security
This skill helps you integrate security best practices and OWASP-aligned patterns directly into your codebase, whether you're starting fresh or hardening existing systems. It guides you through vulnerability assessment, secure coding patterns, and compliance-focused implementation strategies to reduce risk and build defensible applications.
The security skill provides guidance on preventing secrets and credentials from being committed to version control through multiple layers: implementing pre-commit security hooks that scan for exposed API keys and tokens before they reach your repository, using environment variables and secrets management tools to keep sensitive data out of code, and setting up automated detection workflows. It covers best practices for .gitignore configuration, credential scanning tools, and CI/CD integration to catch leaks early in your development pipeline.
AI-generated summary based on this skill's SKILL.md
Install
alinaqi/maggy/security · repository language: Python
git clone https://github.com/alinaqi/maggy
cp -r maggy/skills/security ~/.claude/skills/securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How can the security skill help me prevent secrets from leaking in git?
The security skill provides guidance on preventing secrets and credentials from being committed to version control through multiple layers: implementing pre-commit security hooks that scan for exposed API keys and tokens before they reach your repository, using environment variables and secrets management tools to keep sensitive data out of code, and setting up automated detection workflows. It covers best practices for .gitignore configuration, credential scanning tools, and CI/CD integration to catch leaks early in your development pipeline.
What OWASP security best practices does this skill cover for web applications?
The security skill integrates OWASP-aligned patterns directly into your codebase to help you build defensible applications. It guides you through implementing input validation and sanitization to prevent injection and XSS attacks, configuring security headers using tools like Helmet, setting up proper authentication with JWT best practices, implementing rate limiting on auth endpoints, and establishing secure CORS configurations. The skill also covers vulnerability assessment strategies and compliance-focused implementation to reduce risk across your application architecture.
How does the security skill help with setting up automated security testing in CI/CD pipelines?
The security skill helps you establish automated security testing and vulnerability scanning directly in your CI/CD workflows. It provides guidance on integrating tools like npm audit for dependency vulnerabilities, setting up GitHub Actions security workflows, implementing pre-commit security hooks, and configuring automated code scanning for security vulnerabilities and anti-patterns. This approach ensures continuous vulnerability detection throughout your development lifecycle and helps catch issues before they reach production.
What input validation and sanitization techniques does the security skill teach?
The security skill teaches you to validate and sanitize user input using industry-standard libraries and patterns to prevent injection and XSS attacks. It covers validation frameworks like Zod and Pydantic for schema validation, sanitization tools like DOMPurify for client-side protection, parameterized queries for SQL injection prevention, and path traversal prevention techniques. The skill provides practical examples for React and other frameworks, helping you implement defense-in-depth input handling across your application.
Can the security skill help me review code for vulnerabilities and anti-patterns?
Yes, the security skill includes guidance on reviewing code for security vulnerabilities and anti-patterns. It helps you identify common security mistakes, understand why certain patterns are risky, and learn defensive alternatives. The skill covers topics like secure password hashing with bcrypt, proper JWT authentication implementation, secure configuration of security headers, and detection of secrets in code. This knowledge enables you to conduct effective security reviews and harden both new and existing systems against common attack vectors.
What does the security skill provide for hardening existing systems?
The security skill guides you through hardening existing systems by integrating OWASP-aligned patterns and vulnerability assessment strategies into your current codebase. It helps you implement security best practices incrementally, set up automated security testing in your existing CI/CD pipelines, add security headers and proper authentication, and establish code review processes focused on security vulnerabilities. The skill provides compliance-focused implementation strategies that reduce risk while working within your existing architecture and development workflow.
SKILL.md
rendered from the published skill — quoted content, verbatim
Security Skill
Security best practices and automated security testing for all projects.
Core Principle
Security is not optional. Every project must pass security checks before merge. Assume all input is malicious, all secrets will leak if committed, and all dependencies have vulnerabilities.
Required Security Setup
1. Gitignore (Non-Negotiable)
Every project must have these in .gitignore:
# Environment files - NEVER commit
.env
.env.*
!.env.example
# Secrets
*.pem
*.key
*.p12
*.pfx
credentials.json
secrets.json
*-credentials.json
service-account*.json
# IDE and OS
.idea/
.vscode/settings.json
.DS_Store
Thumbs.db
# Dependencies
node_modules/
__pycache__/
*.pyc
.venv/
venv/
# Build outputs
dist/
build/
*.egg-info/
# Logs that might contain sensitive data
*.log
logs/
2. Environment Variables
Create .env.example with all required vars (no
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/security/SKILL.md