Security Prompts

A library of copy-paste security prompts organized into 23 templates across four categories: prompt engineering (secure forms, endpoints, file uploads), threat modeling (STRIDE analysis, OWASP checks), auth/authorization (RBAC, permissions), and built-in controls. Each template includes the actual prompt text, security controls checklist, customization tips, and testing steps. Built for the Secure Vibe Coding methodology with Next.js, Clerk, and Convex. The templates are meant to be chained together, like using the RBAC implementation prompt first, then the admin action prompt, then security testing. Honest take: this is well organized if you're following their specific security architecture, but the value depends entirely on whether their opinionated stack matches yours.

skills.sh installs: 193
GitHub stars: 18
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add harperaa/secure-claude-skills --skill security-prompts --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Prompt Templates Library

Purpose

This skill provides ready-to-use security prompt templates following the Secure Vibe Coding methodology. Each template includes complete security controls, testing checklists, and customization guidance.

When to Use This Skill

Use security prompt templates when:

Building features: Forms, APIs, file uploads, admin panels
Implementing auth: RBAC, permissions, ownership checks
Security reviews: Threat modeling, code review, OWASP compliance
Testing: Security test generation, vulnerability assessment

Library Organization

📁 Prompt Engineering Templates (8 templates)

Location: .claude/skills/security/security-prompts/prompt-engineering/

Comprehensive prompts for implementing secure features:

01_secure_form.md - Public forms with full security stack
- Triggers: "secure form", "contact form", "public form"
- Controls: CSRF, rate limiting, XSS prevention, validation
02_authenticated_endpoint.md - Authenticated data modification
- Triggers: "authenticated endpoint", "user update", "protected route"
- Controls: Authentication, authorization, ownership checks