New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Openai Security Best Practices

by trailofbits in trailofbits/skills-curated

Perform language and framework specific security best-practice reviews and suggest improvements.

OfficialCC-BY-SA-4.0Auto-check: notesSecurity

Install Openai Security Best Practices

skills CLI
$ npx skills add trailofbits/skills-curated --skill openai-security-best-practices -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trailofbits/skills-curated openai-security-best-practices --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trailofbits/skills-curated.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/openai-security-best-practices/skills/openai-security-best-practices .claude/skills/openai-security-best-practices && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
openai-security-best-practices
GitHub stars
512
Used in
9 other repos
Token cost
~2.2k tokens
SKILL.md length
1,372 words
Files
11 (incl. references)
Skills in repo
24
Repo updated
First seen
Licence
CC-BY-SA-4.0

At a glance

Perform language and framework specific security best-practice reviews and suggest improvements.

  • Works in 3 steps: The primary mode is to just use the… → The secondary mode is to passively… → The user can ask for a security report…
  • Ly when the user explicitly requests security best practices guidance
  • SKILL.md covers Overview, Workflow, Workflow Decision Tree and When to Use, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Openai Security Best Practices is an agent skill from trailofbits/skills-curated, published by the product's own GitHub organization. Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Originally from OpenAI's curated skills catalog.

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 11 other files, including reference files (for example `references/golang-general-backend-security.md`, `references/javascript-express-web-server-security.md` and `references/javascript-general-web-frontend-security.md`).

It sits in Security, covering Security review. It works with OpenAI, JavaScript, Python and TypeScript. The repository describes itself as: Curated, community-vetted Claude Code plugin marketplace. The licence is CC-BY-SA-4.0.

When your agent uses it

  • Ly when the user explicitly requests security best practices guidance
  • A security review/report
  • Secure-by-default coding help
  • Ly for supported languages (python

Example prompts

  • “/openai-security-best-practices”

Requirements

  • Pre-approved tools (allowed-tools): Bash, Read, Grep, Glob, Write, Edit

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new…
  2. The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very…
  3. The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe…

What it can do on your machine

Read from SKILL.md and the folder at commit 6d05be4. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Read
    • Grep
    • Glob
    • Write
    • Edit

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Openai Security Best Practices loads about 2.2k tokens when it runs, and up to ~100k if it reads all its reference files. Until then it costs about 116 tokens; SKILL.md has 1,372 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~116
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~100k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Read, Grep, Glob, Write, Edit

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trailofbits/skills-curated at commit 6d05be4, republished under its CC-BY-SA-4.0 licence (© trailofbits). 1,372 words, ~2,205 tokens.

Download SKILL.mdSave it as .claude/skills/openai-security-best-practices/SKILL.md (or your agent's skills folder). This skill also uses 10 other files; get the full folder from GitHub.
name
openai-security-best-practices
description
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Originally from OpenAI's curated skills catalog.
allowed-tools
Bash, Read, Grep, Glob, Write, Edit

Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.

Then check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is <language>-<framework>-<stack>-security.md. You should also check if there is a <language>-general-<stack>-security.md which is agnostic to the framework you may be using.

If working on a web application which includes a frontend and a backend, make sure you have checked for reference documents for BOTH the frontend and backend!

If you are asked to make a web app which will include both a frontend and backend, but the frontend framework is not specified, also check out javascript-general-web-frontend-security.md. It is important that you understand how to secure both the frontend and backend.

If no relevant information is available in the skill's references directory, think a little bit about what you know about the language, the framework, and all well known security best practices for it. If you are unsure you can try to search online for documentation on security best practices.

From there it can operate in a few ways.

  1. The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.

  2. The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.

  3. The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe anyways the project fails to follow security best practices guidance. The report should be prioritized and have clear sections of severity and urgency. Then offer to start working on fixes for these issues. See #fixes below.

Workflow Decision Tree

  • If the language/framework is unclear, inspect the repo to determine it and list your evidence.
  • If matching guidance exists in references/, load only the relevant files and follow their instructions.
  • If no matching guidance exists, consider if you know any well known security best practices for the chosen language and or frameworks, but if asked to generate a report, let the user know that concrete guidance is not available (you can still generate the report or detect for sure critical vulnerabilities)

Overrides

While these references contain the security best practices for languages and frameworks, customers may have cases where they need to bypass or override these practices. Pay attention to specific rules and instructions in the project's documentation and prompt files which may require you to override certain best practices. When overriding a best practice, you MAY report it to the user, but do not fight with them. If a security best practice needs to be bypassed / ignored for some project specific reason, you can also suggest to add documentation about this to the project so it is clear why the best practice is not being followed and to follow that bypass in the future.

Report Format

When producing a report, you should write the report as a markdown file in security_best_practices_report.md or some other location if provided by the user. You can ask the user where they would like the report to be written to.

The report should have a short executive summary at the top.

