The 8 Best Claude Code Skills for Security in 2026

A Claude Code security skill is a set of natural-language instructions your agent loads and follows during a session — which means installing an unvetted one is closer to running someone else's code than adding a linter config. That distinction is the whole ballgame for this category. The eight skills below are real entries in the public agent-skill registry, each tied to a named author, and each judged on scan rating, source transparency, and what it actually checks. To carry any of them across every agent your team uses — Claude Code, Cursor, Codex, Copilot — BuildBetter CLI (run as bb, at tryzeroshot.com) is the context layer that makes vetted skills run everywhere and keeps an audit trail of what ran on which change.

This guide covers why a skill install is a supply-chain decision, how to read a scan rating before you trust it, the eight skills worth adopting in 2026, and the vetting workflow that keeps you honest.

Why a Security Skill Is a Supply-Chain Decision, Not a Convenience

A security skill is instructions your agent will execute with real tool access — file reads, network calls, git operations — so vetting one is a supply-chain decision, not a convenience toggle. The blast radius is comparable to adding a dependency, even though the artifact is prose rather than a package.

The threat model has four main vectors:

• Prompt-injection payloads embedded in the skill text itself.
• Warning suppression — instructions that tell the agent to downgrade or ignore security flags.
• Exfiltration via legitimate tool calls — a skill that reads secrets and ships them out through a normal network request.
• Insecure defaults disguised as best practice — advice that looks authoritative and is quietly wrong.

OWASP's 2025 LLM Top 10 ranks prompt injection (LLM01) as the number-one risk to LLM applications, with insecure output handling and supply-chain vulnerabilities also in the top tier. A skill file is model input, so it is a prompt-injection surface by definition. That's why the registry's scan rating — safe, low, medium, high, or unknown — is the headline metric for this category, not a footnote.

Set expectations up front: security skills catch classes of bugs. They are not a substitute for a human security review or a real SAST/DAST pipeline.

Software supply-chain attacks have grown by triple-digit percentages year over year since 2021, with malicious packages in open registries a leading vector. Agent skills are the newest version of that surface — prose-based, but with an agent standing by to act on it.

How to Read a Skill's Security Scan Before You Install

Read the scan rating first, then the source — in that order, every time. skillrank is an open-source tool that indexes the public agent-skill registry and exposes, per skill, a security scan rating, the GitHub source URL, detected tech stacks, and eval results. It is also available as bb skills <command> inside BuildBetter CLI.

The five ratings, explained

• Safe — passed scanning with no flags; trustworthy as a default.
• Low — minor concerns, generally fine to adopt without a deep read.
• Medium — warrants a manual read of the source before you install.
• High — read the source carefully and default to skipping unless you understand exactly why the flags exist.
• Unknown — the skill was never scanned. This means unscanned, not clean. Treat it as a prompt to open the source, not a green light.

Commands you can run today

• skillrank search <query> — find skills by keyword.
• skillrank show <ref> — read the scan rating, source URL, and detected stacks.
• skillrank install <ref> — a hash-verified, pinned install so the exact text you audited is the text that runs.
• skillrank recommend — surface skills matched to your repo's detected stack.
• skillrank eval <ref> — a local paired evaluation of whether the skill improved outputs.

Hash-pinning is the single most under-appreciated control here. A skill you read last month can be silently rewritten upstream. Pinning to a verified hash means what you audited is what runs.

The 8 Best Claude Code Security Skills for 2026

The strongest posture layers skills: broad first-party guidance as a baseline, a review pass, enforcement at commit time, and CI wiring so nothing is optional. Confirm each live scan rating with skillrank show <ref> before you install — ratings change as scanners and skill files update.

1. anthropics/security-guidance

First-party general security guidance from Anthropic. Broad coverage of injection, secrets handling, and unsafe defaults, which makes it the safest default starting point for any team. Anthropic's Agent Skills feature launched publicly in 2025, and this is the reference implementation of what good guidance looks like. Confirm a safe rating via skillrank show. Source: github.com/anthropics/security-guidance.

2. addyosmani/security-and-hardening

Application hardening focus — security headers, CSP, dependency hygiene, and secure configuration. Strongest for web-app teams that want defense-in-depth checks baked into the agent. Confirm safe/low before install. Source: github.com/addyosmani.

