New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Checklist

by c0x12c in c0x12c/ai-toolkit

Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention.

No licenceAuto-check: notesSecurity

Install Security Checklist

skills CLI
$ npx skills add c0x12c/ai-toolkit --skill security-checklist -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install c0x12c/ai-toolkit security-checklist --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/c0x12c/ai-toolkit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.codex/skills/security-checklist .claude/skills/security-checklist && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-checklist
GitHub stars
106
Token cost
~672 tokens
SKILL.md length
314 words
Files
2
Skills in repo
33
Repo updated
First seen
Licence
None found

At a glance

Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention.

  • Works in 7 steps: Check Authentication — every controller… → Check Authorization — verify user has… → Check Input Validation — @Valid on… → …
  • Implementing auth
  • SKILL.md covers When to Use, Process, Interaction Style and Rules, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Security Checklist is an agent skill from c0x12c/ai-toolkit. Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention. Use when implementing auth, validating inputs, or reviewing security.

Its SKILL.md is about 670 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `audit-reference.md`).

It sits in Security, covering Security review, Web application vulnerabilities and Android development. It works with Kotlin.

When your agent uses it

  • Implementing auth
  • Validating inputs
  • Reviewing security

Example prompts

  • “/security-checklist”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Check Authentication — every controller has @Secured, current user comes from security context
  2. Check Authorization — verify user has access to the resource before returning it
  3. Check Input Validation — @Valid on controller params, Jakarta annotations on request DTOs
  4. Check SQL Injection Prevention — use Exposed ORM (auto-parameterized), never raw SQL with string concat
  5. Check Common Vulnerabilities — SQL injection, XSS, CSRF, auth bypass, IDOR, mass assignment, data exposure, rate limiting
  6. Check Secrets Management — no hardcoded secrets, use env vars, never log tokens/passwords/PII, never commit .env
  7. Check Response Sanitization — response DTOs control what's exposed, never return raw entities

What it can do on your machine

Read from SKILL.md and the folder at commit 96b2c9d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Checklist loads about 672 tokens when it runs. Until then it costs about 56 tokens; SKILL.md has 314 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~56
When it runs · the whole SKILL.md, loaded when a task matches
~672

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:31
    r log tokens/passwords/PII, never commit .env

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 314 words (~672 tokens).

“Run a security audit against Micronaut/Kotlin backend code.”

— opening of SKILL.md by c0x12c
name
security-checklist

Read the full SKILL.md on GitHub

Files

SKILL.md and 1 other file in .codex/skills/security-checklist of c0x12c/ai-toolkit.

  • SKILL.md
  • audit-reference.md

Open the folder on GitHubat commit 96b2c9d

Compare with similar skills

Security Checklist next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Checklist compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Checklist this skillc0x12c/ai-toolkit106—~672Automated safety check: NotesNone
Security Reviewlangfuse/langfuse36k—~1.4kAutomated safety check: PassCustom licence
Security Auditjellydn/my-ai-tools123—~2.9kAutomated safety check: NotesMIT
Security Reviewgithub/awesome-copilot40k1 repos~2.3kAutomated safety check: NotesMIT
Security Reviewtrycompai/comp2k—~853Automated safety check: PassAGPL-3.0
Java Audit SkillLeoYeAI/openclaw-master-skills2.2k—~3.1kAutomated safety check: PassMIT

Similar skills

  • Security Review

    langfuse/langfuse

    Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy.

    36k GitHub stars~1.4k tokensUpdated yesterday
    SecurityAuto-check passed

  • Security Audit

    jellydn/my-ai-tools

    A skill your agent uses when reviewing code for security vulnerabilities, hardening an application, or deriving security requirements from OWASP/ASVS guidance.

