# Your Skill Name

> Use when [trigger conditions]. Performs [what it does] for [target language/framework].

- **Type:** Skill
- **Install:** `agentstack add skill-kalshamsi-claude-security-skills-template`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kalshamsi](https://agentstack.voostack.com/s/kalshamsi)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kalshamsi](https://github.com/kalshamsi)
- **Source:** https://github.com/kalshamsi/claude-security-skills/tree/main/skills/_template

## Install

```sh
agentstack add skill-kalshamsi-claude-security-skills-template
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Your Skill Name

One paragraph explaining the skill's purpose. For example: "This skill performs static analysis
for [vulnerability class] in [language/framework] projects, identifying [specific issues] and
mapping findings to CWE/OWASP standards."

## When to Use

- When the user asks to...
- When scanning code for...
- When reviewing...
- When a pull request contains changes to...

## When NOT to Use

- When the user is asking about...
- For non-security-related...
- When another skill (e.g., `skill-name`) already covers...

## Prerequisites

### Tool Installed (Preferred)

```bash
# Detection
which toolname || toolname --version

# Installation (if not found)
npm install -g toolname
# or: pip install toolname
# or: brew install toolname
```

### Tool Not Installed (Fallback)

> **Note:** Manual checks are less comprehensive than automated tooling. Consider installing
> `toolname` for full coverage.

1. Check for [common vulnerability pattern 1]
2. Check for [common vulnerability pattern 2]
3. Check for [common vulnerability pattern 3]
4. Check for [common vulnerability pattern 4]
5. Check for [common vulnerability pattern 5]
6. Check for [common vulnerability pattern 6]
7. Check for [common vulnerability pattern 7]
8. Check for [common vulnerability pattern 8]
9. Check for [common vulnerability pattern 9]
10. Check for [common vulnerability pattern 10]

## Workflow

1. Detect project language/framework by inspecting package.json, requirements.txt, go.mod, etc.
2. Identify target files for scanning (e.g., `src/**/*.ts`, `app/**/*.py`)
3. Scan for [specific vulnerability patterns]
4. For each finding:
   a. Determine severity (Critical / High / Medium / Low)
   b. Map to the relevant CWE identifier
   c. Map to the relevant OWASP Top 10 category
   d. Identify the file and line number
   e. Draft a remediation recommendation
5. Deduplicate and sort findings by severity (Critical first)
6. Generate the findings report using the format below
7. Summarize: total findings, breakdown by severity, top recommendations

## Findings Format

Each finding should include:

| Field | Description |
|-------|-------------|
| Severity | Critical / High / Medium / Low |
| CWE | CWE-XXX identifier |
| OWASP | A01-A10 category |
| Location | file:line |
| Issue | Description of the vulnerability |
| Remediation | How to fix it |

### Example Finding

| Field | Value |
|-------|-------|
| Severity | High |
| CWE | CWE-79 |
| OWASP | A03:2021 - Injection |
| Location | src/components/UserProfile.tsx:42 |
| Issue | User-supplied `name` is rendered without sanitization via `dangerouslySetInnerHTML` |
| Remediation | Use React's default text rendering or sanitize input with DOMPurify before rendering |

## Reference Tables

| Check | CWE | OWASP | Severity |
|-------|-----|-------|----------|
| Example check 1 | CWE-79 | A03 | High |
| Example check 2 | CWE-89 | A03 | Critical |
| Example check 3 | CWE-200 | A01 | Medium |
| Example check 4 | CWE-522 | A07 | High |

## Example Usage

**User prompt:**
> "Run a [your-skill-name] scan on this project"

**Expected output (abbreviated):**

```
## [Your Skill Name] Scan Results

Scanned 23 files in src/

### Findings (3 total: 1 Critical, 1 High, 1 Medium)

| # | Severity | CWE | OWASP | Location | Issue |
|---|----------|-----|-------|----------|-------|
| 1 | Critical | CWE-89 | A03 | src/db/queries.ts:18 | SQL query built via string concatenation with user input |
| 2 | High | CWE-79 | A03 | src/views/profile.ejs:7 | Unescaped user output in template |
| 3 | Medium | CWE-200 | A01 | src/errors/handler.ts:34 | Stack trace exposed in production error response |

### Recommendations
1. Use parameterized queries for all database access (Finding #1)
2. Enable auto-escaping in EJS templates (Finding #2)
3. Suppress stack traces when NODE_ENV=production (Finding #3)
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kalshamsi](https://github.com/kalshamsi)
- **Source:** [kalshamsi/claude-security-skills](https://github.com/kalshamsi/claude-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kalshamsi-claude-security-skills-template
- Seller: https://agentstack.voostack.com/s/kalshamsi
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.