secure-code-guardian

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, compliance, debugging, security, web.

What it does

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill secure-code-guardian

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/secure-code-guardian ~/.claude/skills/secure-code-guardian

Safety box score

Grade A, minimal risk: 9 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only guidance for implementing authentication, authorization, input validation, security headers, and other OWASP-related controls. It does not ship installers or native scripts, but it can steer the agent into sensitive app-code changes and optional external validation against services like Mozilla Observatory.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts, binaries, or code-evaluation helpers are included; the files are Markdown guidance with TypeScript snippets only.
Network access	1 (low)	It recommends outbound validation with `curl -I` and Mozilla Observatory, which can send the target URL/headers to a third-party scanner, but there are no download/install flows.
Filesystem reach	0 (none)	The skill only describes application code patterns and does not instruct edits to dotfiles, system paths, or files outside the project.
Secrets & credentials	1 (low)	The examples explicitly use secret-bearing env vars like `process.env.JWT_SECRET` and `process.env.SESSION_SECRET`, but they do not ask the user to paste or expose secrets.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or OS/git configuration change in the skill files.
Instruction hijack surface	0 (none)	The content does not try to override higher-priority instructions or fetch remote prompt content; it is straightforward security guidance.
Irreversible actions	0 (none)	It does not send messages, deploy, publish, pay, or delete anything; it only advises how to implement and test security controls.
Transparency	0 (none)	All shipped files are readable Markdown; there are no binaries, minified blobs, or runtime-decoded code.

Before installing

Read `SKILL.md` and `references/*.md` to confirm it is guidance-only and ships no scripts or installers.
If you use the validation step, be comfortable sending your site URL/headers to a third-party scanner like Mozilla Observatory.
Confirm your app already manages secrets via env vars such as `JWT_SECRET` and `SESSION_SECRET`; the skill assumes they exist but does not create them.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/secure-code-guardian/SKILL.md
Branch: main
Updated: 2026-09-19

java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
django-expert — Use when building Django web applications or REST APIs with Django REST Framework.
django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages.
dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.