Security Review
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.
Install Discover Security
$ npx skills add rand/cc-polymath --skill discover-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install rand/cc-polymath discover-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/discover-security .claude/skills/discover-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .claude/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/rand/cc-polymath/tree/main/skills/discover-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add rand/cc-polymath --skill discover-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install rand/cc-polymath discover-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/discover-security .agents/skills/discover-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .agents/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add rand/cc-polymath --skill discover-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install rand/cc-polymath discover-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/discover-security .cursor/skills/discover-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .cursor/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/rand/cc-polymath.git --path skills/discover-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add rand/cc-polymath --skill discover-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install rand/cc-polymath discover-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/discover-security .gemini/skills/discover-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .gemini/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install rand/cc-polymath discover-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add rand/cc-polymath --skill discover-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/discover-security .github/skills/discover-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .github/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add rand/cc-polymath --skill discover-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install rand/cc-polymath discover-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/rand/cc-polymath.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/discover-security .opencode/skills/discover-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "discover-security" agent skill from https://github.com/rand/cc-polymath/tree/main/skills/discover-security into .opencode/skills/discover-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "discover-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
discover-security- GitHub stars
- 181
- Token cost
- ~1.9k tokens
- SKILL.md length
- 730 words
- Files
- 1
- Skills in repo
- 26
- Repo updated
- First seen
- Licence
- MIT
At a glance
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.
- Works in 3 steps: Identity and access → Input protection → Operations
- Tasks that involve Web application vulnerabilities
- SKILL.md covers When This Skill Activates, Available Skills, Common Workflows and Skill Selection Guide, plus 4 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Discover Security is an agent skill from rand/cc-polymath. Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Designed for Claude Code. Compatible with any agent supporting the Agent Skills format.
It sits in Security, covering Web application vulnerabilities, Vulnerability scanning and Authorization and RBAC. The repository describes itself as: Claude Code skills and workflows, optimized for context-efficiency and skill quality. Skills ranging from cloud infrastructure to design to advanced maths. The licence is MIT.
When your agent uses it
- Tasks that involve Web application vulnerabilities
- Tasks that involve Vulnerability scanning
- Tasks that involve Authorization and RBAC
Example prompts
- “/discover-security”
Requirements
- Compatibility (from SKILL.md): Designed for Claude Code. Compatible with any agent supporting the Agent Skills format.
Workflow steps
3 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit baa2df1. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Designed for Claude Code. Compatible with any agent supporting the Agent Skills format.
From compatibility in the SKILL.md frontmatter.
Context cost
Discover Security loads about 1.9k tokens when it runs. Until then it costs about 66 tokens; SKILL.md has 730 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from rand/cc-polymath at commit baa2df1, republished under its MIT licence (© rand). 730 words, ~1,926 tokens.
Download SKILL.mdSave it as
.claude/skills/discover-security/SKILL.md (or your agent's skills folder).- name
- discover-security
- description
- Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
- compatibility
- Designed for Claude Code. Compatible with any agent supporting the Agent Skills format.
- license
- MIT
- metadata.author
- rand
- metadata.version
- 4.0
Security Skills Discovery
Provides automatic access to comprehensive application security, vulnerability assessment, and security best practices skills.
When This Skill Activates
This skill auto-activates when you're working with:
- Authentication and authorization systems
- Input validation and sanitization
- Security headers (CSP, HSTS, CORS)
- Vulnerability scanning and penetration testing
- OWASP Top 10 vulnerabilities
- Secrets management (Vault, AWS Secrets Manager)
- SQL injection, XSS, or other attack prevention
- Security hardening and compliance
- Password hashing and credential management
- API security and access control
Available Skills
Quick Reference
The Security category contains 6 specialized skills:
- authentication - Authentication patterns (JWT, OAuth2, sessions, MFA, password security)
- authorization - Access control (RBAC, ABAC, policy engines, permissions)
- input-validation - Input validation and sanitization (SQL injection, XSS, command injection)
