New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Secure By Design

by ooiyeefei in ooiyeefei/ccc

Run an enterprise security review of a system design or existing code before it ships.

MITAuto-check passedSecurity

Install Secure By Design

skills CLI
$ npx skills add ooiyeefei/ccc --skill secure-by-design -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ooiyeefei/ccc secure-by-design --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ooiyeefei/ccc.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/secure-by-design .claude/skills/secure-by-design && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
secure-by-design
GitHub stars
494
Token cost
~1.5k tokens
SKILL.md length
710 words
Files
6 (incl. references)
Skills in repo
22
Repo updated
First seen
Licence
MIT

At a glance

Run an enterprise security review of a system design or existing code before it ships.

  • Works in 5 steps: Classify the assets. List what has… → Map the trust boundaries. Where does… → Select controls per boundary. For each… → …
  • The user says security review
  • SKILL.md covers Leading words (say these), The review (do these in order…, Top-level checklist (does the… and Reference material (load only…
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Secure By Design is an agent skill from ooiyeefei/ccc. Run an enterprise security review of a system design or existing code before it ships. Use when the user says "security review", "secure by design", "threat model this", "is this design secure", "what security controls do we need", "audit this for security", "harden this system", "RBAC design", "review my auth", or "enterprise security checklist". Classifies assets and trust boundaries FIRST, then recommends only the controls that fit — grounded in battle-tested patterns. Right-sizes for team scale (bones now…

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including reference files (for example `README.md`, `references/control-catalog.md` and `references/groot-case-studies.md`).

It sits in Security, covering Secure coding, Security review and Authorization and RBAC. The repository describes itself as: Claude Code Custom Plugins - Custom plugins for Claude Code CLI. The licence is MIT.

When your agent uses it

  • The user says security review
  • Secure by design
  • Threat model this
  • Is this design secure

Example prompts

  • “security review”
  • “secure by design”
  • “threat model this”
  • “/secure-by-design”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Classify the assets. List what has value: customer data (PII, financial), credentials/keys, tenant isolation, admin capability, audit…
  2. Map the trust boundaries. Where does control change hands? Client↔server, tenant↔tenant, staff↔customer, human↔machine (M2M)…
  3. Select controls per boundary. For each boundary, pull the applicable controls from the catalog — see references/control-catalog.md. Apply…
  4. Right-size for scale. A two-person team should build primitives (TTL, eligible-vs-active, request/approve state, append-only audit) now…
  5. Produce the output. A ranked list: control → which asset/boundary it protects → build-now or defer → the one-line reasoning. Flag any…

What it can do on your machine

Read from SKILL.md and the folder at commit c0fd926. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Secure By Design loads about 1.5k tokens when it runs, and up to ~6k if it reads all its reference files. Until then it costs about 170 tokens; SKILL.md has 710 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~170
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ooiyeefei/ccc at commit c0fd926, republished under its MIT licence (© ooiyeefei). 710 words, ~1,545 tokens.

Download SKILL.mdSave it as .claude/skills/secure-by-design/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
secure-by-design
description
Run an enterprise security review of a system design or existing code before it ships. Use when the user says "security review", "secure by design", "threat model this", "is this design secure", "what security controls do we need", "audit this for security", "harden this system", "RBAC design", "review my auth", or "enterprise security checklist". Classifies assets and trust boundaries FIRST, then recommends only the controls that fit — grounded in battle-tested patterns. Right-sizes for team scale (bones now, ceremony later). Do NOT use for writing a specific exploit, penetration-testing a system the user does not own, or general non-security code review.

Secure by design

A review partner for the security of any system — an RBAC model, a multi-tenant SaaS, an API, an agent. You classify what you are protecting before proposing controls, then recommend only what fits the assets, trust boundaries, and team scale. Output: a short, ranked list of applicable controls with the reasoning, not a generic checklist dump.

The leading words below are load-bearing. Use them in your reasoning — they carry the decisions.

Leading words (say these)

  • deny-by-default — an unmapped permission is denied, never allowed.
  • fail-closed — unknown state ⇒ deny; an error path never grants access.
  • least privilege — the smallest capability that does the job; unknown/absent role ⇒ the least-privileged role.
  • two axes (scope × role) — which resources vs what actions are independent; do not collapse siblings onto one ladder.
  • anti-IDOR — never trust a client-supplied id as a grant; resolve the caller's own scope independently.
  • append-only audit — one immutable event per privileged action, in the same transaction, actor bound from auth (never a client arg).
  • eligible-not-active (JIT) — sensitive access is requested → approved → activated → auto-expires; default OFF.
  • four-eyes — critical actions are proposed by one person and executed only after a different person approves (separation of duties: requester ≠ approver).
  • blast radius — how much one compromised credential or mistake can touch; minimize it.
  • data minimization — mask/omit sensitive data below the role that needs it; expose aggregates, not raw PII.
  • deploy-authority separation — only CI holds the deploy key; humans and feature branches cannot deploy.
  • break-glass — a documented, logged, reviewed-after emergency bypass.
  • bones now, ceremony later — build the primitives into the schema early; defer the process overhead.

