secure-code-guardian
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
npx skills add Jeffallan/claude-skills --skill secure-code-guardian --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Secure Code Guardian ## Core Workflow 1. **Threat model** — Identify attack surface and threats 2. **Design** — Plan security controls 3. **Implement** — Write secure code with defense in depth; see code examples below 4. **Validate** — Test security controls with explicit checkpoints (see below) 5. **Document** — Record security decisions ### Validation Checkpoints After each implementation step, verify: - **Authentication**: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence). - **Authorization**: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users. - **Input handling**: Confirm SQL injection payloads (`' OR 1=1--`) are rejected; confirm XSS payloads (`<script>alert(1)</script>`) are escaped or rejected. - **Headers/CORS**: Validate with a security scanner (e.g., `curl -I`, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct. ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|---------
- Core Workflow
- Validation Checkpoints
- Reference Guide
- Constraints
- MUST DO
- MUST NOT DO
- Code Examples
- Password Hashing (bcrypt)
- Parameterized SQL Query (Node.js / pg)
- Input Validation with Zod
- JWT Validation
- Securing an Endpoint — Full Flow
- Output Templates
- Knowledge Reference
What does the secure-code-guardian skill do?
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
How do I install it?
Run `npx skills add Jeffallan/claude-skills --skill secure-code-guardian --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From Jeffallan/claude-skills, a repository with 10,871 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.