3. luongnv89/code-review-specialist

A security-aware review pass that flags injection, XSS, and auth mistakes during PR review rather than after merge. Pairs naturally with anthropics/security-guidance to move detection left. Confirm safe/low. Source: github.com/luongnv89.

4. wshobson/solidity-security

Smart-contract-specific checks — reentrancy, access control, and arithmetic issues — for teams shipping on-chain code. Language-specific, so only install it where it applies. Confirm the rating for the current release. Source: github.com/wshobson.

5. mattpocock/code-review

A general review skill that catches unsafe patterns as part of a broader quality pass. Useful, but not a dedicated security tool — pair it with anthropics/security-guidance so you get depth on the security side. Confirm safe/low. Source: github.com/mattpocock.

6. mattpocock/setup-pre-commit

Enforces pre-commit hooks so secret-scanning and linting run before code ever reaches a branch. This is the enforcement-at-commit-time layer — it stops leaked secrets in diffs before review even happens. Confirm safe/low. Source: github.com/mattpocock.

7. obra/requesting-code-review + obra/receiving-code-review

Process skills that make review consistent and reviewable, closing the human-in-the-loop gap that security tooling can't fill on its own. They standardize how review is requested and received so nothing slips through on a busy day. Confirm ratings for both. Source: github.com/obra.

8. addyosmani/ci-cd-and-automation

Wires security checks into CI so scans are enforced, not optional — the automation backbone behind the review skills above. Without this layer, everything else is advisory. Confirm safe/low. Source: github.com/addyosmani.

Comparison Table: The 8 Skills at a Glance

Confirm the live scan rating with skillrank show <ref> before you adopt any of these — ratings can change as scanners and skill files update.

Skill ref	Author	Primary focus	What it catches	Best for	Verify rating
Carried across all agents via BuildBetter CLI	BuildBetter / BB-Skills	Running vetted skills everywhere + audit trail	Consistency + which skill ran on which change	Whole teams on multiple agents	bb skills show
anthropics/security-guidance	anthropics	General security guidance	Injection, secrets, unsafe defaults	Everyone (baseline)	skillrank show
addyosmani/security-and-hardening	addyosmani	App hardening	Headers, CSP, config, deps	Web apps	skillrank show
luongnv89/code-review-specialist	luongnv89	Security-aware review	Injection, XSS, auth mistakes	PR review gate	skillrank show
wshobson/solidity-security	wshobson	Smart-contract security	Reentrancy, access control, arithmetic	On-chain code	skillrank show
mattpocock/code-review	mattpocock	General review	Unsafe patterns broadly	Quality + security combined	skillrank show
mattpocock/setup-pre-commit	mattpocock	Commit-time enforcement	Secrets in diffs, lint failures	Shift-left secret scanning	skillrank show
obra/requesting + receiving-code-review	obra	Review process	Inconsistent / skipped review	Human-in-the-loop discipline	skillrank show
addyosmani/ci-cd-and-automation	addyosmani	CI enforcement	Skipped / optional scans	Automation backbone	skillrank show

Language-specific vs. stack-agnostic: wshobson/solidity-security and language-focused packs like wshobson/python-anti-patterns only earn their place in the repos where that stack lives. anthropics/security-guidance, the review skills, and the CI/commit skills are stack-agnostic and belong on nearly every team.

What Security Skills Genuinely Catch — and What They Don't Replace

Security skills reliably catch the obvious classes of bug early, and that's genuinely valuable. The vast majority of applications contain at least one vulnerability in the OWASP Top 10 categories, with injection and misconfiguration among the most common findings in SAST scans — exactly the categories these skills are good at surfacing.

Genuinely caught:

• Common injection patterns and XSS
• Unsafe defaults and missing input validation
• Secrets leaked in diffs
• Weak crypto choices

Not replaced:

• Architecture-level threat modeling
• Business-logic authorization flaws
• Dependency CVE tracking
• Penetration testing and a real human security review

Treat skills as a first pass that reduces noise and clears the easy findings, freeing reviewers to focus on the hard problems a model can't reason about. The honest limit: a skill is a set of instructions the model may or may not follow well on any given run. That variability is precisely why measuring impact matters more than trusting a stated purpose.

The Vetting Workflow: Search, Scan, Read Source, Install, Evaluate

Apply the same discipline you'd give any dependency — the difference is the artifact is prose, so the review burden is minutes, not days.

