How do I install the Security skill?

Run npx skillmds@latest add persimmon-automation-labs/security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Security skill do?

Security — Index It is listed under Security on SkillMD.

Is Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security?

Persimmon-Automation-Labs (@persimmon-automation-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security by persimmon-automation-labs

Name: Security
Rating: 4.2 (5 reviews)
Author: Persimmon-Automation-Labs

File contents

Security — Index

Persimmon security = NextAuth v5 (credentials/OAuth) with a Prisma adapter and JWT sessions, plus a dedicated security review pass before delivery. This mother is a map; follow the child for the actual work.

Trigger

"Add auth / login" / "NextAuth" / "sessions" / "protect this route"
"Security review" / "audit before delivery" / "check headers / CSP"

The child skills

Skill	When to use	Owns
`security-nextauth`	Implementing or fixing auth	NextAuth v5 credentials + Prisma adapter, JWT sessions, `trustHost: true`, middleware reading `x-forwarded-host`, route protection
`security-review`	Pre-delivery audit (also part of `quality`)	Headers, auth gaps, injection, secret exposure, CSP, dependency CVEs

How to route

Auth work? → security-nextauth.
Auditing? → security-review (invoked standalone or via quality-final-review).

Persimmon security defaults — one-screen summary

NextAuth v5 behind Railway: trustHost: true is mandatory; middleware redirects must read x-forwarded-host or users bounce to *.up.railway.app.
Secrets server-side only — never NEXT_PUBLIC_*, never in client bundles.
Headers in next.config.ts: HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin.
Validate every boundary input with Zod (see stack-zod-boundary).
Never log secrets, PII, or document contents — redact in error reports.

Anti-patterns banned

NextAuth without trustHost behind a proxy
Redirects using the internal host instead of x-forwarded-host
Secrets in NEXT_PUBLIC_*
Logging PII / document contents
Missing security headers in next.config.ts

Relationship to other mothers

Mother	Connection
`stack`	Boundary validation via `stack-zod-boundary`
`quality`	`security-review` is one dimension of `quality-final-review`
`infra`	Header config ships in the deployed app (`infra-railway-deploy`)

---name: securitydescription: Security — Index---# Security — IndexPersimmon security = NextAuth v5 (credentials/OAuth) with a Prisma adapter and JWT sessions, plus a dedicated security review pass before delivery. This mother is a map; follow the child for the actual work.## Trigger- "Add auth / login" / "NextAuth" / "sessions" / "protect this route"- "Security review" / "audit before delivery" / "check headers / CSP"## The child skills| Skill | When to use | Owns ||---|---|---|| `security-nextauth` | Implementing or fixing auth | NextAuth v5 credentials + Prisma adapter, JWT sessions, `trustHost: true`, middleware reading `x-forwarded-host`, route protection || `security-review` | Pre-delivery audit (also part of `quality`) | Headers, auth gaps, injection, secret exposure, CSP, dependency CVEs |## How to route1. **Auth work?** → `security-nextauth`.2. **Auditing?** → `security-review` (invoked standalone or via `quality-final-review`).## Persimmon security defaults — one-screen summary- **NextAuth v5 behind Railway**: `trustHost: true` is mandatory; middleware redirects must read `x-forwarded-host` or users bounce to `*.up.railway.app`.- **Secrets server-side only** — never `NEXT_PUBLIC_*`, never in client bundles.- **Headers** in `next.config.ts`: HSTS, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`.- **Validate every boundary input** with Zod (see `stack-zod-boundary`).- **Never log** secrets, PII, or document contents — redact in error reports.## Anti-patterns banned- NextAuth without `trustHost` behind a proxy- Redirects using the internal host instead of `x-forwarded-host`- Secrets in `NEXT_PUBLIC_*`- Logging PII / document contents- Missing security headers in `next.config.ts`## Relationship to other mothers| Mother | Connection ||---|---|| `stack` | Boundary validation via `stack-zod-boundary` || `quality` | `security-review` is one dimension of `quality-final-review` || `infra` | Header config ships in the deployed app (`infra-railway-deploy`) |

Frequently asked questions

Security