Individual skill
security-best-practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
bundled/skills/security-best-practices/SKILL.md
Source commit bd10381417cbd890ed6f08a18bb18fb5aaf0f741
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 3,813
- Repository last updated
- Nov 9, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- ai-workflow Repository topic
- automation Repository topic
- codex Repository topic
- developer-tools Repository topic
- skills Repository topic
- ai-skills Repository topic
- claude-code Repository topic
- llm Repository topic
- vibe-coding Repository topic
- engineering Derived category
- security Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSE.txtdoc · 10,776 bytesSKILL.mdcore · 8,612 bytesagents/openai.yamlasset · 237 bytesreferences/golang-general-backend-security.mddoc · 38,659 bytesreferences/javascript-express-web-server-security.mddoc · 49,357 bytesreferences/javascript-general-web-frontend-security.mddoc · 38,638 bytesreferences/javascript-jquery-web-frontend-security.mddoc · 33,581 bytesreferences/javascript-typescript-nextjs-web-server-security.mddoc · 43,423 bytesreferences/javascript-typescript-react-web-frontend-security.mddoc · 41,686 bytesreferences/javascript-typescript-vue-web-frontend-security.mddoc · 31,445 bytesreferences/python-django-web-server-security.mddoc · 38,661 bytesreferences/python-fastapi-web-server-security.mddoc · 44,926 bytesreferences/python-flask-web-server-security.mddoc · 31,748 bytes
Read excerpt
# Security Best Practices
## Overview
This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.
This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.
## Workflow
The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.
Then check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is `<language>-<framework>-<stack>-security.md`. You should also check if there is a `<language>-general-<stack>-security.md` which is agnostic to the framework you may be using.
