claude-security-skills - 25 production-tested defensive security skills for

项目说明

<p align="center">
<img src="./assets/banner.png" alt="Claude Code Security Skills" width="100%">
</p>

<di="center">

Claude Code Security Skills

Defensi playbooks for LLM coding agents and the de using them

![CI]()
![Claude Code]()
![Stars]()
![Forks]()
![Last commit]()
![Featured on dev.to]()
![Announcement on goldenwing.at]()

38 production-tested skills · 13 security domains · defensi · MIT-licensed

Get started · What's inside · Find a skill · Read on dev.to · Read on goldenwing.at · Contributing

</div>

---

> ⚠️ Independent project — Not affiliated with Anthropic PBC. The skills are plain Markdown with YAML frontmatter and work with any LLM coding agent that supports the same con.

Give any LLM coding agent the instincts of a senior engineer

A senior engineer knows when a --no- flag is hiding a real bug, when an empty catch {} is silently swallowing an auth check, what to do when a customer's WordPress site starts redirecting to a casino, and how to harden a fresh VPS in thirty minutes. Your AI coding agent doesn't — unless you give it these skills.

This repo contains 38 production-tested defensi skills, each a self-contained Markdown file with YAML frontmatter so Claude Code (or any compatible agent) can auto-trigger the right one. Every skill comes from real incident-response, hardening, and audit work — generalized so the patterns tra the original engagement. Clone it, point your agent at it, and your next deploy, audit, or 3am alert gets expert-le in seconds.

What's inside — 13 security domains

| Domain | Skills | What it covers |
|---|---|---|
| 🤖 AI & LLM security | 6 | MCP security · agent guardrails · prompt injection defense · OWASP LLM Top 10 · coding-agent failure modes · RAG pipelines |
| 🌐 Web application | 6 | WordPress · Next.js · Payload CMS · API (OWASP API Top 10) · Stripe webhooks · file upload safety |
| 🏗️ Server & infrastructure | 7 | VPS · Cloudflare · Postgres · Docker · Kubernetes · DNS & domains · object storage (S3 / R2) |
| 🛰 Distributed systems | 3 | Distributed-system audit · nati / client security · message bus (NATS / RabbitMQ / Kafka) |
| 🎯 Architecture & reliability | 2 | Backend architecture (twel, stateless deploys) · backups & disaster recovery |
| 🔎 Audit & review | 2 | Codebase audit methodology · site / ser checklist |
| 🔐 Identity & access | 2 | Auth hardening (NIST 800-63B, MFA tiers) · secret hygiene & rotation |
| 📦 Supply chain & CI/CD | 2 | npm / pnpm / typosquat defense · GitHub Actions (OIDC, SHA pinning) |
| 📋 Compliance (EU / DACH) | 2 | GDPR technical controls · DACH Impressum / Datenschutz / AGB |
| 🔍 Detection & monitoring | 2 | Log strategy (operational / access / audit) · honeypots & tarpits |
| 🛡️ Incident response | 1 | SANS PICERL runbook with post-mortem template |
| 📨 Email security | 1 | SPF / DKIM / DMARC (with the p=none → p=reject migration path) |
| 📱 Mobile security | 2 | iOS / macOS — Keychain, ATS, pinning · Android — Keystore, Play Integrity, WebView |

Who this is for

Each skill is defensive only. No exploitation, no offensi. Authorization for the systems you work on is assumed.

Quick start

Use any skill in three ways:

1. As a Claude Code skill — Claude auto-triggers the right one based on the con. The YAML description field is matched against your request.
2. As a runbook for yourself — open <skill-name>/SKILL.md and follow the steps.
3. As a checklist for review — paste the skill into a PR or audit doc and walk through it.

Skill anatomy

Every SKILL.md follows a consistent structure that doubles as a discovery contract and a self-contained runbook:

A companion index.json at the repo root indexes every skill's slug, name, description, and domain for programmatic use (skill discovery, agent loading, search UIs).

Documentation

Reference material that complements the skills:

Compatibility

Skills use plain Markdown with YAML frontmatter (name, description). Tested target is Claude Code; the same files work with any LLM coding agent that supports the con — including Cursor, GitHub Copilot, Codex CLI, Cline, Continue.dev, and Gemini CLI. Nothing in the body is platform-specific.

