New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security

by gridaco in gridaco/grida

How to handle GRIDA-SEC-<id security boundaries in the Grida repo.

Apache-2.0Auto-check passedSecurity

Install Security

skills CLI
$ npx skills add gridaco/grida --skill security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install gridaco/grida security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/gridaco/grida.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/security .claude/skills/security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security
GitHub stars
2.7k
Token cost
~1.3k tokens
SKILL.md length
680 words
Files
1
Skills in repo
29
Repo updated
First seen
Licence
Apache-2.0

At a glance

How to handle GRIDA-SEC-<id security boundaries in the Grida repo.

  • Works in 3 steps: Read the entry in /SECURITY.md for that… → Run grep -rn GRIDA-SEC- . to find every… → Don't remove a tag without removing the…
  • You encounter a GRIDA-SEC tag in source/docs
  • SKILL.md covers What GRIDA-SEC- means, Working with tagged code, Mandatory security review… and Adding a new GRIDA-SEC id, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Security is an agent skill from gridaco/grida. How to handle GRIDA-SEC-<id security boundaries in the Grida repo. Triggers when you encounter a GRIDA-SEC tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each GRIDA-SEC-<id identifies a structural trust boundary documented in /SECURITY.md. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Security review. The licence is Apache-2.0.

When your agent uses it

  • You encounter a GRIDA-SEC tag in source/docs
  • Modifying files under any tagged path
  • Adding a new prevented- vulnerability record
  • GRIDA-SEC appears in context

Example prompts

  • “GRIDA-SEC”
  • “/security”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Read the entry in /SECURITY.md for that id. Don't act on the
  2. Run grep -rn GRIDA-SEC- . to find every other file in the
  3. Don't remove a tag without removing the entry from /SECURITY.md

What it can do on your machine

Read from SKILL.md and the folder at commit 165496f. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security loads about 1.3k tokens when it runs. Until then it costs about 129 tokens; SKILL.md has 680 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~129
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from gridaco/grida at commit 165496f, republished under its Apache-2.0 licence (© gridaco). 680 words, ~1,292 tokens.

Download SKILL.mdSave it as .claude/skills/security/SKILL.md (or your agent's skills folder).
name
security
description
How to handle `GRIDA-SEC-<id>` security boundaries in the Grida repo. Triggers when you encounter a `GRIDA-SEC` tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each `GRIDA-SEC-<id>` identifies a structural trust boundary documented in `/SECURITY.md`. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.

Security boundaries — GRIDA-SEC

What GRIDA-SEC-<id> means

Each GRIDA-SEC-<id> is a prevented vulnerability — a class of attack that would exist by default but the codebase structurally forecloses. Unlike a CVE (which describes something that was broken), a GRIDA-SEC id is a contract: this specific class of attack is impossible because of these specific files, and we keep it that way.

/SECURITY.md is the canonical registry. Every id has a section there with:

  • What it protects — the boundary in plain English.
  • Vulnerable scenario — the attack that would exist without the boundary.
  • How the code prevents it — the enforcement mechanism, file by file.
  • Files bound by this id — the exact files whose contents make up the contract.

Working with tagged code

When you see GRIDA-SEC-<id> in a file you're touching:

  1. Read the entry in /SECURITY.md for that id. Don't act on the tag alone — the rules are spelled out there.
  2. Run grep -rn GRIDA-SEC-<id> . to find every other file in the contract. Changes that look local often aren't — a tagged file is load-bearing for the boundary.
  3. Don't remove a tag without removing the entry from /SECURITY.md in the same change, with a written justification.

Mandatory security review before commit

If your change touches any file containing a GRIDA-SEC-<id> tag, you must complete a security review before committing. The review is brief but explicit:

  1. Re-read the entry in /SECURITY.md for every GRIDA-SEC-<id> that appears in your diff. Confirm the prevented scenario is still prevented after your change.
  2. Walk the enforcement mechanism. For each numbered "How the code prevents it" step in the entry, point at the line in your diff (or confirm it's untouched) that satisfies that step.
  3. Verify all tagged files are still tagged. A rename, refactor, or move that drops the tag is a contract violation, even if behavior looks identical.
  4. If you added or removed a file from the boundary, update the "Files bound by this id" list in /SECURITY.md in the same commit.
  5. Run any tests adjacent to the boundary. The SECURITY.md entry for the id may list specific tests; use grep -rn GRIDA-SEC-<id> --include='*test*' --include='*spec*' to find any others.

For database-backed boundaries, follow the canonical RPC role contract. Trace public entry points through their role privileges and tenant policies; a private inner schema or a service-role grant comment does not prove that callers are denied.

If you cannot satisfy steps 1–4, do not commit. Either revert the change, or explicitly amend the SECURITY.md entry to reflect a deliberate update of the contract — and surface that to the user.

Show full SKILL.md (253 more words)Show less

Adding a new GRIDA-SEC id

When you introduce a new structural prevention worth tracking:

  1. Allocate the next sequential id. Look at /SECURITY.md, find the highest existing GRIDA-SEC-NNN, use NNN+1. Don't reuse retired ids; don't renumber.
  2. Write the entry in /SECURITY.md under "Active boundaries". Use the same four-section shape as existing ids: What it protects / Vulnerable scenario / How the code prevents it / Files bound.
  3. Tag every relevant file. Header comment in source files, callout block in READMEs, comment in scripts. Use the literal string GRIDA-SEC-NNN. Brief inline tags at specific code locations are fine too (e.g. // GRIDA-SEC-NNN: rule 2 — fail closed).
  4. Verify the grep works. grep -rn GRIDA-SEC-NNN . should return the entry in /SECURITY.md plus every tagged file.

