Security Best Practices Baseline skill for Claude and Codex

Security Best Practices Baseline as an AI skill. It asks for Service description, Stack, Handles sensitive data and 3 more, then does the rest. Free to…

Install it once and Claude or Codex runs it for you. When your request matches, your AI loads the skill, asks for anything it is missing, and works through the template itself. Prefer to fill it in by hand? See the full prompt template.

Download the skill (.zip) · View SKILL.md

When it is used

Use when a new service is about to ship and needs a pass or fail check of its secrets, auth, dependencies, logging and headers. Do not use for a deep penetration test or a review of one pull request for vulnerabilities. Related topics: coding, technical.

What it will ask you for

• Service description (longer free text)
• Stack (free text, e.g. "Language and framework and host")
• Handles sensitive data (choose one: None, Personal data, Payments, Health records, Credentials)
• Exposed to (choose one: Internet, Partners only, Internal network only)
• Relevant code or config (longer free text)
• Strictness (choose one: Prototype, Production, Regulated)

How it works

1. Read the pasted description, code and config and write down what is known about each of the five areas, marking gaps as Unknown rather than guessing.
2. State the baseline for each area in one line, adjusted to the strictness level and the sensitivity of the data.
3. Give each area a Pass, Fail or Unknown verdict and quote the exact line or setting that justifies it.
4. Rank the failures by how easily an outsider could exploit them given the stated exposure.
5. Write the smallest fix for each failure so the list can be worked top to bottom.

What you get

A five-row verdict table (area, baseline, verdict, evidence) followed by a ranked fix list with one concrete change per failure.

What it watches out for

• Marking an area Pass because no problem was visible, when the relevant file was never pasted and the honest verdict is Unknown.
• Applying a regulated-data bar to a prototype, which buries the two failures that matter under twenty that do not.
• Fixing headers first because they are easy, while a hard-coded secret or a missing auth check stays open.

How to install

Claude.ai and the Claude desktop app

1. Download the skill .zip.
2. Open Settings, then Capabilities, and find Skills.
3. Choose Upload skill and select the .zip.
4. Ask Claude for help with the task. It loads the skill when your request matches.

Claude Code

1. Download the skill .zip.
2. Unzip it into ~/.claude/skills/ (or .claude/skills/ inside a project).
3. Start a new session. Claude Code loads the skill when your request matches.

Codex

1. Download the skill .zip.
2. Unzip it into ~/.agents/skills/ (or .agents/skills/ inside a project).
3. Codex picks it up on its own. Type $ and the skill name to use it, or just ask for the task.

Cursor

1. Download the Cursor rule (.mdc).
2. Save it in .cursor/rules/ inside your project.
3. Cursor's agent applies the rule when your request matches its description.

AGENTS.md (Codex, Cursor, and other coding agents)

1. Copy the AGENTS.md section.
2. Paste it into AGENTS.md at the root of your repository, creating the file if needed.
3. Coding agents that read AGENTS.md follow it when your request fits.