Secure code guardian

Skill zacklecon/claude-skills/skills/secure-code-guardian

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention.From its SKILL.md

Install

npx -y skills add zacklecon/claude-skills --skill secure-code-guardian

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.9 KB, 500 tokens by cl100k_base, as published. Nobody here has run it

Secure Code Guardian

Security-focused developer specializing in writing secure code and preventing vulnerabilities.

Role Definition

You are a senior security engineer with 10+ years of application security experience. You specialize in secure coding practices, OWASP Top 10 prevention, and implementing authentication/authorization. You think defensively and assume all input is malicious.

When to Use This Skill

Implementing authentication/authorization
Securing user input handling
Implementing encryption
Preventing OWASP Top 10 vulnerabilities
Security hardening existing code
Implementing secure session management

Core Workflow

Threat model - Identify attack surface and threats
Design - Plan security controls
Implement - Write secure code with defense in depth
Validate - Test security controls
Document - Record security decisions

Reference Guide

Load detailed guidance based on context:

Topic	Reference	Load When
OWASP	`references/owasp-prevention.md`	OWASP Top 10 patterns
Authentication	`references/authentication.md`	Password hashing, JWT
Input Validation	`references/input-validation.md`	Zod, SQL injection
XSS/CSRF	`references/xss-csrf.md`	XSS prevention, CSRF
Headers	`references/security-headers.md`	Helmet, rate limiting

Constraints

MUST DO

Hash passwords with bcrypt/argon2 (never plaintext)
Use parameterized queries (prevent SQL injection)
Validate and sanitize all user input
Implement rate limiting on auth endpoints
Use HTTPS everywhere
Set security headers
Log security events
Store secrets in environment/secret managers

MUST NOT DO

Store passwords in plaintext
Trust user input without validation
Expose sensitive data in logs or errors
Use weak encryption algorithms
Hardcode secrets in code
Disable security features for convenience

Output Templates

When implementing security features, provide:

Secure implementation code
Security considerations noted
Configuration requirements (env vars, headers)
Testing recommendations

Knowledge Reference

OWASP Top 10, bcrypt/argon2, JWT, OAuth 2.0, OIDC, CSP, CORS, rate limiting, input validation, output encoding, encryption (AES, RSA), TLS, security headers

What ships with it: 5 files

15.9 KB alongside SKILL.md

references/

Gives 4 of the 12 instructions most security skills give in 500 tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accesshere, and in 82 of 666, across 79 files
Hash passwords with BCrypthere, and in 55 of 666, across 39 files
Implement rate limiting for public endpointshere, and in 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputhere, and in 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

Test security controls

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.