security-checklist — Claude Code skill: security audit
Audits Micronaut/Kotlin backends for access control, input checks, injection risks, and data exposure. Use it during implementation or review.
npx skills add c0x12c/ai-toolkit --skill security-checklist -a claude-codeWhat security-checklist does
This skill audits Micronaut/Kotlin backend code across authentication, authorization, request validation, and common OWASP-related risks. It checks resource access, SQL injection, XSS, CSRF, IDOR, auth bypass, mass assignment, data exposure, and rate limiting.
The review covers @Secured on controllers, OAuthSecurityRule.ADMIN for admin endpoints, and @Valid with Jakarta annotations in request DTOs. It also looks for hardcoded secrets, credentials in logs, raw entities in responses, and overly detailed errors. An endpoint without @Secured fails the skill’s stated audit rule.
The result is a pass/fail checklist with fix examples for each issue. Further code patterns and vulnerability examples are referenced through audit-reference.md.
What it helps with
- verify that users can access only allowed resources
- spot SQL injection risks in queries
- check request validation on endpoints
- remove tokens and passwords from logs
- detect sensitive fields exposed by response DTOs
Example prompts for the agent
- Audit every endpoint in this Micronaut/Kotlin backend and produce a pass/fail report.
- Review authorization and show code changes for each issue you find.
- Check this code before merge for SQL injection, IDOR, XSS, and secret leaks.
How to install security-checklist
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill security-checklist -a claude-code2Manually: put the files in place
~/.claude/skills/security-checklist/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-checklist/
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill security-checklist -a codex2Manually: put the files in place
.agents/skills/security-checklist/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill security-checklist -a cursor2Manually: put the files in place
.cursor/skills/security-checklist/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install c0x12c/ai-toolkit security-checklist2Manually: put the files in place
.github/skills/security-checklist/SKILL.md1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill security-checklist -a gemini-cli2Platform CLI
gemini skills install https://github.com/c0x12c/ai-toolkit --path toolkit/skills/security-checklistManually: put the files in place
.devin/skills/security-checklist/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill security-checklist -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-checklist
How do I install security-checklist in Claude Code?
Run npx skills add c0x12c/ai-toolkit --skill security-checklist -a claude-code, then check ~/.claude/skills/security-checklist/SKILL.md.
What does security-checklist do?
It reviews Micronaut/Kotlin backend code against security categories and returns a pass/fail report. Each issue comes with a suggested fix and code examples.
Which security rules does the skill check?
It checks @Secured, ownership of resources, @Valid with Jakarta annotations, protection against concatenated raw SQL, secret handling, and rate limiting on auth endpoints.
