SAAS Security

Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or authorization logic, check for injection risks, race conditions, or insecure configurations, or asks anything related to SaaS security hardening. Also trigger proactively when the user shares code and asks for a review — always include a security perspective using this skill.

11 starsSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)
npx skills add vitormiziara/saas-security --skill saas-security
Manual install
git clone --depth 1 https://github.com/vitormiziara/saas-security.git /tmp/saas-security
mkdir -p ~/.claude/skills
cp -r /tmp/saas-security/. ~/.claude/skills/saas-security

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# SaaS Security Skill

You are a senior software engineer with deep expertise in offensive and defensive security.
Every code review, checklist, or audit you perform follows the rules in this skill **without exception**.
Treat every output as if it will be submitted to a professional red team pentest — any vulnerability found is a critical failure on your part.

These rules apply regardless of stack, language, framework, or system type.
Adapt each protection to the project's technological context as it is revealed.

---

## How to Use This Skill

**Read the appropriate reference files before responding:**

| User asks for… | Read these files |
|---|---|
| Code audit / vulnerability review | `references/core-principles.md` + `references/owasp-domains.md` |
| Security checklist | `references/checklists.md` |
| Race condition review | `references/race-conditions.md` |
| Auth / session review | `references/owasp-domains.md` (A07 section) |
| Input validation review | `references/owasp-domains.md` (A05 + Input Validation section) |
| Full security report | All reference files |
| Deploy / infra review | `references/checklists.md` (Deploy section) |

---

## Workflow: Security Audit

Follow this 4-phase structure for any audit request:

### Phase 1 — Reconnaissance
Before checking anything, map the terrain:
- Identify the tech stack (language, framework, ORM, auth library, DB)
- Identify trust boundaries (what comes from the user? what comes from internal services?)
Read the full skill on GitHub

Details

Skill name
saas-security
Repository
vitormiziara/saas-security
License
MIT
Repo updated
30 March 2026

FAQ

What does the SAAS Security skill do?

Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or authorization logic, check for injection risks, race conditions, or insecure configurations, or asks anything related to SaaS security hardening. Also trigger proactively when the user shares code and asks for a review — always include a security perspective using this skill.

How do I install the SAAS Security skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add vitormiziara/saas-security --skill saas-security. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is SAAS Security popular?

It lives in vitormiziara/saas-security, which has 11 GitHub stars and 0 forks.

Related skills

Skill Security Reviewer

9

oguzhantopgul/skill-security-reviewer

Security review and threat analysis for agent skills. Use when reviewing, auditing, or validating skills for security issues including prompt injection, code execution risks, data exfiltration, supply chain vulnerabilities, and policy violations. Triggers on requests to "review a skill", "audit skill security", "check skill for vulnerabilities", "validate skill safety", or any security assessment of SKILL.md files and their associated scripts/assets.

Security

Repo Seed

10

EricSanchezok/repo-seed

Seed, audit, adopt, and progressively evolve an agent-native repository with risk-triggered specs, durable decisions, resident governance skills, capability state, deterministic gates, and safe upgrades. Use when initializing or upgrading a repository, when an unmanaged repository grows complex, or when delivery, ownership, security, release, or incident signals suggest a governance capability is missing.

Security

Spinal Pro

9

Zeeh-Lin/spinal-pro

End-to-end SpinalHDL skill for generating, reviewing, explaining, and validating RTL (Scala HDL). Covers DSL semantics (`:=`, `<>`, `Reg`, `Stream`, `Flow`, `Bundle`, `Vec`, `ClockDomain`, `StateMachine`, `Mem`, `BusSlaveFactory`), pipeline and plugin composition (`spinal.lib.misc.pipeline`, `spinal.lib.misc.plugin`), simulation with `SimConfig`/`doSim`, and architecture patterns drawn from official SpinalHDL docs and VexRiscv. Load for SpinalHDL DSL questions, module implementation, interface design, SoC integration, bug hunting, error-message decoding, and simulation or build validation.

Security

My Security Auditor

10

leomarviegas/my-security-auditor

Comprehensive authorized security audit skill covering web, APIs, cloud, Kubernetes, mobile, AI/LLM, microservices, SaaS (multi-tenancy, SSO, BYOK), plus red/blue/purple team operations. Integrates OWASP (Top 10, API/Mobile/LLM/Cloud/K8s, ASVS, SAMM, WSTG, MASVS), MITRE ATT&CK + D3FEND, OSSTMM with RAV, NIST RMF/CSF, FAIR, ISO 27001 family, CVSS/EPSS/SSVC, Zero Trust (800-207, CISA ZTMM), SABSA, CIS, CSA CCM, SOC 1/2/3, PCI-DSS v4.0.1, GDPR/LGPD/CCPA/HIPAA privacy, customer trust deliverables (DPAs, CAIQ/SIG, VDPs), SOC operations, detection engineering, threat hunting, adversary emulation (CA

Security

Oma Lwm2m Expert

9

svdwalt007/Best-LwM2M-Agentic-Skills

OMA LwM2M expert: specs v1.0–v1.2.2 plus v2.0 roadmap, object/resource data model, transports, security, ecosystem. Trigger on: LwM2M, Lightweight M2M, OMA SpecWorks, OMNA registry, OMA-TS-LightweightM2M, CoAP (RFC 7252/7641/7959/8323), DTLS, DTLS CID (RFC 9146), DTLS 1.3, RRC (RFC 9853), OSCORE (RFC 8613), PSK, RPK, X.509, EST, SNI, NoSec, TLV, SenML JSON/CBOR, LwM2M CBOR, bootstrap, Bootstrap-Pack, registration, endpoint name, Profile ID, Queue Mode, bindings (UDP/TCP/SMS/Non-IP/LoRaWAN/MQTT/HTTP/ WebSockets), Read/Write/Execute/Discover, composite operations, Send, observe/notify, notificat

Security

Security Bluebook Builder

8

SHADOWPR0/security-bluebook-builder

Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.

SecurityIn 1 list

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.