spatie-security — Claude Code skill: what it does, how to install
Applies Spatie's security guidelines across applications, databases, servers, and Git workflows. Useful during infrastructure setup and security code reviews.
npx skills add spatie/guidelines-skills --skill spatie-security -a claude-codeWhat spatie-security does
This skill guides agents through Spatie's security practices for codebases and infrastructure. It handles SSL setup, CSRF protection, password hashing, and database user isolation. It also enforces signed Git commits and secure credential handling.
The skill references references/spatie-security-guidelines.md. When activated, the agent identifies the security issue and applies the narrowest relevant protection without weakening existing safeguards. Rules include disabling SSH password authentication, enabling unattended security updates, and restricting database hosts.
Code style, business logic, and UI design are out of scope. Because of that focus, the agent will not touch code formatting or interface components. It zeroes in on permissions and vulnerabilities.
What it helps with
- enforce SSL and CSRF protection in web applications
- harden servers by disabling SSH password logins and enabling firewall rules
- isolate database users and restrict permitted database hosts
- configure signed Git commits and protect private keys
- audit controllers and forms for authorization vulnerabilities
Example prompts for the agent
- Review our server and database configuration using spatie-security rules
- Check this controller for CSRF protection and authorization checks
- Help me set up signed Git commits according to Spatie guidelines
How to install spatie-security
1Skills CLI (Vercel)
npx skills add spatie/guidelines-skills --skill spatie-security -a claude-code2Manually: put the files in place
~/.claude/skills/spatie-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/spatie-security/
1Skills CLI (Vercel)
npx skills add spatie/guidelines-skills --skill spatie-security -a codex2Manually: put the files in place
.agents/skills/spatie-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add spatie/guidelines-skills --skill spatie-security -a cursor2Manually: put the files in place
.cursor/skills/spatie-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install spatie/guidelines-skills spatie-security2Manually: put the files in place
.github/skills/spatie-security/SKILL.md1Skills CLI (Vercel)
npx skills add spatie/guidelines-skills --skill spatie-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/spatie/guidelines-skills --path resources/boost/skills/spatie-securityManually: put the files in place
.devin/skills/spatie-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add spatie/guidelines-skills --skill spatie-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about spatie-security
How to install spatie-security in Claude Code?
Run npx skills add spatie/guidelines-skills --skill spatie-security -a claude-code in your terminal. The configuration is stored in ~/.claude/skills/spatie-security/SKILL.md.
What does spatie-security do?
It applies Spatie's security standards for web applications, databases, servers, and credentials. It covers password hashing, API key encryption, server updates, and signed commits.
Does spatie-security review code style or business logic?
No, code style, UI/UX design, and business logic are explicitly out of scope. The skill only evaluates security controls and infrastructure hardening.
Source text
SKILL.md · MIT
--- name: spatie-security description: Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening. license: MIT metadata: author: Spatie --- # Spatie Security Guidelines ## Overview Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure. ## When to Activate - Activate this skill when configuring application security (authentication, authorization, forms). - Activate this skill when setting up or reviewing database configurations. - Activate this skill when configuring servers or reviewing infrastructure. - Activate this skill when reviewing code for security vulnerabilities. - Activate this skill when configuring or creating signed Git commits. ## Scope - In scope: Application security, database security, server configuration, credential management, signed Git commits. - Out of scope: Code style, business logic, UI/UX design. ## Workflow 1. Identify the application, database, server, credential, or Git security concern. 2. Read `references/spatie-security-guidelines.md` and focus on the relevant sections. 3. Apply the narrowest relevant security controls without weakening existing protections. ## Core Rules (Summary) - Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys. - Sign all Git commits. - Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests. - Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts. - Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic. - Protect devices, backups, sensitive data, and browser activity. ## References - `references/spatie-security-guidelines.md`
© Spatie · MIT · spatie/guidelines-skills
