Security: skills, plugins, subagents and slash commands
Security for Claude Code, Codex and Cursor: skills, plugins, subagents and slash commands, from popular to niche.
1–40 of 136
Security of AI-written code: in the Veracode 2025 study, models left OWASP Top 10 vulnerabilities in 45% of tasks. Skills and rules here look for secrets in code, injection, XSS, client-side authorization and database permissions. A hook that blocks a commit containing a key beats a skill that politely asks the agent not to. And remember that a skill is code too: GitHub warns that skills are not reviewed and may contain prompt injection.