Repository structure

<details>
<summary>38 skills + repo metadata — click to expand</summary>

Every skill is a self-contained SKILL.md with YAML frontmatter (name, description) plus a body that follows roughly: *when to invoke → detection / steps / patterns → checklist → what this skill will not do*.

</details>

Skills by category

Each link goes to the full SKILL.md with detection commands, step-by-step procedures, and checklists.

🤖 AI & LLM security

| Skill | Summary |
|---|---|
| mcp-security | Audit MCP configurations, risk-tier capabilities, detect malicious servers, apply least-pri scoping. |
| ai-agent-guardrails | Blast-radius classification, dry-run-first, out-of-band appro, kill switches. |
| prompt-injection-defense | Source-of-trust tagging, tool-use confirmation after untrusted input, exfiltration pre. |
| llm-app-security | OWASP LLM Top 10 mapped to practical controls — rate limits, cost caps, PII scrubbing, audit logging. |
| llm-coding-failure-modes | Antipattern catalog for LLM coding agents — bulk ops, bypassed guards, slopsquatting, sycophancy. |
| rag-security | RAG pipelines — document-le at retrieval time, tenant isolation in DBs, poisoned-corpus defense. |

🌐 Web application

| Skill | Summary |
|---|---|
| wordpress-hardening | Detect WordPress webshells and harden against re-compromise on shared hosting. |
| nextjs-security | Next.js-specific issues — middleware bypass, RSC o, NEXT_PUBLIC_ traps, CSP, next/image SSRF. |
| payload-cms-security | Access control, file uploads, GraphQL surface, and multi-tenant isolation in Payload CMS. |
| api-security | OWASP API Top 10 — BOLA, mass assignment, excessive data exposure, GraphQL depth limits. |
| file-upload-security | Accept uploads safely — magic-byte , polyglot defense, separate-origin serving with Content-Disposition. |
| stripe-webhook-security | Raw-body signature , idempotency, replay protection, currency-mismatch traps. |
| site-ser | Non-intrusi for DNS, TLS, security headers, exposed paths, and cookies. |

🏗️ Server & infrastructure

| Skill | Summary |
|---|---|
| | 30-minute Debian / Ubuntu baseline — SSH key-only, UFW, fail2ban, unattended-upgrades. |
| cloudflare-hardening | Origin-IP protection, WAF, Rate Limiting, Zero Trust Access, Transform Rules for headers. |
| postgres-hardening | pg_hba, role separation, row-le, TLS, encrypted backups, pg_audit. |
| docker-container-security | Non-root users, read-only filesystems, dropped capabilities, image scanning, the UFW-bypass trap. |
| kubernetes-security | Pod Security Standards, RBAC least-pri, NetworkPolicy default-deny, admission controllers. |
| dns-domain-security | Dangling records and subdomain takeover, registrar lock, CAA, DNSSEC tradeoffs, CT-log monitoring. |
| object-storage-security | S3 / R2 / GCS — public-access audit, presigned URLs done right, scoped credentials, object lock. |

🛰 Distributed systems

| Skill | Summary |
|---|---|
| distributed-system-audit | Map first, judge later — trust boundaries, protocol audit (replay / ordering / forgery), failure-mode walk. |
| agent-client-security | Nati on customer machines — installer signing, OTA with rollback, mTLS, anti-tampering signals. |
| message-bus-security | NATS / RabbitMQ / Kafka — tenant isolation, deny-default permissions, replay protection, consumer idempotency. |

🎯 Architecture & reliability

| Skill | Summary |
|---|---|
| backend-architecture | Stateless apps, state in the right places, twel — survi, scaling, ser. |
| backup-disaster-recovery | RPO / RTO, 3-2-1, encrypted off-host backups, ransomware-resistant immutable storage, restore drills. |

🔎 Audit & review

| Skill | Summary |
|---|---|
| codebase-audit | Methodology for inherited codebases — triage, SAST / SCA recipes, OWASP grep patterns, se report. |

🔐 Identity & access

| Skill | Summary |
|---|---|
| auth-hardening | NIST 800-63B passphrases, Argon2id, MFA tiers, no-enumeration lockout, password reset done right. |
| secret-hygiene | Find leaked secrets, rotate in the right order, optionally purge git history with git-filter-repo. |

