Secure Code Guardian
Guides an agent to write auth, input validation, and OWASP-aligned security code
- Repository
- Jeffallan/claude-skills
- Stars
- 12,176
- Licence
- MIT
- Files
- 6 files
What it does
When installed, the agent follows a security-focused workflow whenever you build login, permissions, input handling, or web security settings. It applies defaults such as bcrypt or argon2 password hashing, parameterized SQL queries, Zod input validation, JWT checks with an explicit algorithm allowlist, rate limiting on login, and headers like CSP and HSTS. It also gives example code and a checklist of tests to run afterward, such as SQL injection and XSS payload checks.
Great for
- Developers building login, sessions, or JWT-based APIs who want secure defaults
- Teams adding input validation or hardening an Express/Node.js app against OWASP Top 10 issues
- Reviewers who want a checklist of what to test after implementing security controls
Skip it if
- Production security sign-off or formal audits: the skill is guidance and examples, not a scanner, and its own description points to other skills for standalone audits
- Pre-built OAuth/SSO integrations: the description says to use a more specialized skill for these
- Non-Node.js stacks: the code examples are TypeScript/Express-focused, so the agent must adapt them, which may introduce mistakes
Try asking
- “Implement secure password hashing and login for my Express app”
- “Add Zod validation and parameterized queries to my user signup endpoint”
- “Set up JWT issuance and verification with short-lived tokens in httpOnly cookies”
- “Review my API's security headers, CORS config, and rate limiting”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 6 original files, the MIT licence and an attribution note.
secure-code-guardian.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip secure-code-guardian.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip secure-code-guardian.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Name your stack and framework up front (e.g., Express + Postgres) so the agent adapts the examples correctly rather than copying them blindly
- Ask the agent to run the listed validation checkpoints against your code, and actually execute the tests rather than just reading them
- Treat generated auth code as a starting point and have a security-literate person review it before production use
What's inside
- references/authentication.md
- references/input-validation.md
- references/owasp-prevention.md
- references/security-headers.md
- references/xss-csrf.md
- SKILL.md
Redistributed unmodified from Jeffallan/claude-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.