The report should be clearly delineated into multiple sections based on severity of the vulnerability. The report should focus on the most critical findings as these have the highest impact for the user. All findings should be noted with an numeric ID to make them easier to reference.

For critical findings include a one sentence impact statement.

Once the report is written, also report it to the user directly, although you may be less verbose. You can offer to explain any of the findings or the reasons behind the security best practices guidance if the user wants more info on any findings.

Important: When referencing code in the report, make sure to find and include line numbers for the code you are referencing.

After you write the report file, summarize the findings to the user.

Also tell the user where the final report was written to

Show full SKILL.md (507 more words)Show less

Fixes

If you produced a report, let the user read the report and ask to begin performing fixes.

If you passively found a critical finding, notify the user and ask if they would like you to fix this finding.

When producing fixes, focus on fixing a single finding at a time. The fixes should have concise clear comments explaining that the new code is based on the specific security best practice, and perhaps a very short reason why it would be dangerous to not do it in this way.

Always consider if the changes you want to make will impact the functionality of the user's code. Consider if the changes may cause regressions with how the project works currently. It is often the case that insecure code is relied on for other reasons (and this is why insecure code lives on for so long). Avoid breaking the user's project as this may make them not want to apply security fixes in the future. It is better to write a well thought out, well informed by the rest of the project, fix, then a quick slapdash change.

Always follow any normal change or commit flow the user has configured. If making git commits, provide clear commit messages explaining this is to align with security best practices. Try to avoid bunching a number of unrelated findings into a single commit.

Always follow any normal testing flows the user has configured (if any) to confirm that your changes are not introducing regressions. Consider the second order impacts the changes may have and inform the user before making them if there are any.

General Security Advice

Below is a few bits of secure coding advice that applies to almost any language or framework.

Avoid Using Incrementing IDs for Public IDs of Resources

When assigning an ID for some resource, which will then be used by exposed to the internet, avoid using small auto-incrementing IDs. Use longer, random UUID4 or random hex string instead. This will prevent users from learning the quantity of a resource and being able to guess resource IDs.

A note on TLS

While TLS is important for production deployments, most development work will be with TLS disabled or provided by some out-of-scope TLS proxy. Due to this, be very careful about not reporting lack of TLS as a security issue. Also be very careful around use of "secure" cookies. They should only be set if the application will actually be over TLS. If they are set on non-TLS applications (such as when deployed for local dev or testing), it will break the application. You can provide a env or other flag to override setting secure as a way to keep it off until on a TLS production deployment. Additionally avoid recommending HSTS. It is dangerous to use without full understanding of the lasting impacts (can cause major outages and user lockout) and it is not generally recommended for the scope of projects being reviewed by the agent.

When to Use

<!-- TODO: review -->

When NOT to Use

<!-- TODO: review -->

© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 10 other files (references) in plugins/openai-security-best-practices/skills/openai-security-best-practices of trailofbits/skills-curated.

  • SKILL.md
  • references/golang-general-backend-security.md
  • references/javascript-express-web-server-security.md
  • references/javascript-general-web-frontend-security.md
  • references/javascript-jquery-web-frontend-security.md
  • references/javascript-typescript-nextjs-web-server-security.md
  • references/javascript-typescript-react-web-frontend-security.md
  • references/javascript-typescript-vue-web-frontend-security.md
  • references/python-django-web-server-security.md
  • references/python-fastapi-web-server-security.md
  • references/python-flask-web-server-security.md

Open the folder on GitHubat commit 6d05be4

Used in 9 other repositories

We found 9 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 9 other GitHub owners. This page covers the copy in trailofbits/skills-curated, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Openai Security Best Practices next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Openai Security Best Practices compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Openai Security Best Practices this skilltrailofbits/skills-curated5129 repos~2.2kAutomated safety check: NotesCC-BY-SA-4.0
Secure Code Guidancenightly-labs/openbot453—~369Automated safety check: PassCustom licence
CodeQL Security Scantrailofbits/skills7.4k—~4.6kAutomated safety check: NotesCC-BY-SA-4.0
Code Review ChecklistshareAI-lab/learn-claude-code78k5 repos~1.1kAutomated safety check: PassMIT
Supercov Securitysupercorp-ai/supercov1501 repos~236Automated safety check: PassMIT
Gemini Interactions APIAyuilos/Miffan192—~4.6kAutomated safety check: PassAGPL-3.0

Similar skills

  • Secure Code Guidance

    nightly-labs/openbot

    Review or write Python, JavaScript, TypeScript, or Go code using secure defaults.

    453 GitHub stars~369 tokensUpdated today
    SecurityAuto-check passed

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Code Review Checklist

    shareAI-lab/learn-claude-code

    Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.

    78k GitHub starsUsed in 5 repos~1.1k tokens
    DevelopmentAuto-check passed

  • Supercov Security

    supercorp-ai/supercov

    Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes.

