25 skills · category

Security skills for Claude Code

Skills for defensive engineering and explicitly authorized testing: OWASP Top 10 and API Top 10 reviews, threat modeling, secrets management, sessions, OAuth and OIDC, JWTs, security headers, input validation, file uploads, container hardening, supply-chain audits, and practical cryptography.

Download all 25 (.zip) Browse the list

Every security skill

Each card opens the full playbook, example prompts and install commands.

No. 268

API Security

Prove every endpoint denies the wrong user

Claude works through the OWASP API Security Top 10 with the checks that catch real breaches: queries scoped to the caller, strict input and output schemas against mass assignment and data leaks, default-deny function checks, page and body caps, and GraphQL cost limits. A bundled matrix script calls every endpoint as several users on staging and fails on any cross-account access.

api-security 176 lines · 2 files

No. 269

Auth and Sessions

Makes Claude build login the way a security engineer would: argon2id with transparent rehashing, NIST rev. 4 password rules with breach checks, uniform responses that prevent enumeration, session IDs rotated at login, __Host- cookies, server-enforced MFA, and reset tokens that are hashed, short-lived and single-use. Includes an audit checklist for existing auth code.

auth-sessions 176 lines

No. 270

Authorization Models

One decision point, default deny, tested matrix

Claude replaces scattered role checks with a single check() and filter() interface backed by the right model: plain RBAC in code for small apps, Cerbos or OPA when rules depend on attributes, OpenFGA when sharing and hierarchies appear. It writes the requirements matrix first, enforces default deny, and proves every allow and deny cell with table-driven tests.

authorization-models 282 lines

No. 271

Bot and Fraud Defense

Stop credential stuffing without taxing real users

Claude names the attack and what it costs, baselines login, signup, SMS and checkout metrics, then layers controls: velocity limits keyed on account, IP, ASN and device, Pwned Passwords checks, server-verified Turnstile challenges and step-up MFA for risky traffic only. Rules launch in shadow mode with friction metrics, so you block bots without silently losing real customers.

bot-fraud-defense 185 lines

No. 272

Cloud Security Posture

Find the public bucket before someone else does

Claude audits cloud accounts with read-only roles across every region: it confirms logging baselines, runs Prowler against a CIS framework, adds targeted CLI checks for public data, open admin ports and risky identities, then collapses findings into root causes. Fixes go into Terraform or CDK after usage evidence and confirmation, each paired with an SCP or org policy guardrail.

cloud-security-posture 231 lines

No. 273

Container Security

Minimal images, non-root pods, scanned on every build

Claude fixes container risk at the source: it swaps bloated base images for pinned distroless or slim ones, moves build secrets to BuildKit mounts, runs as a numeric non-root user, and applies a restricted securityContext with dropped capabilities and a read-only root filesystem. Trivy and hadolint gate CI, images get signed, and every change is measured against a CVE baseline.

container-security 209 lines

No. 274

Cryptography Basics

Right primitive, vetted library, no novel designs

Prevents the classic crypto mistakes before they ship. Claude maps each job to one vetted primitive and library, encrypts with AES-GCM or XChaCha20-Poly1305 using fresh nonces and associated data, versions ciphertext for rotation, wraps data keys with a KMS, and compares MACs in constant time. Reviews flag ECB, static IVs, MD5, hardcoded keys and disabled TLS checks.

cryptography-basics 179 lines

No. 275

GDPR Privacy Engineering

Data maps, consent, and deletion you can actually prove

Claude builds the machinery privacy rules depend on: a data map generated from your schema and integrations, purpose and retention tags next to the fields, append-only consent records that honor Global Privacy Control, and a DSAR handler registry that exports and erases across the database, processors, analytics, and backups. Legal judgments stay with counsel; this is engineering, not legal advice.

gdpr-privacy 262 lines · 2 files

No. 276

Input Validation

Safe sinks first, schemas second, payload tests always

Claude stops relying on character stripping and fixes injection where it happens: bound parameters for SQL and allowlists for identifiers, context-specific encoding and sanitizers for HTML, resolved-IP checks for user-supplied URLs, resolved-path checks for file access, and argument arrays for commands. Boundary schemas in Zod or Pydantic add a second layer, and every fix ships with a payload test.