The review (do these in order — do NOT jump to controls)

Legwork first. The most common failure is proposing controls before understanding what is protected. Complete steps 1–2 fully before step 3.

  1. Classify the assets. List what has value: customer data (PII, financial), credentials/keys, tenant isolation, admin capability, audit integrity, availability. For each, note the worst case if it leaks or is tampered with.

  2. Map the trust boundaries. Where does control change hands? Client↔server, tenant↔tenant, staff↔customer, human↔machine (M2M), app↔infrastructure, CI↔production. Name every boundary; each is where a control belongs. Note the two control planes: the app can enforce approvals on app actions but cannot protect infrastructure actions (deploy, DB migration, cloud console) — those need a separate plane. State this so nobody gets false comfort.

  3. Select controls per boundary. For each boundary, pull the applicable controls from the catalog — see references/control-catalog.md. Apply "least privilege" and "blast radius" as the selection lens. Do not recommend a control that doesn't map to a classified asset + boundary.

  4. Right-size for scale. A two-person team should build primitives (TTL, eligible-vs-active, request/approve state, append-only audit) now and defer ceremony (quarterly reviews, anomaly detection, hash-chaining). See references/right-sizing.md. Say "bones now, ceremony later" and mark each control build-now vs defer.

  5. Produce the output. A ranked list: control → which asset/boundary it protects → build-now or defer → the one-line reasoning. Flag any asset with no covering control as a gap.

Show full SKILL.md (217 more words)Show less

Top-level checklist (does the design have these where applicable?)

  • Authorization is deny-by-default on two axes (scope × role), with least-privilege normalization of unknown roles.
  • Guards fail-closed — unknown/error state denies.
  • Anti-IDOR — the caller's scope is resolved independently; a passed id is never a grant.
  • Reads vs writes are scoped separately where breadth differs — all-scope read need not mean all-scope write.
  • Append-only audit on every privileged action, actor from auth, same transaction.
  • Sensitive standing access is JIT (eligible-not-active) with TTL + justification, not permanent.
  • Critical high-blast-radius actions use four-eyes (requester ≠ approver).
  • Data minimization — sensitive data masked below the role that needs it; aggregates over raw PII.
  • M2M callers go through one keyed, allowlisted, fail-closed door — not scattered public endpoints.
  • Deploy-authority separation — CI-only deploy; no local prod deploy.
  • Infra actions have their own two-person control (protected branches, required reviews) — the app cannot enforce these.
  • Break-glass path is documented and reviewed-after.
  • Access reviews cadence exists (or is deliberately deferred with a note).

Reference material (load only the branch you need)

  • references/control-catalog.md — every control, what it defends, and when it applies.
  • references/groot-case-studies.md — concrete, shipped implementations of each control (real code paths) to copy the shape from.
  • references/threat-model-steps.md — a deeper asset/boundary/attacker walkthrough when the system is large or unfamiliar.
  • references/right-sizing.md — build-now vs defer by team scale; the IAM-grade evolution path for a future resellable product.

© ooiyeefei, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (references) in skills/secure-by-design of ooiyeefei/ccc.

  • SKILL.md
  • README.md
  • references/control-catalog.md
  • references/groot-case-studies.md
  • references/right-sizing.md
  • references/threat-model-steps.md

Open the folder on GitHubat commit c0fd926

Compare with similar skills

Secure By Design next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Secure By Design compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Secure By Design this skillooiyeefei/ccc494—~1.5kAutomated safety check: PassMIT
Security And Hardeningdzhalaevd/Donatello135—~5.1kAutomated safety check: NotesApache-2.0
Strix Code Vulnerability Scanusestrix/strix67k—~1.1kAutomated safety check: PassApache-2.0
Security Audit Scannerruvnet/ruflo74k2 repos~823Automated safety check: PassMIT
Security Review ChecklistZeroDeng01/sublinkPro1.7k—~2.3kAutomated safety check: PassMIT
Codewhale Security Reviewcodewhale-hq/Codewhale41k—~844Automated safety check: PassMIT

Similar skills

  • Security And Hardening

    dzhalaevd/Donatello

    Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.

