projectowasp-top-10before every production releaseincident-responsefor active security events — stop all other work first
Campaign Templates
New Project Security Baseline
/security-review→ built-in initial scansecrets-scanner→ hardcoded credentials checkdependency-audit→ vulnerable package scanowasp-top-10→ application-level vulnerabilitiescodeql-integration→ wire automated scanning into CI
Pre-Release Security Gate
security-audit→ comprehensive SAST + manual reviewowasp-top-10→ full Top 10 checklistdependency-audit→ final dependency sweepvariant-analysis→ check for related vulnerability patterns
AI App Hardening
prompt-injection-defense→ input validation, sandboxing, output filteringsecurity-audit→ standard audit extended for AI surfacesowasp-top-10→ plus AI-specific additions (OWASP LLM Top 10)
When to invoke this skill
Example 1
- user: run a security audit on this codebase
- assistant: Loads ccc-security and invokes /security-review built-in, then routes to owasp-top-10 + secrets-scanner for comprehensive coverage.
Example 2
- user: our app uses AI — protect it from prompt injection
- assistant: Loads ccc-security and routes to prompt-injection-defense for AI-specific attack surface hardening.
Example 3
- user: scan our dependencies for vulnerabilities
- assistant: Loads ccc-security and routes to dependency-audit for npm/pip/cargo vulnerability scanning.
⚙️ Fable contract: plan before build · verifier ≠ worker · prove before alarm · loops need gates · leave durable state —
rules/fable-method.md
(On Codex, present these options as a numbered list and ask the user to reply with a number — AskUserQuestion is Claude-only.)