Your Skill Name

Your Skill Name

One paragraph explaining the skill's purpose. For example: "This skill performs static analysis for [vulnerability class] in [language/framework] projects, identifying [specific issues] and mapping findings to CWE/OWASP standards."

When to Use

• When the user asks to...
• When scanning code for...
• When reviewing...
• When a pull request contains changes to...

When NOT to Use

• When the user is asking about...
• For non-security-related...
• When another skill (e.g., skill-name) already covers...

Prerequisites

Tool Installed (Preferred)

# Detection
which toolname || toolname --version

# Installation (if not found)
npm install -g toolname
# or: pip install toolname
# or: brew install toolname

Tool Not Installed (Fallback)

> Note: Manual checks are less comprehensive than automated tooling. Consider installing > toolname for full coverage.

1. Check for [common vulnerability pattern 1]
2. Check for [common vulnerability pattern 2]
3. Check for [common vulnerability pattern 3]
4. Check for [common vulnerability pattern 4]
5. Check for [common vulnerability pattern 5]
6. Check for [common vulnerability pattern 6]
7. Check for [common vulnerability pattern 7]
8. Check for [common vulnerability pattern 8]
9. Check for [common vulnerability pattern 9]
10. Check for [common vulnerability pattern 10]

Workflow

1. Detect project language/framework by inspecting package.json, requirements.txt, go.mod, etc.
2. Identify target files for scanning (e.g., src/**/*.ts, app/**/*.py)
3. Scan for [specific vulnerability patterns]
4. For each finding:

a. Determine severity (Critical / High / Medium / Low) b. Map to the relevant CWE identifier c. Map to the relevant OWASP Top 10 category d. Identify the file and line number e. Draft a remediation recommendation

1. Deduplicate and sort findings by severity (Critical first)
2. Generate the findings report using the format below
3. Summarize: total findings, breakdown by severity, top recommendations

Findings Format

Each finding should include:

| Field | Description | |-------|-------------| | Severity | Critical / High / Medium / Low | | CWE | CWE-XXX identifier | | OWASP | A01-A10 category | | Location | file:line | | Issue | Description of the vulnerability | | Remediation | How to fix it |

Example Finding

| Field | Value | |-------|-------| | Severity | High | | CWE | CWE-79 | | OWASP | A03:2021 - Injection | | Location | src/components/UserProfile.tsx:42 | | Issue | User-supplied name is rendered without sanitization via dangerouslySetInnerHTML | | Remediation | Use React's default text rendering or sanitize input with DOMPurify before rendering |

Reference Tables

| Check | CWE | OWASP | Severity | |-------|-----|-------|----------| | Example check 1 | CWE-79 | A03 | High | | Example check 2 | CWE-89 | A03 | Critical | | Example check 3 | CWE-200 | A01 | Medium | | Example check 4 | CWE-522 | A07 | High |

Example Usage

User prompt: > "Run a [your-skill-name] scan on this project"

Expected output (abbreviated):

## [Your Skill Name] Scan Results

Scanned 23 files in src/

### Findings (3 total: 1 Critical, 1 High, 1 Medium)

| # | Severity | CWE | OWASP | Location | Issue |
|---|----------|-----|-------|----------|-------|
| 1 | Critical | CWE-89 | A03 | src/db/queries.ts:18 | SQL query built via string concatenation with user input |
| 2 | High | CWE-79 | A03 | src/views/profile.ejs:7 | Unescaped user output in template |
| 3 | Medium | CWE-200 | A01 | src/errors/handler.ts:34 | Stack trace exposed in production error response |

### Recommendations
1. Use parameterized queries for all database access (Finding #1)
2. Enable auto-escaping in EJS templates (Finding #2)
3. Suppress stack traces when NODE_ENV=production (Finding #3)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: kalshamsi
• Source: kalshamsi/claude-security-skills
• License: MIT

Install and usage instructions live in the source repository linked above.