Skill Finder
The best Claude skills for security
Start with security-audit from Cloudflare: it scores highest here, 80, and scales from a single question to a full audit of your source code, with output kept outside the repo. The list also covers security-and-hardening for rules while Claude writes web code, Better Auth hardening, two security-review skills, Strix pentests, and secondary picks for Postgres, sign-in, Android and repo audits.
The 6 skills made for this job
-
1
Get security-auditsecurity-audit
For developers who want a source-based security review, from one question up to a full multi-agent audit. Skip it if you want scans of live deployed sites.
-
2
Get security-and-hardeningsecurity-and-hardening
For web developers handling input, logins or personal data who want clear always, ask-first and never rules. Skip it if you need a formal audit report.
-
3
Get better-auth-security-best-practicesbetter-auth-security-best-practices
For developers running Better Auth who want to lock down sessions, cookies and sign-in limits before launch. Skip it if your app uses a different auth library.
-
4
Get security-reviewsecurity-review
For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws. Skip it if you want every possible weakness listed or a live penetration test.
-
5
Get penetration-testing-with-strixpenetration-testing-with-strix
For developers who want automated pentests that prove each finding with a working exploit. Skip it if you can't confirm you are authorized to attack the target.
-
6
Get security-reviewsecurity-review
For web developers adding login, payments, uploads or new API routes who want a security checklist at hand. Skip it if you need an automated scan of your code or work outside the Node web stack.
Also useful for security
Their main job is something else, but they help with this one.
-
Get supabase-postgres-best-practicessupabase-postgres-best-practices
For developers writing SQL, schemas or row level security policies on any Postgres database. Skip it if you never touch the database layer yourself.
-
Get supabase
supabase
For developers building on Supabase who want auth, RLS and migrations handled with care. Skip it if your backend runs on plain Postgres or another platform.
-
Get solana-devsolana-dev
For developers building Solana programs, clients or wallet UIs who want current tooling defaults. Skip it if you are not working on Solana.
-
Get better-auth-best-practices
better-auth-best-practices
For TypeScript developers setting up or changing Better Auth sign-in, sessions and plugins. Skip it if your app uses a different auth library or a hosted provider.
-
Get insforge-debuginsforge-debug
For developers on InsForge chasing an error, a slow endpoint or a pre-launch audit. Skip it if your backend runs on a different platform.
-
Get stripe-best-practicesstripe-best-practices
For developers adding payments, subscriptions or sales tax to an app with Stripe. Skip it if you use another payment provider or never touch the Stripe API.
-
Get email-and-password-best-practices
email-and-password-best-practices
For TypeScript developers adding email and password login with Better Auth. Skip it if your app uses another auth library or only social sign-in.
-
Get clerk-setupclerk-setup
For developers adding Clerk sign-in to a web or mobile app through the Clerk CLI. Skip it if you want auth that runs only on your own servers.
-
Get ponytail-auditponytail-audit
For developers or founders who want a whole repo audited in plain English and ranked by risk. Skip it if you want code changed or one diff reviewed.
-
Get multi-stage-dockerfilemulti-stage-dockerfile
For developers who want a smaller, safer Docker image built in stages. Skip it if you do not use containers or need a full CI or Kubernetes setup.
-
Get Android SkillsAndroid Skills
For Android developers who want official step-by-step guidance for Compose layout, upgrades, security and performance work. Skip it if you don't build Android apps.
-
Get healthhealth
For Claude Code, Codex or Pi users whose agent ignores instructions or whose hooks and MCP servers misbehave. Skip it if you are chasing an app bug or want a pull request review.
How to choose
security-audit reviews code for flaws that cross a trust boundary. It gives guidance by default and runs its six-phase audit only when you ask, ending in a REPORT.md. It reads source only and runs target code only in a sandbox with no network. It is not for scanning live sites.
security-and-hardening works while code is written rather than after. It starts with a short STRIDE threat model, then applies always, ask-first and never rules, such as parameterized queries and no secrets in commits. Pick it for web code that handles input, logins or personal data. It needs nothing extra.
Two skills share the name security-review. Sentry's version researches the whole codebase and reports only high-confidence, exploitable flaws; at least one scanner rated it high risk. Affaan Mustafa's version is a checklist with wrong and right examples for TypeScript web apps, ending in a seventeen-item list before deploy.
better-auth-security-best-practices only fits apps on Better Auth, covering the secret, rate limits, CSRF checks and cookies. penetration-testing-with-strix runs the Strix pentest tool against targets you own, needs Docker and an LLM key, and has a high-risk scanner result.
Secondary picks cover one platform each. supabase-postgres-best-practices and supabase include row level security rules, clerk-setup adds Clerk sign-in, and Android Skills cover intent and permission security. ponytail-audit reports security holes across a whole repo, and health checks your agent setup's deny-lists for credential folders.