How do I install the Spatie Security skill?

Run npx skillmds add spatie-guidelines-skills/spatie-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Spatie Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Spatie Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Spatie Security free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Spatie Security?

spatie (@spatie-guidelines-skills) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Spatie Security by spatie-guidelines-skills

Name: Spatie Security
Rating: 4.2 (5 reviews)
Author: spatie

Spatie Security

Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.

spatie 7a7f13c 2 files · 4.0 KB Updated Sep 9, 2026

File contents

Spatie Security Guidelines

Overview

Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.

When to Activate

Activate this skill when configuring application security (authentication, authorization, forms).
Activate this skill when setting up or reviewing database configurations.
Activate this skill when configuring servers or reviewing infrastructure.
Activate this skill when reviewing code for security vulnerabilities.
Activate this skill when configuring or creating signed Git commits.

Scope

In scope: Application security, database security, server configuration, credential management, signed Git commits.
Out of scope: Code style, business logic, UI/UX design.

Workflow

Identify the application, database, server, credential, or Git security concern.
Read references/spatie-security-guidelines.md and focus on the relevant sections.
Apply the narrowest relevant security controls without weakening existing protections.

Core Rules (Summary)

Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys.
Sign all Git commits.
Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests.
Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts.
Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic.
Protect devices, backups, sensitive data, and browser activity.

References

references/spatie-security-guidelines.md

---name: spatie-securitydescription: Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.license: MIT--- # Spatie Security Guidelines ## Overview Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure. ## When to Activate - Activate this skill when configuring application security (authentication, authorization, forms). - Activate this skill when setting up or reviewing database configurations. - Activate this skill when configuring servers or reviewing infrastructure. - Activate this skill when reviewing code for security vulnerabilities. - Activate this skill when configuring or creating signed Git commits. ## Scope - In scope: Application security, database security, server configuration, credential management, signed Git commits. - Out of scope: Code style, business logic, UI/UX design. ## Workflow 1. Identify the application, database, server, credential, or Git security concern. 2. Read `references/spatie-security-guidelines.md` and focus on the relevant sections. 3. Apply the narrowest relevant security controls without weakening existing protections. ## Core Rules (Summary) - Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys. - Sign all Git commits. - Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests. - Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts. - Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic. - Protect devices, backups, sensitive data, and browser activity. ## References - `references/spatie-security-guidelines.md`

Frequently asked questions