Security Best Practices

This is a proactive security review tool that kicks in when you explicitly ask for a security audit or secure coding guidance across Python, JavaScript/TypeScript, and Go. It identifies your tech stack, pulls framework-specific best practices from its reference library (like Django, Express, or Gin security patterns), then either writes secure-by-default code going forward or generates a severity-ranked vulnerability report with line numbers. The nice touch is the three-mode approach: passive detection of critical issues while you work, full security reports when requested, and guided fixes that respect your commit workflow and testing setup. It won't fight you on project-specific overrides, which is refreshingly pragmatic. Just know it only triggers on explicit security requests, not general code review.

skills.sh installs: 246
GitHub stars: 33.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add davila7/claude-code-templates --skill security-best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.

SKILL.md on GitHub