    135 GitHub stars~5.1k tokensUpdated 5 days ago
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    67k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    SecurityAuto-check passed

  • Security Review Checklist

    ZeroDeng01/sublinkPro

    Checklist-driven security review for changes to authentication, authorization, MFA, secrets, input validation and other security-critical code.

    1.7k GitHub stars~2.3k tokensUpdated today
    SecurityAuto-check passed

  • Codewhale Security Review

    codewhale-hq/Codewhale

    Reviews a diff, module or network surface for exploitable defects, mapping trust boundaries and sinks, then reports only findings with a verified reachable path and a fix.

    41k GitHub stars~844 tokensUpdated today
    SecurityAuto-check passed

  • Cso

    no-session/pstack

    Chief Security Officer mode. An agent skill from no-session/pstack.

    135 GitHub stars~12k tokensUpdated 6 mo ago
    SecurityAuto-check: notes

More from ooiyeefei/ccc

All 22 skills in this repo

  • Scribe Meeting Notes

    ooiyeefei/ccc

    Turns meeting recordings into notes with a chain of custody from audio to claim, auditing transcripts for gaps and low-confidence numbers and names.

    494 GitHub stars~876 tokensUpdated 2 mo ago
    Auto-check passed

  • Motion Video in Remotion

    ooiyeefei/ccc

    Builds marketing and explainer videos in Remotion from rendered scenes, with one real product capture as proof, and cuts them for each platform's formats.

    494 GitHub stars~2.9k tokensUpdated 2 mo ago
    Auto-check passed

  • Product Demo Video Recorder

    ooiyeefei/ccc

    Records a sharp product demo video by driving the real app with a browser agent, from storyboard to Xvfb capture and a narration script synced to the frames.

    494 GitHub stars~2.8k tokensUpdated 2 mo ago
    Auto-check passed

  • Excalidraw Architecture Diagrams

    ooiyeefei/ccc

    Generates architecture diagrams as .excalidraw files by analyzing a codebase, with optional PNG or SVG export through Playwright.

    494 GitHub stars~2k tokensUpdated 2 mo ago
    Auto-check passed

  • Google Analytics 4 Setup

    ooiyeefei/ccc

    Sets up GA4 on a website and wires one real conversion event end to end, verified in DebugView before any money goes into ads.

    494 GitHub stars~2.2k tokensUpdated 2 mo ago
    Auto-check passed

  • Landing Page GTM Copy

    ooiyeefei/ccc

    Builds or rewrites SaaS landing pages by researching the real product, positioning it against alternatives and writing buyer-focused copy, then implementing it in the codebase.

    494 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed

Categories

Questions about Secure By Design

What does Secure By Design do?

Run an enterprise security review of a system design or existing code before it ships. Secure By Design is an agent skill from ooiyeefei/ccc. Run an enterprise security review of a system design or existing code before it ships.

When should I use Secure By Design?

Secure By Design fits situations like: the user says security review; secure by design; threat model this; is this design secure.

How do I install Secure By Design in Claude Code?

Run `npx skills add ooiyeefei/ccc --skill secure-by-design -a claude-code`. Or copy the skill folder (skills/secure-by-design in ooiyeefei/ccc) into .claude/skills/secure-by-design in your project. Claude Code loads it when a task matches its description.

How do I install Secure By Design in Codex?

Run `npx skills add ooiyeefei/ccc --skill secure-by-design -a codex`. Or copy the skill folder (skills/secure-by-design in ooiyeefei/ccc) into .agents/skills/secure-by-design in your project. Codex loads it when a task matches its description.

Can I use Secure By Design in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ooiyeefei/ccc --skill secure-by-design -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/secure-by-design, .gemini/skills/secure-by-design, .github/skills/secure-by-design and .opencode/skills/secure-by-design in your project.

What does Secure By Design need to run?

SKILL.md names no scripts, command-line tools or credentials: Secure By Design is instructions for the agent only.

Does Secure By Design access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Secure By Design safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Secure By Design use?

Secure By Design is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Secure By Design use?

About 1.5k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.5k tokens, read only when the agent opens those files.

What are the alternatives to Secure By Design?

Skills that share tags, products or a category with Secure By Design: Security And Hardening (dzhalaevd/Donatello, 135 stars), Strix Code Vulnerability Scan (usestrix/strix, 67k stars), Security Audit Scanner (ruvnet/ruflo, 74k stars) and Security Review Checklist (ZeroDeng01/sublinkPro, 1.7k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Secure By Design?

ooiyeefei (a GitHub user) maintains it in ooiyeefei/ccc, which has 494 GitHub stars. The repository holds 22 skills in this directory. The repository was last updated on July 29, 2026.

Source: ooiyeefei/ccc on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.