Guide · Agent skill
How to use the Secure Code Guardian agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
Secure Code Guardian is an agent skill: a folder of instructions and reference files that a Claude agent loads when you ask it to build security-sensitive code. It is aimed at developers building login, sessions, JWT-based APIs or input handling in a Node.js project. After this guide you will know what the skill changes about the agent's behaviour, how to install it, how to phrase requests so it triggers, and what to check before you trust its output.
Secure Code GuardianJeffallan/claude-skills · MIT Download the skill Quick start
- 1Download the skill ZIP. Get the secure-code-guardian ZIP from the skill's page in this directory.
- 2Unzip into a skills folder. Extract it into ~/.claude/skills/ for personal use or into your project's .claude/skills/ folder.
- 3Or upload it in the Claude apps. Open Settings → Capabilities → Skills and upload the skill there.
- 4Set up your Node.js project. Install the packages the examples use, such as bcrypt, pg, zod, jsonwebtoken, express, express-rate-limit and helmet.
- 5Set JWT_SECRET. Provide the JWT_SECRET environment variable for the JWT example rather than hardcoding a secret.
- 6Ask for a specific security task. Describe the feature in plain words, for example adding bcrypt login to your Express app.
- 7Run the post-implementation tests. Test brute-force limits, injection and XSS payloads, token expiry and headers before relying on the code.
What does the Secure Code Guardian skill make the agent do?
When the skill is installed and relevant, the agent follows a security-focused workflow: threat model, design, implement, validate and document. Its source lists defaults it applies, including bcrypt or argon2 password hashing, parameterized SQL queries, Zod input validation, JWT checks with an explicit algorithm allowlist, rate limiting on auth endpoints, and security headers such as CSP, HSTS and X-Frame-Options.
The skill also asks the agent to finish each implementation step with a checkpoint. For example, it should test brute-force protection, check that invalid-credential messages do not reveal whether a user exists, confirm SQL injection payloads such as ' OR 1=1-- are rejected, and confirm XSS payloads such as <script>alert(1)</script> are escaped or rejected.
How do you install the skill?
Option 1: download the ZIP from the skill's page on our directory and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it only for that project.
Option 2: in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
What files does the skill contain?
The skill contains SKILL.md, which holds the core workflow, constraints and code examples, plus reference files the agent loads when relevant. These are references/authentication.md (password hashing and JWT), references/input-validation.md (Zod and SQL injection), references/owasp-prevention.md, references/xss-csrf.md and references/security-headers.md (Helmet and rate limiting).
How do you trigger the skill with natural requests?
You do not need a special command. Describe the security task in plain words and the agent should load the skill when the request matches its description. The description covers authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management and security hardening.
Name the concrete thing you are building. The more specific the request, the more likely the right reference file is used.
- Add bcrypt password hashing and a login route to my Express app.
- Make this SQL lookup safe from injection.
- Validate this signup form with Zod and reject bad input.
- Set up JWT auth for my API with an algorithm allowlist.
- Harden this Express app against OWASP Top 10 issues and tell me what to test.
What does a secured login endpoint look like?
The skill's full-flow example combines helmet, a JSON body size limit, express-rate-limit on the login route, Zod validation, a parameterized lookup, bcrypt comparison, a short-lived JWT and an httpOnly cookie. Treat it as a starting point the agent adapts to your project, not finished production code.
- Helmet sets headers including CSP and HSTS.
- Login is limited to 10 attempts per 15 minutes per IP in the example.
- The token is sent in an httpOnly, secure, sameSite strict cookie.
app.post('/api/login', authLimiter, async (req, res) => { /* validate, parameterized lookup, bcrypt compare, sign JWT, set cookie */ });What do you need before you start?
The skill is written for a Node.js project, and its examples use TypeScript. The packages referenced in the examples are bcrypt, pg, zod, jsonwebtoken, express, express-rate-limit and helmet. The JWT example reads its key from a JWT_SECRET environment variable, which you must set yourself. Curl or Mozilla Observatory is optional for checking headers.
The skill declares that it runs no scripts and uses no network access. It is guidance and code examples, so the agent writes and explains code rather than executing a scanner.
What should you check after the agent writes code?
Run the checklist the skill gives. Test brute-force protection, token expiry, horizontal and vertical privilege escalation, SQL injection and XSS payloads, and whether security headers are present using curl -I or Mozilla Observatory. Confirm that CORS allows only the origins you intend.
Also review the code yourself. The skill is not a scanner and not a formal audit, and adapting examples to a non-Node.js stack may introduce mistakes.
- Confirm JWT_SECRET is set from the environment, not hardcoded.
- Confirm the JWT verify call lists allowed algorithms explicitly.
- Confirm login errors are generic.
- Confirm failed logins and privilege escalation attempts are logged.
What people use it for
- Adding bcrypt password hashing and a login route to an Express and pg app.
- Replacing string-built SQL queries with parameterized queries.
- Validating signup or login form input with Zod before it reaches your database.
- Setting up JWT issuance and verification with an explicit HS256 allowlist.
- Working through an OWASP Top 10 checklist for a Node.js API and listing tests to run.
Frequently asked questions
How do I install the secure-code-guardian skill?
Download the ZIP from the skill's page in this directory and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Is the Secure Code Guardian skill free?
The skill is published under the MIT licence, as stated on its page. Check the licence file in the download for the full terms.
What do I need to use the skill?
You need a Node.js project, since the examples are TypeScript and reference bcrypt, pg, zod, jsonwebtoken, express, express-rate-limit and helmet. The JWT example also needs a JWT_SECRET environment variable. Curl or Mozilla Observatory is optional for header checks.
Does the skill run scripts or access the network?
According to its listing, the skill runs no scripts and uses no network access. It provides guidance, code examples and reference files.
Can I use it for a non-Node.js project?
The code examples are TypeScript and Express focused, so the agent has to adapt them to your stack. That adaptation may introduce mistakes, so review the output carefully.
Is this skill enough for a security audit or OAuth/SSO setup?
No. The skill is guidance and examples, not a scanner or formal audit. Its own description says to consider a more specialized skill for pre-built OAuth/SSO integrations or standalone security audits.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use Secure Code Guardian if you are building login, sessions, JWT-based APIs or input validation in Node.js and want secure defaults and a test checklist. Pick a different skill for pre-built OAuth or SSO, formal security audits, or production security sign-off, and do not rely on it alone for non-Node.js stacks.
Download the skill