input-validation 202 lines

No. 277

JWT Handling

Verify, never just decode

Claude verifies every JWT with an explicit algorithm allowlist and required claims using jose, PyJWT or golang-jwt, issues short-lived tokens with kid headers, and rotates keys through JWKS without downtime. It audits code for decode-without-verify and algorithm confusion, and ships a standard-library inspector that flags risky tokens without ever claiming to verify them.

jwt-handling 173 lines · 2 files

No. 278

MFA Implementation

Second factors with no back door left open

Claude builds MFA as a server-enforced state machine rather than a login screen: a pending-MFA state that reaches nothing else, TOTP with encrypted secrets and replay guards, 64-bit recovery codes, attempt limits, step-up for sensitive actions, and remembered devices that never skip step-up. It also closes the usual bypasses through password reset, token endpoints, support tools and recovery.

mfa-implementation 279 lines

No. 279

Mobile App Security

Ship an app binary with nothing worth stealing

Claude reviews iOS, Android, React Native and Flutter apps the way a MASVS assessor does: it scans your own release build for leaked keys, moves tokens into hardware-backed storage, adds SPKI pinning with backup pins and expiry, binds biometrics to keys, and locks down deep links and WebViews. Every finding is mapped to a MASVS control with file evidence.

mobile-app-security 209 lines

No. 280

OAuth 2.1 and OIDC

PKCE, state and nonce, checked every single time

Keeps Claude on the authorization code + PKCE path for every client type, with state, nonce and issuer checks tied to the browser session. It validates ID tokens by signature, iss, aud and nonce, identifies users by issuer plus subject rather than email, keeps tokens out of the browser with a BFF, and audits existing setups against the misconfigurations behind real account takeovers.

oauth-oidc 168 lines

★ No. 281

OWASP Top 10 Review

Findings with file:line evidence, not vague advice

Turns a vague 'is this secure?' into a structured source review. Claude maps every entry point, sweeps each OWASP Top 10:2025 category with targeted searches, confirms each lead by tracing attacker input to the sink, and only then reports. Findings come with severity, a concrete attack path, the fix, and an honest list of what was not reviewed.

owasp-review 174 lines · 2 files

★ No. 282

Passkeys and WebAuthn

Phishing-resistant sign-in with a recovery path to match

Claude builds passkey sign-in the way identity teams ship it: an RP ID chosen for the long term, single-use server-side challenges, verified origins, a credential table with counters, transports, and backup flags, and conditional UI so passkeys appear in autofill. It also designs fallback and account recovery so an email link does not quietly undo the phishing resistance.

passkeys-webauthn 266 lines

No. 283

SAML SSO

Enterprise single sign-on without the XML bypasses

Claude adds SAML as a careful service provider: a patched library in strict mode, per-tenant connections with pinned IdP certs, audience, recipient, time, InResponseTo and replay checks, and users keyed by tenant plus IdP subject instead of email. IdP-initiated login stays off by default, and an 18-case suite of forged, replayed and wrapped responses must fail before launch.

saml-sso 268 lines · 2 files

No. 284

Secrets Management

Rotate first, rewrite history second

When a key leaks, Claude revokes and rotates it before anything else, checks provider audit logs for misuse, and only then offers a confirmed history purge with git filter-repo. For prevention it wires gitleaks into pre-commit and CI, moves secrets into the right store for each environment, and fixes the quiet leaks in Docker layers, client bundles, and logs.

secrets-management 186 lines

No. 285

Secure File Uploads

Uploads that can't execute, escape, or exhaust you

Claude designs uploads from a per-type policy: size limits at proxy, app and storage, content-based type detection, generated storage keys, and private buckets. Images are re-encoded to strip EXIF and polyglots, archives are checked for zip slip and bombs, shared files pass through a quarantine bucket and ClamAV, and everything is served from a separate domain with attachment and nosniff headers.

secure-file-uploads 194 lines

No. 286

Security Headers

Strict CSP shipped without breaking production

Claude ships a nonce-based CSP with strict-dynamic through a Report-Only phase instead of pasting a policy that breaks checkout. It configures HSTS in safe steps, replaces X-Frame-Options with frame-ancestors, fixes CORS that reflects origins with credentials, and knows the nginx and Next.js traps. A bundled checker grades any URL you own and fails CI on regressions.

