Security Best Practices

This is a proactive security companion that knows language-specific best practices for Python, JavaScript/TypeScript, and Go. It runs in three modes: write secure code by default on new projects, passively flag critical vulnerabilities as you work, or generate a full severity-ranked report when you ask for one. The references directory contains framework-specific guidance files that it loads on demand, covering both frontend and backend stacks. It handles fixes one at a time with thoughtful comments and actually considers whether changes might break your existing functionality, which is refreshingly practical. The report format includes line numbers and numeric IDs for findings, making it easy to track fixes through your workflow.

skills.sh installs: 378
GitHub stars: 7.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add tech-leads-club/agent-skills --skill security-best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.

SKILL.md on GitHub