New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security

by parcadei in parcadei/Continuous-Claude-v3

Security audit workflow - vulnerability scan → verification. An agent skill from parcadei/Continuous-Claude-v3.

MITAuto-check passedSecurity

Install Security

skills CLI
$ npx skills add parcadei/Continuous-Claude-v3 --skill security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install parcadei/Continuous-Claude-v3 security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/parcadei/Continuous-Claude-v3.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/security .claude/skills/security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security
GitHub stars
3.9k
Token cost
~1.5k tokens
SKILL.md length
164 words
Files
1
Skills in repo
141
Repo updated
First seen
Licence
MIT

At a glance

Security audit workflow - vulnerability scan → verification. An agent skill from parcadei/Continuous-Claude-v3.

  • Works in 2 steps: Security Audit → Verification (After Fixes)
  • Tasks that involve Security review
  • SKILL.md covers When to Use, Workflow Overview, Agent Sequence and Why Dedicated Security?, plus 5 more sections
  • Needs STRIPE_KEY

What it does

Security is an agent skill from parcadei/Continuous-Claude-v3. Security audit workflow - vulnerability scan → verification

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Security review and Web application vulnerabilities. The repository describes itself as: Context management for Claude Code. Hooks maintain state via ledgers and handoffs. MCP execution without context pollution. Agent orchestration with isolated context windows. The licence is MIT.

When your agent uses it

  • Tasks that involve Security review
  • Tasks that involve Web application vulnerabilities

Example prompts

  • “/security”

Requirements

  • A credential in STRIPE_KEY

Workflow steps

2 steps, taken from the step headings in SKILL.md.

  1. Security Audit
  2. Verification (After Fixes)

What it can do on your machine

Read from SKILL.md and the folder at commit d07ff4b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • STRIPE_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security loads about 1.5k tokens when it runs. Until then it costs about 17 tokens; SKILL.md has 164 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~17
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from parcadei/Continuous-Claude-v3 at commit d07ff4b, republished under its MIT licence (© parcadei). 164 words, ~1,509 tokens.

Download SKILL.mdSave it as .claude/skills/security/SKILL.md (or your agent's skills folder).
name
security
description
Security audit workflow - vulnerability scan → verification

/security - Security Audit Workflow

Dedicated security analysis for sensitive code.

When to Use

  • "Security audit"
  • "Check for vulnerabilities"
  • "Is this secure?"
  • "Review authentication code"
  • "Check for injection attacks"
  • Before handling auth, payments, user data
  • After adding security-sensitive features

Workflow Overview

┌─────────┐    ┌───────────┐
│  aegis  │───▶│ arbiter  │
│         │    │           │
└─────────┘    └───────────┘
  Security       Verify
  audit          fixes

Agent Sequence

#AgentRoleOutput
1aegisComprehensive security scanVulnerability report
2arbiterVerify fixes, run security testsVerification report

Why Dedicated Security?

The /review workflow focuses on code quality. Security needs:

  • Specialized vulnerability patterns
  • Dependency scanning
  • Secret detection
  • OWASP Top 10 checks
  • Authentication/authorization review

Execution

Phase 1: Security Audit
Task(
  subagent_type="aegis",
  prompt="""
  Security audit: [SCOPE]

  Scan for:

  **Injection Attacks:**
  - SQL injection
  - Command injection
  - XSS (Cross-Site Scripting)
  - LDAP injection

  **Authentication/Authorization:**
  - Broken authentication
  - Session management issues
  - Privilege escalation
  - Insecure direct object references

  **Data Protection:**
  - Sensitive data exposure
  - Hardcoded secrets/credentials
  - Insecure cryptography
  - Missing encryption

  **Configuration:**
  - Security misconfigurations
  - Default credentials
  - Verbose error messages
  - Missing security headers

  **Dependencies:**
  - Known vulnerable packages
  - Outdated dependencies
  - Supply chain risks

  Output: Detailed report with:
  - Severity (CRITICAL/HIGH/MEDIUM/LOW)
  - Location (file:line)
  - Description
  - Remediation steps
  """
)
Phase 2: Verification (After Fixes)
Task(
  subagent_type="arbiter",
  prompt="""
  Verify security fixes: [SCOPE]

  Run:
  - Security-focused tests
  - Dependency audit (npm audit, pip audit)
  - Re-check reported vulnerabilities
  - Verify fixes don't introduce regressions

  Output: Verification report
  """
)

Security Scopes

Full Codebase
User: /security
→ Scan entire codebase
Specific Area
User: /security authentication
→ Focus on auth-related code
Single File
User: /security src/api/auth.py
→ Deep dive on one file
Dependencies Only
User: /security --deps
→ Only dependency vulnerabilities

Example

User: /security the payment processing code

Claude: Starting /security audit for payment code...

Phase 1: Security audit...
[Spawns aegis]

┌─────────────────────────────────────────────────────────────┐
│ Security Audit Report                                       │
├─────────────────────────────────────────────────────────────┤
│ Scope: src/services/payment/                                │
│ Files scanned: 12                                           │
│ Lines analyzed: 2,847                                       │
├─────────────────────────────────────────────────────────────┤
│ CRITICAL (1)                                                │
│ ──────────                                                  │
│ [C1] SQL Injection in payment.py:89                         │
│      query = f"SELECT * FROM orders WHERE id = {order_id}"  │
│      Fix: Use parameterized queries                         │
│                                                             │
│ HIGH (2)                                                    │
│ ────────                                                    │
│ [H1] Hardcoded API key in stripe_client.py:12               │
│      STRIPE_KEY = "sk_live_..."                             │
│      Fix: Move to environment variable                      │
│                                                             │
│ [H2] Missing input validation in refund.py:45               │
│      amount = request.json['amount']  # No validation       │
│      Fix: Validate amount is positive number                │
│                                                             │
│ MEDIUM (1)                                                  │
│ ──────────                                                  │
│ [M1] Verbose error messages in error_handler.py:23          │
│      return {"error": str(e)}  # Leaks internal details     │
│      Fix: Return generic message, log details internally    │
│                                                             │
│ LOW (0)                                                     │
│ ───────                                                     │
│ None                                                        │
├─────────────────────────────────────────────────────────────┤
│ Summary: 1 critical, 2 high, 1 medium, 0 low                │
│ Status: BLOCKING - Fix critical issues before release       │
└─────────────────────────────────────────────────────────────┘

