Secure Code Guardian
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
Install
npx skills add Jeffallan/claude-skills --skill secure-code-guardiangit clone --depth 1 https://github.com/Jeffallan/claude-skills.git /tmp/claude-skills
mkdir -p ~/.claude/skills
cp -r /tmp/claude-skills/skills/secure-code-guardian ~/.claude/skills/secure-code-guardianPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Secure Code Guardian ## Core Workflow 1. **Threat model** — Identify attack surface and threats 2. **Design** — Plan security controls 3. **Implement** — Write secure code with defense in depth; see code examples below 4. **Validate** — Test security controls with explicit checkpoints (see below) 5. **Document** — Record security decisions ### Validation Checkpoints After each implementation step, verify: - **Authentication**: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence). - **Authorization**: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users. - **Input handling**: Confirm SQL injection payloads (`' OR 1=1--`) are rejected; confirm XSS payloads (`<script>alert(1)</script>`) are escaped or rejected. - **Headers/CORS**: Validate with a security scanner (e.g., `curl -I`, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct. ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|-----------| | OWASP | `references/owasp-prevention.md` | OWASP Top 10 patterns | | Authentication | `references/authentication.md` | Password hashing, JWT | | Input Validation | `references/input-validation.md` | Zod, SQL injection | | XSS/CSRF | `references/xss-csrf.md` | XSS prevention, CSRF |
Details
- Skill name
secure-code-guardian- Repository
- Jeffallan/claude-skills
- Path
skills/secure-code-guardian/SKILL.md- License
- MIT
- Repo updated
- 30 October 2026
FAQ
What does the Secure Code Guardian skill do?
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
How do I install the Secure Code Guardian skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add Jeffallan/claude-skills --skill secure-code-guardian. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Secure Code Guardian popular?
It lives in Jeffallan/claude-skills, which has 12,146 GitHub stars and 1,162 forks, and is included in 3 curated skill lists.
Related skills
API Designer
12kJeffallan/claude-skills
Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards.
Code Documenter
12kJeffallan/claude-skills
Generates, formats, and validates technical documentation — including docstrings, OpenAPI/Swagger specs, JSDoc annotations, doc portals, and user guides. Use when adding docstrings to functions or classes, creating API documentation, building documentation sites, or writing tutorials and user guides. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, getting started guides.
Debugging Wizard
12kJeffallan/claude-skills
Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points, and applies systematic hypothesis-driven methodology to isolate and resolve bugs. Use when investigating errors, analyzing stack traces, finding root causes of unexpected behavior, troubleshooting crashes, or performing log analysis, error investigation, or root cause analysis.
Security Reviewer
12kJeffallan/claude-skills
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
Google Cloud Waf Security
22kgoogle/skills
Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.
Deepsec
8.3kvercel-labs/deepsec
Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.