    150 GitHub starsUsed in 1 repo~236 tokens
    Testing & QAAuto-check passed

  • Gemini Interactions API

    Ayuilos/Miffan

    A skill your agent uses when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, streaming responses…

    192 GitHub stars~4.6k tokensUpdated 2 days ago
    Media & CreativeAuto-check passed

  • Brightdata SDK JS

    brightdata/skills

    Web data extraction and discovery using the Bright Data JavaScript/TypeScript SDK (@brightdata/sdk).

    264 GitHub stars~3k tokensUpdated yesterday
    Productivity & AutomationAuto-check passed

More from trailofbits/skills-curated

All 24 skills in this repo

  • Openai Security Ownership Map

    trailofbits/skills-curated

    Official

    Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization.

    512 GitHub starsUsed in 5 repos~2.2k tokens
    Auto-check: notes

  • Openai Doc

    trailofbits/skills-curated

    Official

    A skill your agent uses when the task involves reading, creating, or editing .docx documents, especially when formatting or layout fidelity matters; prefer python-docx plus the bundled…

    512 GitHub starsUsed in 5 repos~786 tokens
    Auto-check: notes

  • Openai Develop Web Game

    trailofbits/skills-curated

    Official

    A skill your agent uses when the agent is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script…

    512 GitHub stars~2.3k tokensUpdated 2 mo ago
    Auto-check: notes

  • Openai Jupyter Notebook

    trailofbits/skills-curated

    Official

    A skill your agent uses when the user asks to create, scaffold, or edit Jupyter notebooks (.ipynb) for experiments, explorations, or tutorials; prefer the bundled templates and run the helper script…

    512 GitHub stars~1k tokensUpdated 2 mo ago
    Auto-check: notes

  • Openai Playwright

    trailofbits/skills-curated

    Official

    A skill your agent uses when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via playwright-cli…

    512 GitHub stars~945 tokensUpdated 2 mo ago
    Auto-check: notes

  • X Research

    trailofbits/skills-curated

    Official

    Searches X/Twitter for real-time perspectives, dev discussions, product feedback, breaking news, and expert opinions using the X API v2.

    512 GitHub stars~1.9k tokensUpdated 2 mo ago
    Auto-check: notes

Works with

Categories

Questions about Openai Security Best Practices

What does Openai Security Best Practices do?

Perform language and framework specific security best-practice reviews and suggest improvements. Openai Security Best Practices is an agent skill from trailofbits/skills-curated, published by the product's own GitHub organization. Perform language and framework specific security best-practice reviews and suggest improvements.

When should I use Openai Security Best Practices?

Openai Security Best Practices fits situations like: ly when the user explicitly requests security best practices guidance; A security review/report; secure-by-default coding help; ly for supported languages (python.

How do I install Openai Security Best Practices in Claude Code?

Run `npx skills add trailofbits/skills-curated --skill openai-security-best-practices -a claude-code`. Or copy the skill folder (plugins/openai-security-best-practices/skills/openai-security-best-practices in trailofbits/skills-curated) into .claude/skills/openai-security-best-practices in your project. Claude Code loads it when a task matches its description.

How do I install Openai Security Best Practices in Codex?

Run `npx skills add trailofbits/skills-curated --skill openai-security-best-practices -a codex`. Or copy the skill folder (plugins/openai-security-best-practices/skills/openai-security-best-practices in trailofbits/skills-curated) into .agents/skills/openai-security-best-practices in your project. Codex loads it when a task matches its description.

Can I use Openai Security Best Practices in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills-curated --skill openai-security-best-practices -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/openai-security-best-practices, .gemini/skills/openai-security-best-practices, .github/skills/openai-security-best-practices and .opencode/skills/openai-security-best-practices in your project.

What does Openai Security Best Practices need to run?

SKILL.md names no scripts, command-line tools or credentials: Openai Security Best Practices is instructions for the agent only. Its frontmatter pre-approves these tools: Bash, Read, Grep, Glob, Write, Edit.

Does Openai Security Best Practices access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Openai Security Best Practices safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Openai Security Best Practices use?

Openai Security Best Practices is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Openai Security Best Practices use?

About 2.2k tokens (SKILL.md is roughly 8.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 98k tokens, read only when the agent opens those files.

What are the alternatives to Openai Security Best Practices?

Skills that share tags, products or a category with Openai Security Best Practices: Secure Code Guidance (nightly-labs/openbot, 453 stars), CodeQL Security Scan (trailofbits/skills, 7.4k stars), Code Review Checklist (shareAI-lab/learn-claude-code, 78k stars) and Supercov Security (supercorp-ai/supercov, 150 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Openai Security Best Practices?

trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills-curated, which has 512 GitHub stars. The repository holds 24 skills in this directory. The repository was last updated on July 14, 2026.

Source: trailofbits/skills-curated on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.