How do I install the Security Cleanup skill?

Run npx skillmds@latest add thejefflarson/security-cleanup in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Cleanup safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Cleanup?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Cleanup free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Cleanup?

thejefflarson (@thejefflarson) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Cleanup by thejefflarson — Agent Skill

Name: Security Cleanup
Author: thejefflarson

Security Cleanup

Applies fixes for security findings produced by /security-review. Use when the user wants to fix security issues found by /security-review or when they ask to clean up, remediate, or apply fixes for security findings.

File contents

Security Cleanup (A01:2025–A10:2025 + LLM01:2025–LLM10:2025)

What this checks

Applies fixes for security findings. Pair with /security-review to detect issues, then /security-cleanup to fix them.

Vulnerable patterns

This skill remediates, not detects. Run /security-review first.

Procedure

Get the findings: from the user's message, a recent /security-review output, or — if none are available — run /security-review first to produce them.
For each finding (highest severity first):
- Read the cited file at the cited line
- Read .claude/skills/<skill>/SKILL.md for the correct fix pattern
- Apply the fix using the Edit tool
- Use the language's idiomatic safe API (Go html/template, Python Environment(autoescape=True), Java PreparedStatement, etc.)
After all findings are processed, summarize what was fixed.

Rules:

Never change observable behavior beyond removing the vulnerability
If unsure about the correct fix, say so and skip that finding
One Edit per finding — don't refactor surrounding code

Verification

Each fix addresses the specific finding cited
No fix introduces new vulnerabilities or changes business logic
Summary lists all findings and their disposition

References

Frequently asked questions