    123 GitHub stars~2.9k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Review

    github/awesome-copilot

    Official

    AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

    40k GitHub starsUsed in 1 repo~2.3k tokens
    SecurityAuto-check: notes

  • Security Review

    trycompai/comp

    Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…

    2k GitHub stars~853 tokensUpdated yesterday
    SecurityAuto-check passed

  • Java Audit Skill

    LeoYeAI/openclaw-master-skills

    AI驱动的Java代码安全审计技能，实现系统化、高覆盖率的漏洞挖掘。使用场景： (1) 审计Java/Kotlin项目寻找安全漏洞（0day挖掘、代码审计、安全评估） (2) 企业级代码库的安全审计（支持大型项目） (3) 需要高质量、低幻觉率的安全审计报告 (4) CI/CD集成的前期漏洞发现 触发关键词：Java审计、代码审计、安全审计、漏洞挖掘、0day、安全评估、Java…

    2.2k GitHub stars~3.1k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Security Audit

    PostHog/posthog

    Official

    Focused security audit of code, calibrated to surface real exploitable bugs and suppress theoretical findings.

    40k GitHub stars~8k tokensUpdated yesterday
    SecurityAuto-check: warnings

More from c0x12c/ai-toolkit

All 33 skills in this repo

  • UI UX Pro Max

    c0x12c/ai-toolkit

    UI/UX design intelligence with searchable style, palette, typography, and chart databases.

    106 GitHub stars~2.1k tokensUpdated 3 mo ago
    Auto-check passed

  • API Endpoint Creator

    c0x12c/ai-toolkit

    Creates RPC-style endpoint following layered architecture (Controller → Manager → Repository).

    106 GitHub stars~3.3k tokensUpdated 3 mo ago
    Auto-check passed

  • Backend API Design

    c0x12c/ai-toolkit

    Design RPC-style APIs with layered architecture (Controller → Manager → Repository).

    106 GitHub stars~814 tokensUpdated 3 mo ago
    Auto-check passed

  • CI CD Patterns

    c0x12c/ai-toolkit

    CI/CD pipeline patterns for GitHub Actions, PR automation, and deployment workflows.

    106 GitHub stars~833 tokensUpdated 3 mo ago
    Auto-check passed

  • Content Engine

    c0x12c/ai-toolkit

    Turn one idea into platform-native content for X, LinkedIn, TikTok, YouTube, newsletters.

    106 GitHub stars~986 tokensUpdated 3 mo ago
    Auto-check passed

  • Database Table Creator

    c0x12c/ai-toolkit

    Creates database table with full Kotlin synchronization (SQL migration → Table → Entity → Repository → Tests).

    106 GitHub stars~1.1k tokensUpdated 3 mo ago
    Auto-check passed

Works with

Categories

Questions about Security Checklist

What does Security Checklist do?

Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention. Security Checklist is an agent skill from c0x12c/ai-toolkit. Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention.

When should I use Security Checklist?

Security Checklist fits situations like: implementing auth; validating inputs; reviewing security.

How do I install Security Checklist in Claude Code?

Run `npx skills add c0x12c/ai-toolkit --skill security-checklist -a claude-code`. Or copy the skill folder (.codex/skills/security-checklist in c0x12c/ai-toolkit) into .claude/skills/security-checklist in your project. Claude Code loads it when a task matches its description.

How do I install Security Checklist in Codex?

Run `npx skills add c0x12c/ai-toolkit --skill security-checklist -a codex`. Or copy the skill folder (.codex/skills/security-checklist in c0x12c/ai-toolkit) into .agents/skills/security-checklist in your project. Codex loads it when a task matches its description.

Can I use Security Checklist in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add c0x12c/ai-toolkit --skill security-checklist -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-checklist, .gemini/skills/security-checklist, .github/skills/security-checklist and .opencode/skills/security-checklist in your project.

What does Security Checklist need to run?

SKILL.md names no scripts, command-line tools or credentials: Security Checklist is instructions for the agent only.

Does Security Checklist access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security Checklist safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Security Checklist use?

No licence was found for Security Checklist or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Security Checklist use?

About 672 tokens (SKILL.md is roughly 2.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Checklist?

Skills that share tags, products or a category with Security Checklist: Security Review (langfuse/langfuse, 36k stars), Security Audit (jellydn/my-ai-tools, 123 stars), Security Review (github/awesome-copilot, 40k stars) and Security Review (trycompai/comp, 2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Checklist?

c0x12c (a GitHub organization) maintains it in c0x12c/ai-toolkit, which has 106 GitHub stars. The repository holds 33 skills in this directory. The repository was last updated on June 18, 2026.

Source: c0x12c/ai-toolkit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.