Discover security

Skill kenantang/codex-and-claude-skills/collected-academic-research-skills/sources/rand__cc-polymath/skills/discover-security

Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.From its SKILL.md

Install

npx -y skills add kenantang/codex-and-claude-skills --skill discover-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

7.5 KB, ~1.5k tokens by cl100k_base, as published. Nobody here has run it

Security Skills Discovery

Provides automatic access to comprehensive application security, vulnerability assessment, and security best practices skills.

When This Skill Activates

This skill auto-activates when you're working with:

Authentication and authorization systems
Input validation and sanitization
Security headers (CSP, HSTS, CORS)
Vulnerability scanning and penetration testing
OWASP Top 10 vulnerabilities
Secrets management (Vault, AWS Secrets Manager)
SQL injection, XSS, or other attack prevention
Security hardening and compliance
Password hashing and credential management
API security and access control

Available Skills

Quick Reference

The Security category contains 6 specialized skills:

authentication - Authentication patterns (JWT, OAuth2, sessions, MFA, password security)
authorization - Access control (RBAC, ABAC, policy engines, permissions)
input-validation - Input validation and sanitization (SQL injection, XSS, command injection)
security-headers - HTTP security headers (CSP, HSTS, X-Frame-Options, CORS)
vulnerability-assessment - Security testing (OWASP Top 10, scanning tools, pentesting)
secrets-management - Secrets handling (Vault, AWS Secrets Manager, key rotation)

Load Full Category Details

For complete descriptions and workflows:

Read ../security/INDEX.md

This loads the full Security category index with:

Detailed skill descriptions
Usage triggers for each skill
Common workflow combinations
Cross-references to related skills

Load Specific Skills

Load individual skills as needed:

Identity and access

Read ../security/authentication.md Read ../security/authorization.md

Input security

Read ../security/input-validation.md Read ../security/security-headers.md

Security operations

Read ../security/vulnerability-assessment.md Read ../security/secrets-management.md

Common Workflows

Secure Web Application

Sequence: Authentication → Authorization → Input validation → Security headers

Read ../security/authentication.md # User login Read ../security/authorization.md # Access control Read ../security/input-validation.md # XSS/SQL injection prevention Read ../security/security-headers.md # Browser protection

Security Audit

Sequence: Vulnerability assessment → Input validation → Headers → Secrets

Read ../security/vulnerability-assessment.md # OWASP Top 10 testing Read ../security/input-validation.md # Injection testing Read ../security/security-headers.md # Header configuration Read ../security/secrets-management.md # Credential security

API Security

Sequence: Authentication → Authorization → Input validation → Secrets

Read ../security/authentication.md # JWT/OAuth2 Read ../security/authorization.md # API access control Read ../security/input-validation.md # Request validation Read ../security/secrets-management.md # API key management

DevSecOps Pipeline

Sequence: Vulnerability assessment → Secrets → Input validation

Read ../security/vulnerability-assessment.md # Security scanning Read ../security/secrets-management.md # CI/CD secrets Read ../security/input-validation.md # SAST validation

Secure New Application

Full security implementation from scratch:

1. Identity and access

Read ../security/authentication.md Read ../security/authorization.md

2. Input protection

Read ../security/input-validation.md Read ../security/security-headers.md

3. Operations

Read ../security/secrets-management.md Read ../security/vulnerability-assessment.md

Skill Selection Guide

Choose Authentication when:

Implementing user login systems
Working with JWT, OAuth2, or sessions
Adding multi-factor authentication
Managing passwords and credentials

Choose Authorization when:

Implementing access control
Building role-based permissions (RBAC)
Working with policy engines (OPA, Casbin)
Preventing privilege escalation

Choose Input Validation when:

Processing user input
Preventing SQL injection
Protecting against XSS attacks
Validating file uploads
Preventing command injection

Choose Security Headers when:

Configuring Content Security Policy (CSP)
Implementing HTTPS enforcement (HSTS)
Setting up CORS for APIs
Preventing clickjacking
Hardening web applications

Choose Vulnerability Assessment when:

Testing for OWASP Top 10
Running security scans (SAST/DAST)
Performing penetration tests
Auditing application security
Setting up security CI/CD

Choose Secrets Management when:

Storing API keys or credentials
Integrating with HashiCorp Vault
Using AWS Secrets Manager or GCP Secret Manager
Rotating encryption keys
Managing CI/CD secrets

Integration with Other Skills

Security skills commonly combine with:

API skills (discover-api):

API authentication and authorization
API input validation
API rate limiting (abuse prevention)
Securing REST and GraphQL endpoints

Database skills (discover-database):

SQL injection prevention
Database connection security
Credential management
Row-level security

Frontend skills (discover-frontend):

XSS prevention in React/Vue
Content Security Policy
Secure cookie handling
Client-side validation

Infrastructure skills (discover-infrastructure, discover-cloud):

Secrets management in deployments
Network security
Container security scanning
TLS/SSL configuration

Testing skills (discover-testing):

Security integration tests
Penetration testing
Automated security scans
Vulnerability regression tests

Usage Instructions

Auto-activation: This skill loads automatically when Claude Code detects security-related work
Browse skills: Run Read ../security/INDEX.md for full category overview
Load specific skills: Use bash commands above to load individual skills
Follow workflows: Use recommended sequences for common security patterns
Combine skills: Load multiple skills for comprehensive security coverage

Progressive Loading

This gateway skill (~200 lines, ~2K tokens) enables progressive loading:

Level 1: Gateway loads automatically (you're here now)
Level 2: Load category INDEX.md (~3K tokens) for full overview
Level 3: Load specific skills (~2-4K tokens each) as needed

Total context: 2K + 3K + skill(s) = 5-12K tokens vs 30K+ for entire index.

Quick Start Examples

"Implement user authentication": Read ../security/authentication.md

"Add role-based access control": Read ../security/authorization.md

"Prevent SQL injection": Read ../security/input-validation.md

"Configure Content Security Policy": Read ../security/security-headers.md

"Test for OWASP vulnerabilities": Read ../security/vulnerability-assessment.md

"Integrate HashiCorp Vault": Read ../security/secrets-management.md

"Secure API with JWT": Read ../security/authentication.md Read ../security/authorization.md

Next Steps: Run Read ../security/INDEX.md to see full category details, or load specific skills using the bash commands above.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most security skills give in ~1.5k tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accessin 82 of 666, across 79 files
Hash passwords with BCryptin 55 of 666, across 39 files
Implement rate limiting for public endpointsin 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputin 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

Read the security index for full category details
Follow recommended sequences for security workflows
Combine multiple security skills for comprehensive coverage

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.