📦 Supply chain & CI/CD

| Skill | Summary |
|---|---|
| dependency-supply-chain | Lockfile hygiene, beha scanning, postinstall review, typosquat and slopsquat defense. |
| github-actions-security | SHA-pinned actions, scoped GITHUB_TOKEN, OIDC in place of long-li secrets. |

📋 Compliance (EU / DACH)

| Skill | Summary |
|---|---|
| gdpr-technical-controls | Data in, SAR and deletion endpoints, log scrubbing, 72-hour breach notification. |
| dach-compliance | Impressum, Datenschutzerklärung, AGB, AVV / DPA, TOMs, cookie consent for Germany / Austria / Switzerland. |

🔍 Detection & monitoring

| Skill | Summary |
|---|---|
| log-strategy | What to log and what never to log — operational , retention tiers, alert routing. |
| honeypot-tarpits | Fake admin paths, canary tokens, decoy .env files — high-signal detection without a SIEM. |

🛡️ Incident response

| Skill | Summary |
|---|---|
| incident-response | SANS PICERL runbook for small teams, with a post-mortem template. |

📨 Email security

| Skill | Summary |
|---|---|
| email-deli | SPF / DKIM / DMARC with the p=none → p=quarantine → p=reject migration path. |

📱 Mobile security

| Skill | Summary |
|---|---|
| ios-security | Keychain accessibility tiers, ATS, certificate pinning, file protection, jailbreak detection as signal. |
| android-security | Keystore + StrongBox, exported components, WebView hardening, backup rules, Play Integrity as signal. |

Find the right skill

| Scenario | Where to start |
|---|---|
| Site hacked / webshell found | incident-response → wordpress-hardening |
| Detect a webshell on WordPress | wordpress-hardening |
| Committed a .env to a public repo | secret-hygiene |
| Pre prompt injection in an LLM app | prompt-injection-defense |
| Re LLM-generated code | llm-coding-failure-modes |
| Giving an AI agent write access to production | ai-agent-guardrails |
| Hardening a new Ubuntu VPS | |
| Hardening a Kubernetes cluster | kubernetes-security |
| User uploads disappear on redeploy | backend-architecture |
| Architecting a backend that scales | backend-architecture |
| Zero-downtime deploys | backend-architecture |
| Inherited a codebase, where to start | codebase-audit |
| Auditing a distributed / agent system | distributed-system-audit |
| Fleet of nati on customer machines | agent-client-security |
| Multi-tenant NATS / RabbitMQ / Kafka | message-bus-security |
| Backups exist but ha been restored | backup-disaster-recovery |
| Broken access control / BOLA in an API | api-security |
| Accepting user file uploads safely | file-upload-security |
| Cloudflare WAF / origin-IP protection | cloudflare-hardening |
| Securing a Stripe webhook | stripe-webhook-security |
| Implementing OWASP LLM Top 10 | llm-app-security |
| GitHub Actions OIDC + scoped tokens | github-actions-security |
| DACH Impressum / Datenschutz / AGB | dach-compliance |
| Blocking brute force on /wp-login.php | wordpress-hardening + + cloudflare-hardening |
| Writing a post-mortem after a breach | incident-response |
| Configuring SPF / DKIM / DMARC | email-deli |
| CNAME points at a depro service (subdomain takeover) | dns-domain-security |
| S3 / R2 bucket accidentally public | object-storage-security |
| RAG answers leak documents users shouldn't see | rag-security |
| Shipping an Android app that holds tokens | android-security |

Using with Claude Code

Drop the directory in a path Claude Code scans for skills, or reference the skills directly. Claude matches the YAML description against your request and loads the matching SKILL.md. If you prefer to work without auto-triggering, just cat the relevant SKILL.md and follow it manually.

Contributing

Contributions welcome, especially:

Please keep contributions defensive in spirit. No exploitation tradecraft, no recommendations to weaken existing protections.

License

MIT.

Maintainers

Maintained by GoldenWing. Patterns here are distilled from real cleanup, hardening, and incident-response work. Specific indicators of compromise and customer details have been generalized so the guidance is portable.

项目信息

开发语言：Python

Star 数：19

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕25 production-tested defensive security skills for Claude Code - WordPress, VPS, Cloudflare, Next.js hardening, AI agent guardrails, MCP security, prompt injection defense, OWASP LLM Top 10, LLM coding failure modes (slopsquatting, hallucinated APIs, sycophancy), incident response, GDPR/DACH compliance. MIT, battle-tested.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。