Fix the critical and high issues, then run:
/security --verify
After Fixes
User: /security --verify

Claude: Phase 2: Verifying fixes...
[Spawns arbiter]

✅ C1: SQL injection fixed - using parameterized queries
✅ H1: API key moved to environment variable
✅ H2: Input validation added
✅ M1: Error messages sanitized

All security tests passing.
Security audit: PASSED

OWASP Top 10 Coverage

RiskChecked
A01 Broken Access Control✅
A02 Cryptographic Failures✅
A03 Injection✅
A04 Insecure Design✅
A05 Security Misconfiguration✅
A06 Vulnerable Components✅
A07 Auth Failures✅
A08 Data Integrity Failures✅
A09 Logging Failures✅
A10 SSRF✅

Flags

  • --deps: Dependencies only
  • --verify: Re-run after fixes
  • --owasp: Explicit OWASP Top 10 report
  • --secrets: Focus on secret detection

© parcadei, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/security of parcadei/Continuous-Claude-v3.

Open the folder on GitHubat commit d07ff4b

Compare with similar skills

Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security this skillparcadei/Continuous-Claude-v33.9k—~1.5kAutomated safety check: PassMIT
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Reviewjewbetcha/opentrace11617 repos~3.1kAutomated safety check: NotesMIT
Strix Code Vulnerability Scanusestrix/strix67k—~1.1kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8931 repos~2.7kAutomated safety check: PassNone
Wooyun Legacytanweai/wooyun-legacy1.8k—~1.9kAutomated safety check: PassCustom licence

Similar skills

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

  • Security Review

    jewbetcha/opentrace

    A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

    116 GitHub starsUsed in 17 repos~3.1k tokens
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    67k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    893 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Wooyun Legacy

    tanweai/wooyun-legacy

    WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

    1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    SecurityAuto-check passed

More from parcadei/Continuous-Claude-v3

All 141 skills in this repo

  • Tldr Deep

    parcadei/Continuous-Claude-v3

    Full 5-layer analysis of a specific function. An agent skill from parcadei/Continuous-Claude-v3.

    3.9k GitHub starsUsed in 2 repos~677 tokens
    Auto-check passed

  • Compound Learnings

    parcadei/Continuous-Claude-v3

    Transform session learnings into permanent capabilities (skills, rules, agents).

    3.9k GitHub starsUsed in 1 repo~1.6k tokens
    Auto-check: notes

  • Gradient Methods

    parcadei/Continuous-Claude-v3

    Problem-solving strategies for gradient methods in optimization

    3.9k GitHub starsUsed in 3 repos~1k tokens
    Auto-check: notes

  • Debug Hooks

    parcadei/Continuous-Claude-v3

    Systematic hook debugging workflow. An agent skill from parcadei/Continuous-Claude-v3.

    3.9k GitHub starsUsed in 1 repo~863 tokens
    Auto-check: notes

  • Math

    parcadei/Continuous-Claude-v3

    Unified math capabilities - computation, solving, and explanation.

    3.9k GitHub starsUsed in 3 repos~1.6k tokens
    Auto-check: notes

  • Math Model Selector

    parcadei/Continuous-Claude-v3

    Routes problems to appropriate mathematical frameworks using expert heuristics

    3.9k GitHub starsUsed in 3 repos~841 tokens
    Auto-check passed

Categories

Questions about Security

What does Security do?

Security audit workflow - vulnerability scan → verification. An agent skill from parcadei/Continuous-Claude-v3. Security is an agent skill from parcadei/Continuous-Claude-v3.

When should I use Security?

Security fits situations like: tasks that involve Security review; tasks that involve Web application vulnerabilities.

How do I install Security in Claude Code?

Run `npx skills add parcadei/Continuous-Claude-v3 --skill security -a claude-code`. Or copy the skill folder (.claude/skills/security in parcadei/Continuous-Claude-v3) into .claude/skills/security in your project. Claude Code loads it when a task matches its description.

How do I install Security in Codex?

Run `npx skills add parcadei/Continuous-Claude-v3 --skill security -a codex`. Or copy the skill folder (.claude/skills/security in parcadei/Continuous-Claude-v3) into .agents/skills/security in your project. Codex loads it when a task matches its description.

Can I use Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add parcadei/Continuous-Claude-v3 --skill security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security, .gemini/skills/security, .github/skills/security and .opencode/skills/security in your project.

What does Security need to run?

Going by SKILL.md and its folder, Security needs credentials named STRIPE_KEY. Our summary lists: A credential in STRIPE_KEY.

Does Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security use?

Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security?

Skills that share tags, products or a category with Security: Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars), Strix Code Vulnerability Scan (usestrix/strix, 67k stars) and Code Audit (3stoneBrother/code-audit, 893 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security?

parcadei (a GitHub user) maintains it in parcadei/Continuous-Claude-v3, which has 3,940 GitHub stars. The repository holds 141 skills in this directory. The repository was last updated on January 26, 2026.

Source: parcadei/Continuous-Claude-v3 on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.