This is the security audit checklist you run before launch. It catches the boring stuff AI tools mess up: API keys hardcoded in files, missing auth checks on protected routes, no rate limiting, plain text passwords. The skill is opinionated about what you don't need yet (OAuth, pentests, WAFs) and pushes you toward auth services instead of rolling your own. Most useful as a pre-flight checklist when you're moving from "works on my machine" to "other people can use this." The prompts are specific enough to copy-paste into Claude, Cursor, or Lovable. Covers OWASP basics without the security theater.
- skills.sh installs
- 178
- GitHub stars
- 220
- last updated
- Jun 3, 2026
Install
$ npx -y skills add whawkinsiv/claude-code-superpowers --skill secure --agent claude-codeInstalls into .claude/skills of the current project.
Files
Secure
Run a security audit on the codebase and fix what matters first. AI-built apps fail in a few predictable places. Check those places, prove each finding, and fix it.
Step 1: Map the app
Read the code and list, briefly:
- the framework, and where the server code runs
- the database, and whether the browser talks to it directly
- how users log in
- every API route, server action, and webhook endpoint
- every third-party key the app uses
- every call that costs money: AI models, email, SMS
Step 2: Run the checks, worst damage first
1. Secrets
- Search the code and the git history for keys and passwords.
- Check that
.envfiles are in.gitignore. - List every environment variable that reaches the browser. Most frameworks mark these with a public prefix. None of them may hold a secret.
- A database key that bypasses access rules (an admin or service key) must never reach the browser.
- A secret that was ever committed must be rotated. Deleting the file does not remove it from git history.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/whawkinsiv/claude-code-superpowers
- First seen
- Jun 3, 2026
Recommended
cavemanjuliusbrussee/cavemanUltra-compressed communication mode. Cuts output tokens 65% (measured) by speaking like caveman while keeping full technical accuracy. Supports intensity levels618.3Kskills.sh installs
improveshadcn/improveSurvey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute. Strictly read-only on s40Kskills.sh installs
systematic-debuggingobra/superpowersUse when encountering any bug, test failure, or unexpected behavior, before proposing fixes326.7Kskills.sh installs
karpathy-guidelinesforrestchang/andrej-karpathy-skillsBehavioral guidelines to reduce common LLM coding mistakes through explicit assumptions, simplicity, and verifiable success criteria.17.9Kskills.sh installs
find-skillsvercel-labs/skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express int4.3Mskills.sh installs