- security-headers - HTTP security headers (CSP, HSTS, X-Frame-Options, CORS)
- vulnerability-assessment - Security testing (OWASP Top 10, scanning tools, pentesting)
- secrets-management - Secrets handling (Vault, AWS Secrets Manager, key rotation)
Load Full Category Details
For complete descriptions and workflows:
Read ../security/INDEX.md
This loads the full Security category index with:
- Detailed skill descriptions
- Usage triggers for each skill
- Common workflow combinations
- Cross-references to related skills
Load Specific Skills
Load individual skills as needed:
Identity and access
Read ../security/authentication.md Read ../security/authorization.md
Input security
Read ../security/input-validation.md Read ../security/security-headers.md
Security operations
Read ../security/vulnerability-assessment.md Read ../security/secrets-management.md
Common Workflows
Secure Web Application
Sequence: Authentication → Authorization → Input validation → Security headers
Read ../security/authentication.md # User login Read ../security/authorization.md # Access control Read ../security/input-validation.md # XSS/SQL injection prevention Read ../security/security-headers.md # Browser protection
Security Audit
Sequence: Vulnerability assessment → Input validation → Headers → Secrets
Read ../security/vulnerability-assessment.md # OWASP Top 10 testing Read ../security/input-validation.md # Injection testing Read ../security/security-headers.md # Header configuration Read ../security/secrets-management.md # Credential security
API Security
Sequence: Authentication → Authorization → Input validation → Secrets
Read ../security/authentication.md # JWT/OAuth2 Read ../security/authorization.md # API access control Read ../security/input-validation.md # Request validation Read ../security/secrets-management.md # API key management
DevSecOps Pipeline
Sequence: Vulnerability assessment → Secrets → Input validation
Read ../security/vulnerability-assessment.md # Security scanning Read ../security/secrets-management.md # CI/CD secrets Read ../security/input-validation.md # SAST validation
Secure New Application
Full security implementation from scratch:
1. Identity and access
Read ../security/authentication.md Read ../security/authorization.md
2. Input protection
Read ../security/input-validation.md Read ../security/security-headers.md
3. Operations
Read ../security/secrets-management.md Read ../security/vulnerability-assessment.md
Skill Selection Guide
Choose Authentication when:
- Implementing user login systems
- Working with JWT, OAuth2, or sessions
- Adding multi-factor authentication
- Managing passwords and credentials
Choose Authorization when:
- Implementing access control
- Building role-based permissions (RBAC)
- Working with policy engines (OPA, Casbin)
- Preventing privilege escalation
Choose Input Validation when:
- Processing user input
- Preventing SQL injection
- Protecting against XSS attacks
- Validating file uploads
- Preventing command injection
Choose Security Headers when:
- Configuring Content Security Policy (CSP)
- Implementing HTTPS enforcement (HSTS)
- Setting up CORS for APIs
- Preventing clickjacking
- Hardening web applications
Choose Vulnerability Assessment when:
- Testing for OWASP Top 10
- Running security scans (SAST/DAST)
- Performing penetration tests
- Auditing application security
- Setting up security CI/CD
Choose Secrets Management when:
- Storing API keys or credentials
- Integrating with HashiCorp Vault
- Using AWS Secrets Manager or GCP Secret Manager
- Rotating encryption keys
- Managing CI/CD secrets
Show full SKILL.md (257 more words)Show less
Integration with Other Skills
Security skills commonly combine with:
API skills (discover-api):
- API authentication and authorization
- API input validation
- API rate limiting (abuse prevention)
- Securing REST and GraphQL endpoints
Database skills (discover-database):
- SQL injection prevention
- Database connection security
- Credential management
- Row-level security
Frontend skills (discover-frontend):
- XSS prevention in React/Vue
- Content Security Policy
- Secure cookie handling
- Client-side validation
Infrastructure skills (discover-infrastructure, discover-cloud):
- Secrets management in deployments
- Network security
- Container security scanning
- TLS/SSL configuration
Testing skills (discover-testing):
- Security integration tests
- Penetration testing
- Automated security scans
- Vulnerability regression tests
Usage Instructions
- Auto-activation: This skill loads automatically when Claude Code detects security-related work
- Browse skills: Run
Read ../security/INDEX.mdfor full category overview - Load specific skills: Use bash commands above to load individual skills
- Follow workflows: Use recommended sequences for common security patterns
- Combine skills: Load multiple skills for comprehensive security coverage
Progressive Loading
This gateway skill (~200 lines, ~2K tokens) enables progressive loading:
- Level 1: Gateway loads automatically (you're here now)
- Level 2: Load category INDEX.md (~3K tokens) for full overview
- Level 3: Load specific skills (~2-4K tokens each) as needed
Total context: 2K + 3K + skill(s) = 5-12K tokens vs 30K+ for entire index.
Quick Start Examples
"Implement user authentication": Read ../security/authentication.md
"Add role-based access control": Read ../security/authorization.md
"Prevent SQL injection": Read ../security/input-validation.md
"Configure Content Security Policy": Read ../security/security-headers.md
"Test for OWASP vulnerabilities": Read ../security/vulnerability-assessment.md
"Integrate HashiCorp Vault": Read ../security/secrets-management.md
"Secure API with JWT": Read ../security/authentication.md Read ../security/authorization.md
Next Steps: Run Read ../security/INDEX.md to see full category details, or load specific skills using the bash commands above.
