Common questions about installing, using, and contributing to the Claude Code Security Skills library. Click any question to expand.
How do I install these skills in Claude Code?
Drop the repo into a path Claude Code scans for skills:
git clone https://github.com/GoldenWing-360/claude-security-skills.git ~/.claude/skills/security-skillsOr, in a project: clone the repo as a sibling and reference its skills directly. Claude Code matches the YAML description of each SKILL.md against your conversation and loads the relevant one.
Do I need Claude Code specifically, or do other agents work?
No, you don't need Claude Code specifically. The skills are plain Markdown with YAML frontmatter (name, description). They work with any LLM coding agent that supports the same convention — Cursor, GitHub Copilot, OpenAI Codex CLI, Cline, Continue.dev, Gemini CLI, and others.
You can also read any SKILL.md as a runbook without any agent involvement — they're written to be useful for humans too.
How do the trigger words / skill discovery work?
Each SKILL.md has a YAML description field that doubles as the agent's discovery surface. When your conversation matches the description semantically, the agent loads that skill into context.
The descriptions in this repo follow a deliberate 3-sentence pattern:
- What the skill does
- Covers — the topics inside
- Invoke when — concrete triggering situations
The "Invoke when" sentence is where most of the discoverability lives. See the Prompt Library for examples that reliably trigger each of the 34 skills.
Why is the repo named "Claude Code Security Skills" if it works with other agents?
Pragmatic discovery. Claude Code is the largest LLM coding agent right now, and the SKILL.md YAML-frontmatter convention originates in Claude Code's design. The skills happen to also work elsewhere, but most users find them via the Claude Code naming.
The repo is explicitly not affiliated with Anthropic PBC — see the disclaimer in the main README.
Why is there no offensive / red-team content?
Defensive-only is an intentional positioning. Offensive tooling is well-served by other libraries. This repo focuses on the developer / agency / solo-operator who wants to not get hacked and respond cleanly when they do.
The patterns are distilled from real cleanup, hardening, and incident-response engagements — see the maintainer's site at goldenwing.at for the engagement side of that work. Every skill assumes the user has explicit authorization for the systems they work on.
Why 34 skills and not 754?
Different positioning. Larger libraries optimize for breadth — every Volatility3 plugin, every Sigma rule. This repo optimizes for depth per skill, distilled from real incident-response and hardening work. Each SKILL.md is 4–12KB of practitioner content, not a thin framework mapping.
If you need breadth, look at Anthropic-Cybersecurity-Skills. If you need a small set of well-tested defensive playbooks tuned for the vibe-coder era and small-team realities, this is it.
Can I use these in commercial work?
Yes. MIT license. Use in client engagements, training material, internal documentation, products. Attribution is appreciated — a link back from your own docs or a star on the repo helps others find this.
If you'd like hands-on help applying these patterns to your own systems, GoldenWing does that work directly.
How do I contribute a new skill?
Open an issue first (use the "New skill proposal" template) to confirm fit, then submit a PR. See CONTRIBUTING.md for the format and style rules.
The roadmap of currently-wanted skills is listed in CONTRIBUTING.md. Translations to other languages are welcome, especially German.
How do I report a security issue with the repo itself?
office@goldenwing.at or via private vulnerability reporting. See SECURITY.md for what counts.
The most common issue class is "a skill recommends an outdated or unsafe pattern" — those are valid and welcome security reports.
The skill descriptions used to be longer. Why are they shorter now?
Earlier descriptions were keyword-stuffed walls optimized purely for agent-discovery matching. They worked, but read poorly. The current 3-sentence pattern (what / covers / invoke when) reads naturally as prose, still triggers correctly in agents, and looks professional in the README's per-category tables.
If you find a description that fails to trigger a skill you expect, open an issue — better trigger surfaces are an ongoing improvement.
Does this work in German, French, or other languages?
The skills are written in English but agents are multilingual — German, French, Spanish, etc. prompts work fine. The agent matches semantics, not exact wording.
The maintainer also operates in German, and DACH-specific content is covered by the dach-compliance and gdpr-technical-controls skills. Translations of the skill content itself are welcome contributions.
What's the difference between index.json and the README's skill tables?
- README tables: human-readable, organized by domain, with one-line summaries.
index.json: programmatic — for agents, search UIs, or skill-discovery tooling. Contains slug, name, full description, domain, and path for each skill.
Use whichever fits your interface.
Are there plans for an MCP server, CLI, or npm package?
Possibly, depending on demand. For now the skills are static Markdown — drop them in, use them. If a CLI (skills add ... à la npm) or MCP server would solve a real problem for you, open a discussion.
Who maintains this and where can I learn more about the engagements behind the patterns?
Maintained by GoldenWing — a Vienna-based studio working on web engineering, AI integration, and infrastructure security. The skills here are distilled from real cleanup, hardening, and incident-response work across small-business WordPress sites on shared hosting, Cloudflare-fronted VPS infrastructure, and LLM-powered applications.
Specific incident details and indicators of compromise have been generalized so the guidance is portable.
Maintained by GoldenWing · Main repository · Prompt Library · Glossary