# Secure Code Guardian

Use when implementing authentication/authorization, securing user input, or preventing...

- Repository: https://github.com/Jeffallan/claude-skills (12164 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Jeffallan/claude-skills --skill secure-code-guardian -g -a claude-code -y`
Codex: `npx skills add Jeffallan/claude-skills --skill secure-code-guardian -g -a codex -y`
Cursor: `npx skills add Jeffallan/claude-skills --skill secure-code-guardian -g -a cursor -y`
Gemini CLI: `npx skills add Jeffallan/claude-skills --skill secure-code-guardian -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Jeffallan/claude-skills`

## Description

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities, including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Secure Code Guardian

## Core Workflow

1. **Threat model**, Identify attack surface and threats
2. **Design**, Plan security controls
3. **Implement**, Write secure code with defense in depth; see code examples below
4. **Validate**, Test security controls with explicit checkpoints (see below)
5. **Document**, Record security decisions

### Validation Checkpoints

After each implementation step, verify:

- **Authentication**: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence).
- **Authorization**: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users.
- **Input handling**: Confirm SQL injection payloads (`' OR 1=1--`) are rejected; confirm XSS payloads (`<script>alert(1)</script>`) are escaped or rejected.
- **Headers/CORS**: Validate with a security scanner (e.g., `curl -I`, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.

## Reference Guide

Load detailed guidance based on context:

| Topic | Reference | Load When |
|-------|-----------|-----------|
| OWASP | `references/owasp-prevention.md` | OWASP Top 10 patterns |
| Authentication | `references/authentication.md` | Password hashing, JWT |
| Input Validation | `references/input-validation.md` | Zod, SQL injection |
| XSS/CSRF | `references/xss-csrf.md` | XSS prevention, CSRF |
| Headers | `references/security-headers.md` | Helmet, rate limiting |

## Constraints

The rest: https://github.com/Jeffallan/claude-skills/blob/HEAD/skills/secure-code-guardian/SKILL.md