Web Security
This is Claude's security-first mindset codified. It assumes hostile input by default and treats web security as a core requirement, not something you bolt on later. You get clear rules on XSS prevention, proper authentication patterns, and safe data handling across boundaries. It steers you away from dangerous patterns like dangerouslySetInnerHTML and localStorage for credentials while pushing secure defaults over flexibility. The guidance is opinionated and restrictive, which is exactly what you want when security matters. Use this when building anything that touches user data or faces the public internet.
- skills.sh installs
- 297
- GitHub stars
- 11
- last updated
- Aug 21, 2026
Install
$ npx -y skills add academind/ai-config --skill web-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Web Security
We treat web security as a core requirement, not an afterthought. Assume hostile input and untrusted environments by default.
Core Principles
- NEVER trust user input
- ALWAYS validate and sanitize data at boundaries
- Prefer secure defaults over configurability
XSS & Injection
- AVOID
dangerouslySetInnerHTMLand raw HTML injection - Escape and encode dynamic content properly
- Never interpolate untrusted data into HTML, CSS, or JS contexts
- Ensure SQL injection protection
Authentication & Authorization
- Do not store secrets or tokens in insecure locations
- AVOID localStorage for sensitive credentials when possible
- Use HTTP-only, secure cookies where applicable
- Always enforce authorization on the server
Browser Security APIs
- Respect CORS, CSP, and browser security boundaries
- Use Content Security Policy to restrict script and resource execution
- Avoid inline scripts and styles when CSP is enabled
Data Handling
- Minimize data exposure
- Do not log sensitive information
Dependencies & Supply Chain
- Avoid unnecessary packages
- Treat third-party code as untrusted input
General Principles
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/academind/ai-config
- Categories
- Security, AI & Agent Building
- First seen
- Jun 3, 2026
Recommended
More Security
security-pr-checklist-skillpatricio0312rev/skillsCreates repeatable security review checklist for PRs with required checks, common pitfalls, and automated gating. Use for "security review", "PR checklist", "co271skills.sh installs
owasp-ai-testingmastepanoski/claude-skillsAI trustworthiness testing using OWASP AI Testing Guide v1. Execute 32 test cases across 4 layers (Application, Model, Infrastructure, Data) with practical payl245skills.sh installs
software-securitycosai-oasis/project-codeguardA software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill w236skills.sh installs
senior-securityborghei/claude-skillsSTRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilit202skills.sh installs