This skill auto-loads on any "GRIDA-SEC" mention via its description. You don't need to register a new id with the skill.

When NOT to use this convention

  • Implementation bugs that were once exploitable. Those are CVE territory. GRIDA-SEC is for prevented-by-structure classes — if a bug happened, write a postmortem, not a GRIDA-SEC.
  • Generic best practices (input validation, authn/authz on user routes, etc.). Those are baseline and don't need an id. Reserve GRIDA-SEC for specific structural decisions where misunderstanding the design would re-open a class of attack.
  • Per-feature security notes that aren't structural contracts. Those go in the feature's own docs.

A good test: if you can reasonably write "this attack class is impossible because…" in one paragraph and grep returns ≥2 files that together make it true, it's a candidate for GRIDA-SEC.

© gridaco, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/security of gridaco/grida.

Open the folder on GitHubat commit 165496f

Compare with similar skills

Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security this skillgridaco/grida2.7k—~1.3kAutomated safety check: PassApache-2.0
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
Native Dependency Updatemono/SkiaSharp5.6k—~4.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
Skillward AuditFangcun-AI/SkillWard143—~2.9kAutomated safety check: PassCustom licence

Similar skills

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 8 days ago
    SecurityAuto-check passed

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated 6 days ago
    SecurityAuto-check: notes

  • Native Dependency Update

    mono/SkiaSharp

    Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

    5.6k GitHub stars~4.1k tokensUpdated today
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated 5 days ago
    SecurityAuto-check: notes

  • Skillward Audit

    Fangcun-AI/SkillWard

    Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.

    143 GitHub stars~2.9k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Security Audit

    TheDecipherist/claude-code-mastery

    Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

    550 GitHub stars~1.3k tokensUpdated 5 mo ago
    SecurityAuto-check: notes

More from gridaco/grida

All 29 skills in this repo

  • Desktop

    gridaco/grida

    Grida Desktop Electron shell and release-impact work: BrowserWindow, preload, window.grida, menus, protocol/deep links, file associations, Forge, path-scoped bridge security, Electron-only UI bugs…

    2.7k GitHub stars~3.2k tokensUpdated yesterday
    Auto-check: notes

  • Io Figma

    gridaco/grida

    Guides work on the Figma I/O package (@grida/io-figma, packages/grida-canvas-io-figma/).

    2.7k GitHub stars~2.2k tokensUpdated yesterday
    Auto-check: notes

  • Opt Library

    gridaco/grida

    Set up, download, verify, and seed the optional Grida Library developer corpus into local Supabase.

    2.7k GitHub stars~1.4k tokensUpdated yesterday
    Auto-check passed

  • Vision

    gridaco/grida

    Query images with a local Ollama vision model without loading the image into the main agent context.

    2.7k GitHub stars~1.5k tokensUpdated yesterday
    Auto-check passed

  • AI Models

    gridaco/grida

    Research, compare, and update shared AI model JSON for TypeScript, web, and Rust consumers.

    2.7k GitHub stars~5.7k tokensUpdated yesterday
    Auto-check passed

  • Agent System

    gridaco/grida

    Grida AI agent system work: @grida/daemon (DaemonServer, loopback HTTP perimeter, files/workspaces, secrets store, daemon discovery) and @grida/agent (the agent tenant: sessions, providers/BYOK…

    2.7k GitHub stars~3.4k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Security

What does Security do?

How to handle GRIDA-SEC-<id security boundaries in the Grida repo. Security is an agent skill from gridaco/grida. How to handle GRIDA-SEC-<id security boundaries in the Grida repo.

When should I use Security?

Security fits situations like: you encounter a GRIDA-SEC tag in source/docs; modifying files under any tagged path; adding a new prevented- vulnerability record; GRIDA-SEC appears in context.

How do I install Security in Claude Code?

Run `npx skills add gridaco/grida --skill security -a claude-code`. Or copy the skill folder (.agents/skills/security in gridaco/grida) into .claude/skills/security in your project. Claude Code loads it when a task matches its description.

How do I install Security in Codex?

Run `npx skills add gridaco/grida --skill security -a codex`. Or copy the skill folder (.agents/skills/security in gridaco/grida) into .agents/skills/security in your project. Codex loads it when a task matches its description.

Can I use Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add gridaco/grida --skill security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security, .gemini/skills/security, .github/skills/security and .opencode/skills/security in your project.

What does Security need to run?

SKILL.md names no scripts, command-line tools or credentials: Security is instructions for the agent only.

Does Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security use?

Security is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security use?

About 1.3k tokens (SKILL.md is roughly 5.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security?

Skills that share tags, products or a category with Security: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Native Dependency Update (mono/SkiaSharp, 5.6k stars) and Semgrep Security Scan (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security?

gridaco (a GitHub organization) maintains it in gridaco/grida, which has 2,657 GitHub stars. The repository holds 29 skills in this directory. The repository was last updated on October 6, 2026.

Source: gridaco/grida on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.