security-baseline
Establish a security baseline for a website or web app. Use this skill when configuring HTTPS and TLS, setting security headers, planning secrets management, evaluating CSP policies, doing a basic security audit, or hardening a site before launch. Triggers on security headers, HTTPS, TLS, CSP, content security policy, HSTS, secrets management, vulnerability scan, security audit, harden, OWASP, security baseline. Also triggers when a security review is required for compliance or before going live.
Profile →npx skills add rampstackco/claude-skills --skill security-baseline --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Baseline Establish the security floor for any production website or web app. Stack-agnostic. Covers the things that should be in place before public launch and verified periodically after. --- ## When to use - Pre-launch security review - Setting up a new site or environment - Periodic security audit (quarterly recommended) - Onboarding a new vendor or third-party integration - Responding to a security finding or report - Hardening after an incident ## When NOT to use - Active incident response (use `incident-response`) - Code-level security review (use `code-review-web`) - Email-specific authentication (SPF/DKIM/DMARC) (use `email-deliverability`) - DNS-level security (CAA, DNSSEC) (use `domain-strategy`) - Performance-related security (DDoS protection sizing) (use `performance-optimization`) --- ## Required inputs - The site or app in scope (URLs, environments) - The hosting platform and CDN - Authentication method (if any) - Third-party scripts and integrations - Compliance context (PCI, SOC2, GDPR, etc., if applicable) - Existing security tooling --- ## The framework: 6 layers Security is layered. Each layer addresses a different attack surface. ### Layer 1: Transpor
- When to use
- When NOT to use
- Required inputs
- The framework: 6 layers
- Layer 1: Transport security
- Layer 2: Response headers
- Layer 3: Authentication and authorization
- Layer 4: Input handling
- Layer 5: Secrets management
- Layer 6: Operational security
- Content Security Policy
- What CSP does
- Two flavors
- Roll out CSP gradually
What does the security-baseline skill do?
Establish a security baseline for a website or web app. Use this skill when configuring HTTPS and TLS, setting security headers, planning secrets management, evaluating CSP policies, doing a basic security audit, or hardening a site before launch. Triggers on security headers, HTTPS, TLS, CSP, content security policy, HSTS, secrets management, vulnerability scan, security audit, harden, OWASP, security baseline. Also triggers when a security review is required for compliance or before going live.
How do I install it?
Run `npx skills add rampstackco/claude-skills --skill security-baseline --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From rampstackco/claude-skills, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.