web-security-skill

Context-aware web security patterns. Auto-detects what feature you are building and injects the right security. Works with Cursor, Copilot, Windsurf, Claude, ChatGPT. 16 auto-apply patterns for Next.js, React, Express.

Multi-agent — Targets three or more agents

Works with

Claude
Cursor
Copilot

View on GitHub

336 GitHub stars (336)

1 skill (1 skills found in its SKILL.md files)
54 forks (54 forks)
3mo ago last update (Last updated 3mo ago)

Install

Skills CLI

npx skills add mrhlaingbwardev/web-security-skill

Asks which agents to install it for. Add -g to install it for every project.

Claude Code

git clone https://github.com/mrhlaingbwardev/web-security-skillcp -r "web-security-skill" ~/.claude/skills/web-security-skill

Copies the web-security skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).

Plugin

/plugin marketplace add mrhlaingbwardev/web-security-skill

Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.

Skills can run code on your machine — read the SKILL.md first.

What it does

In the author's own words, from each skill's SKILL.md.

web-security

SECURE BY DEFAULT. When building login, API routes, file uploads, database queries, payments, user content, admin panels, webhooks, forms, password reset, OAuth, or any web feature — auto-detect what the user is building and inject the correct security patterns BEFORE it ships. Prevents env leaks, XSS, SQLi, IDOR, CSRF, SSRF, path traversal, mass assignment. Frameworks: Next.js, React, Express, R…
SKILL.md on GitHub (opens in a new tab)

Review before you install

A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.

Encoders & Decoders

Hash Generators

Code Formatters

HTML Tools

JavaScript Tools

Network Tools

Database Tools

Development Tools

Miscellaneous Tools

web-security-skill