Security

This is a comprehensive security checklist that assumes you'll leak secrets and get pwned if you don't follow it. It sets up gitignore patterns, environment variable handling with framework-specific prefixes (VITE_, NEXT_PUBLIC_), and pre-commit hooks that scan for secrets and vulnerable dependencies. You get a bash script that blocks commits containing .env files, GitHub Actions workflows for TruffleHog and CodeQL, and OWASP input validation patterns. The paranoid tone is actually helpful because it treats security as non-negotiable rather than optional. Best used when starting a new project or adding security scanning to an existing codebase that handles auth or API keys.

skills.sh installs: 315
GitHub stars: 685
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add alinaqi/claude-bootstrap --skill security --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Skill

Security best practices and automated security testing for all projects.

This skill is preventive — how to write and ship secure code. To audit an existing codebase or PR for vulnerabilities, use the security-audit skill (structured, adversarial, evidence-grounded); for a quick pass over the current branch, run /security-review.

Core Principle

Security is not optional. Every project must pass security checks before merge. Assume all input is malicious, all secrets will leak if committed, and all dependencies have vulnerabilities.

Required Security Setup

1. Gitignore (Non-Negotiable)

Every project must have these in .gitignore:

# Environment files - NEVER commit
.env
.env.*
!.env.example

# Secrets
*.pem
*.key
*.p12
*.pfx
credentials.json
secrets.json
*-credentials.json
service-account*.json

# IDE and OS
.idea/
.vscode/settings.json
.DS_Store
Thumbs.db

# Dependencies
node_modules/
__pycache__/
*.pyc
.venv/
venv/

# Build outputs
dist/
build/
*.egg-info/

# Logs that might contain sensitive data
*.log
logs/