security-headers 190 lines · 2 files

No. 287

Security Logging

Audit trails that answer who did what, and page on it

Claude gives the app a typed security event vocabulary with actor, target, outcome, and correlation IDs, emitted through one redacting function. It routes the audit trail to storage the app cannot rewrite, sets retention per stream, and writes detections for credential stuffing, privilege grants, IDOR probing, and mass export, then proves redaction with canary secrets.

security-logging 233 lines · 2 files

No. 288

Semgrep Rules

Custom rules with tests, tuned to zero noise

Claude turns a real bug or banned API into a Semgrep rule that ships with a test file, passes semgrep --test, and produces no unexplained hits on the repo. It picks search or taint mode deliberately, tunes false positives with pattern-not-inside instead of deleting tests, and gates CI on new findings so legacy hits never block a merge.

semgrep-rules 282 lines · 2 files

No. 289

SOC 2 Readiness

Controls engineers actually run, with evidence on tap

Claude scopes the system and criteria, runs a gap assessment against the engineering controls auditors sample, and builds what is missing: SSO and MFA, leaver checks, quarterly access reviews, branch rulesets and pipeline-only deploys, logging and restore tests. Evidence is pulled by scripts from GitHub, the IdP and cloud APIs. It is engineering guidance, not audit or legal advice.

soc2-readiness 164 lines · 2 files

No. 290

Supply Chain Audit

Triage every CVE instead of just counting them

Instead of running npm audit fix --force and hoping, Claude scans each ecosystem, checks whether each vulnerable package is actually in the runtime and reachable, and sorts findings into fix now, planned, or accepted with reasons. It also catches the quieter risks: missing lockfiles, install scripts, dependency confusion, typosquats, and GitHub Actions pinned to mutable tags.

supply-chain-audit 182 lines

No. 291

Threat Modeling

Find design flaws before they become incidents

Gives Claude a disciplined STRIDE process instead of a generic list of scary threats. It builds a Mermaid data flow diagram from your code and configs, marks trust boundaries, enumerates threats per element, cites existing controls by file, and ranks residual risk. The output is a versioned model document with owners, tickets, and explicitly accepted risks.

threat-modeling 189 lines

No. 292

Vulnerability Triage

Turn 900 scanner CVEs into the dozen that matter

Claude stops sorting scanner output by CVSS and instead merges duplicate findings, enriches them with CISA KEV and EPSS, checks whether vulnerable code is loaded and reachable on exposed assets, and groups fixes by root cause. Decisions land as OpenVEX statements and dated risk acceptances, and a bundled script ranks Trivy, Grype or SARIF output offline.

vulnerability-triage 205 lines · 2 files

Choosing Security skills

Install the skills that match requests you make every week; each costs about 100 tokens of standing context until it loads. If you are not sure where to begin, start with OWASP Top 10 Review and Passkeys and WebAuthn. For background, read Are Claude Code Skills Safe? How to Audit a Skill Before Installing, The Best Claude Code Skills in 2026, by Use Case and How to Install Claude Code Skills (5 Ways).

By technology: Python skills

Install several

Install several at once

The installer accepts any number of skill names. Add --project to install into the current repository.

curl -fsSL https://claudeskills.page/install.sh | sh -s -- api-security auth-sessions authorization-models bot-fraud-defense cloud-security-posture container-security cryptography-basics gdpr-privacy input-validation jwt-handling mfa-implementation mobile-app-security oauth-oidc owasp-review passkeys-webauthn saml-sso secrets-management secure-file-uploads security-headers security-logging semgrep-rules soc2-readiness supply-chain-audit threat-modeling vulnerability-triage

Security skills FAQ

How do I install every Security skill at once?

Download the bundle at https://claudeskills.page/downloads/category/security.zip and unzip it into ~/.claude/skills/ (or .claude/skills/ inside a repository). To pick a few, pass several names to the installer: curl -fsSL https://claudeskills.page/install.sh | sh -s -- api-security auth-sessions authorization-models.

Will installing 25 skills slow Claude Code down?

No. Claude Code keeps only each skill's short description in context — roughly 100 tokens per skill — and loads the full instructions only when a request matches. Install the whole category if it fits your work; unused skills cost almost nothing.

Which Security skill should I start with?

Start with OWASP Top 10 Review, Passkeys and WebAuthn. They cover the most common requests in this category; add the rest as your work calls for them.