Skills/Security
6 skills · 0 measured · no API keys, no install, no scraping

Claude security skill, for the parts a scanner cannot do

Six skills for the design and decision work: what can go wrong and where, which of nine hundred findings matter, what to do in the first hour of a leak, and how to defend an agent that reads untrusted text. How we test →

All 6 shown

6 skills we have not measured yet

Written, reviewed and free to take. No run behind them, so no claim about what they do to an output. What that means.

SecurityNot yet measured Authorisation model build Produces the model, not a bug list: every resource crossed with every actor, one enforcement chokepoint written down, and negative tests for wrong tenant, wrong user, no session and lower role. skill · 4,399 words · MIT Read the write-up
SecurityNot yet measured Dependency risk triage Scan output in, triaged worklist and a written policy out. Four dispositions, each with a mandatory field, and severity is the signal you sort by last. skill · 4,005 words · MIT Read the write-up
SecurityNot yet measured Prompt injection defence build Starts from the published position that instruction and filtering defences do not hold, then spends its length on what the agent is allowed to do once the instruction is already through. skill · 4,047 words · MIT Read the write-up
SecurityNot yet measured Secret exposure response The rotation order is the content: mint, deploy, verify, revoke, plus the branches where you revoke first and the provider quarantine that blocks the rotation you were about to run. skill · 4,237 words · MIT Read the write-up
SecurityNot yet measured Security policy header build Produces the policy per environment, the report-only rollout with an enforcement cutover, and the surrounding header set with the obsolete headers removed. skill · 3,620 words · MIT Read the write-up
SecurityNot yet measured Threat model build Feature in, threat model document out. Boundaries before the diagram, STRIDE applied per element rather than per feature, and every threat closed with a named disposition. skill · 3,769 words · MIT Read the write-up
no API keys, no install, no scraping

The list

The first thing to say is that a free, first-party alternative exists and is good. Claude Code ships an automated security review, and if what you want is a scan of a diff for injection, authentication and data-handling defects, run that first. It is one command, it is maintained by the people who build the model, and nothing in this category is trying to replace it.

These six skills are for the work a scan cannot do. A scanner reads code that exists. It cannot tell you which trust boundary the feature crosses, whether the eight hundredth dependency finding is reachable from your entry points, what order to revoke things in when a key is already public, or whether an agent that reads a web page and can also send email is a design you should ship at all.

Why they are all generative

The library's own composition figures made this decision. Security is the easiest category in the world to fill with audits, and an audit-shaped security skill mostly reproduces a tool that already exists and runs faster. So every skill here produces something: a document, a plan, a policy, a model. Where a check is the right answer, the skill says which existing tool to run rather than imitating it.

The six

Threat model build is the flagship. Its content is procedure and the reason the procedure is ordered the way it is: the diagram before the threat list, because a threat you find without knowing which boundary it crosses cannot be prioritised, and the boundary enumeration before the diagram, because that is the step people skip. It uses the published four-question framing and STRIDE per element rather than the more common per-diagram gesture at the acronym.

Dependency risk triage exists because a modern scan on a modern application returns a number of findings nobody can act on, and severity is the wrong sort by a long way. The skill carries the three signals that actually change the answer, exploitation probability, whether the vulnerable code is reachable from your entry points, and whether it is in the catalogue of things known to be exploited in the wild, and it is explicit about which of the three you can compute cheaply.

Secret exposure response is a runbook for the first hour, built on the fact that deleting the commit does not help and rotating in the wrong order can lock you out of your own production.

Authorisation model build is about the defect class that has been at the top of the published lists for years and is still the most common serious finding in a real application, because it is the one class a scanner genuinely cannot detect: the request is well formed, the user is authenticated, and the object belongs to somebody else.

Security policy header build produces a content security policy that actually deploys, which is mostly a story about why the allowlist approach people reach for first is the one that does not work. Prompt injection defence build is for anyone shipping an agent, and its honest core is that filtering the input does not work, so the design has to assume the instruction gets through.

What is not here

No penetration testing skill, no exploit development, and nothing that produces working attack code. There is no compliance skill either, because a control framework mapping is a different job from finding out what can go wrong, and doing it badly is worse than not doing it.

None of the six carries a number yet, and every card says so.

What the two labels mean

Some of these carry a number. Most do not, and they say so.

Measured means the skill was given a realistic task on real material, then the identical task was run again with the skill removed, five runs each way. Each output was graded alone, against a rubric written by someone who had never seen the skill, by a session that was not told the other arm existed. Whether it passed was decided by a rule written down before any run executed. Those pages carry the worst case, the median, the p value, and what the skill costs you as well as what it buys.

Not yet measured means exactly that. It is written, it has been read, it is free to take, and we have run no experiment on it, so we make no claim about what it does to an output. It is not a skill that failed. Skills that failed are not published at all, in either state, and their numbers are in the results table.

Measuring one skill properly costs roughly twenty model sessions. We are working down the queue and moving skills from the second group into the first. Read the full method, or go back to all skills.