# skill-file-security

Adds OWASP and CWE security rule sets to your project so your AI assistant can audit code and prepare patch diffs right inside your editor.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 779 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/skill-file-security/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/skill-file-security

## What it does

This skill installs 29 rule files directly into the `.skills/security/` folder. The AI assistant uses these instructions to catch vulnerabilities defined by OWASP Top 10 and CWE Top 25 standards. It spots hardcoded credentials, misconfigured HTTP headers, injection risks, and database flaws tailored to your stack.

Daily workflows rely on six slash commands. Running `/security-scan` quickly flags critical issues. Using `/security-audit` evaluates your codebase and calculates an overall score. The tool tracks audit history over time inside `memory-security.md`.

Applying updates through `/security-fix` requires explicit approval after previewing the diff. Setting up this skill changes your repository tree by writing configuration files and updating `.gitignore`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill skill-file-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/skill-file-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/skill-file-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill skill-file-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/skill-file-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill skill-file-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/skill-file-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills skill-file-security
```

2. **Manually: put the files in place**
- File: `.github/skills/skill-file-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill skill-file-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/skill-file-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/skill-file-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill skill-file-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/skill-file-security/SKILL.md

## When to use it
- locate leaked secrets and exposed environment variables
- verify row-level security policies across database migrations
- calculate codebase security score against OWASP standards
- produce reviewed patch diffs for discovered vulnerabilities

## Example prompts
- /security-scan
- /security-audit
- /security-fix rls

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md