© rand, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/discover-security of rand/cc-polymath.
Open the folder on GitHubat commit baa2df1
Compare with similar skills
Discover Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Discover Security this skillrand/cc-polymath | 181 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Security And Hardeningdzhalaevd/Donatello | 135 | — | ~5.1k | Automated safety check: Notes | Apache-2.0 | |
| Quarkus Securityaffaan-m/ECC | 274k | 1 repos | ~3.1k | Automated safety check: Pass | MIT | |
| Security Auditoreigent-ai/eigent | 15k | — | ~1.8k | Automated safety check: Notes | Apache-2.0 | |
| Security Audit Scannerruvnet/ruflo | 74k | 2 repos | ~823 | Automated safety check: Pass | MIT |
Similar skills
- Official
Security And Hardening
dzhalaevd/Donatello
Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.
Quarkus Security
affaan-m/ECC
Quarkus security implementation patterns: JWT and OIDC authentication, @RolesAllowed RBAC and SecurityIdentity checks, Bean Validation and custom validators, parameterized Panache queries, BCrypt…
Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
Security Review Checklist
ZeroDeng01/sublinkPro
Checklist-driven security review for changes to authentication, authorization, MFA, secrets, input validation and other security-critical code.
More from rand/cc-polymath
All 26 skills in this repoAnti Slop
rand/cc-polymath
Comprehensive toolkit for detecting and eliminating "AI slop" - generic, low-quality AI-generated patterns in natural language, code, and design.
Typed Holes Refactor
rand/cc-polymath
Refactor codebases using Design by Typed Holes methodology - iterative, test-driven refactoring with formal hole resolution, constraint propagation, and continuous validation.
Discover Agentic
rand/cc-polymath
Automatically discover agentic workflow skills when building AI agents, implementing tool use patterns, managing context windows, decomposing complex tasks, or designing multi-step autonomous…
Elegant Design
rand/cc-polymath
Create world-class, accessible, responsive interfaces with sophisticated interactive elements including chat, terminals, code display, and streaming content.
Discover API
rand/cc-polymath
Automatically discover API design skills when working with REST APIs, GraphQL schemas, API authentication, OAuth, JWT, rate limiting, API versioning, error handling, or endpoint design.
Discover Database
rand/cc-polymath
Automatically discover database skills when working with SQL, PostgreSQL, MongoDB, Redis, database schema design, query optimization, migrations, connection pooling, ORMs, or database selection.
Related
Categories
Questions about Discover Security
What does Discover Security do?
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Discover Security is an agent skill from rand/cc-polymath. Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.
When should I use Discover Security?
Discover Security fits situations like: tasks that involve Web application vulnerabilities; tasks that involve Vulnerability scanning; tasks that involve Authorization and RBAC.
How do I install Discover Security in Claude Code?
Run `npx skills add rand/cc-polymath --skill discover-security -a claude-code`. Or copy the skill folder (skills/discover-security in rand/cc-polymath) into .claude/skills/discover-security in your project. Claude Code loads it when a task matches its description.
How do I install Discover Security in Codex?
Run `npx skills add rand/cc-polymath --skill discover-security -a codex`. Or copy the skill folder (skills/discover-security in rand/cc-polymath) into .agents/skills/discover-security in your project. Codex loads it when a task matches its description.
Can I use Discover Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add rand/cc-polymath --skill discover-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/discover-security, .gemini/skills/discover-security, .github/skills/discover-security and .opencode/skills/discover-security in your project.
What does Discover Security need to run?
SKILL.md names no scripts, command-line tools or credentials: Discover Security is instructions for the agent only. Compatibility (from SKILL.md): Designed for Claude Code. Compatible with any agent supporting the Agent Skills format..
Does Discover Security access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Discover Security safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Discover Security use?
Discover Security is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Discover Security use?
About 1.9k tokens (SKILL.md is roughly 7.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Discover Security?
Skills that share tags, products or a category with Discover Security: Security Review (github/awesome-copilot, 40k stars), Security And Hardening (dzhalaevd/Donatello, 135 stars), Quarkus Security (affaan-m/ECC, 274k stars) and Security Auditor (eigent-ai/eigent, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Discover Security?
rand (a GitHub user) maintains it in rand/cc-polymath, which has 181 GitHub stars. The repository holds 26 skills in this directory. The repository was last updated on February 28, 2026.
Source: rand/cc-polymath on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.