Step 1 — Search

Run skillrank search security or skillrank recommend to surface skills matched to your repo's detected stack. Recommendation cuts the noise fast.

Step 2 — Scan

Run skillrank show <ref> and read the rating. Safe and low can be trusted as defaults. Medium and high should trigger a manual read. Unknown is a prompt to open the source — never a green light.

Step 3 — Read the source

Follow the GitHub link and actually read the skill file. Because skill files are short and human-readable, reading the source is realistic in a way that reading a transitive npm dependency tree never is. Look for warning suppression, tool calls that touch the network, and advice that contradicts known best practice.

Step 4 — Install

Run skillrank install <ref> for a hash-verified install pinned into the repo. This protects you against silent upstream edits after your review.

Step 5 — Evaluate

Run skillrank eval <ref> to execute a local paired evaluation on your own repo and agent. This measures whether the skill actually improved outputs before you trust it in every review. An empirical eval beats a stated purpose every time.

Making Security Skills Consistent Across Every Agent and Teammate

A vetted skill only helps if it runs in whatever agent each teammate uses — not just yours. Roughly 75–80% of professional developers now report using AI coding tools, and on any real team those tools are split across Claude Code, Cursor, Codex, and Copilot. If a security review skill only fires for the two people on Claude Code, your convention isn't a convention.

BuildBetter CLI (run as bb, at tryzeroshot.com) is the context layer that carries vetted skills across agents so security conventions are consistent for the whole team, not per-person. It works with Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI, Windsurf, and Amazon Q.

• BB-Skills extends the AGENTS.md standard with composable skill packs that load only when relevant — so a security review skill fires on the right files instead of bloating every prompt. Skills are open source at github.com/buildbetter-app/BB-Skills.
• Every session is saved and indexed — an audit trail of which skills ran on which change, which is exactly what a security review asks for when the question is "what checked this?"

Honest positioning: BuildBetter CLI doesn't scan skills — skillrank does. BuildBetter CLI makes the vetted skills run everywhere and keeps the trail. Skills like /bb-review, /bb-specify, and /bb-plan carry your team's actual playbook into every PR. Teams at Brex, Rappi, PostHog, and Procore use this layer so security conventions travel with the change, not with the person.

Two adjacent tools worth knowing: KiroCrew handles audit logging and OS-level sandboxing on your own hardware, and agent-hop does cross-agent session search. They solve neighboring problems if your threat model calls for them.

Frequently Asked Questions

Are Claude Code security skills safe to install?

Only after two checks: confirm the scan rating (via skillrank show <ref>) and read the source skill file on GitHub. A skill is a set of instructions your agent will follow with real tool access, so an unvetted skill is a genuine supply-chain risk — closer to running someone else's code than adding a linter config. Prefer skills rated safe or low from named authors, and pin the install to a verified hash.

What does an 'unknown' scan rating mean?

It means the skill has not been scanned — not that it's clean and not that it's dangerous. Treat unknown as a prompt to open the GitHub source and review the instructions manually before using it. Because skill files are short prose, a manual read is quick and is the correct response to an unscanned skill.

Do security skills replace a security review?

No. Security skills reliably catch common injection patterns, XSS, unsafe defaults, missing input validation, secrets leaked in diffs, and weak crypto choices. They do not cover architecture-level threat modeling, business-logic authorization flaws, dependency CVE tracking, or penetration testing. Use them as a first pass that frees human reviewers to focus on the hard problems, not as a substitute for a real SAST/DAST pipeline or human review.

Which security skill should most teams start with?

anthropics/security-guidance — it's first-party guidance from Anthropic with broad coverage of injection, secrets handling, and unsafe defaults, making it the safest default starting point. Pair it with a review-focused skill like luongnv89/code-review-specialist so security issues get flagged during PR review rather than after merge.

How do I know a security skill actually helps?

Run skillrank eval <ref>. It performs a local paired evaluation on your own repo and agent, measuring whether the skill actually improved outputs before you trust it across every review. Because a skill is just instructions the model may or may not follow well, an empirical eval is more reliable than the skill's stated purpose.

How do I keep security skills consistent across my team's different agents?

Use a context layer like BuildBetter CLI to carry vetted skills across Claude Code, Cursor, Codex, and Copilot, and to keep an audit trail of what ran on which change. That turns a per-person habit into a team-wide convention.

Ship at the speed of insight.

Vet your security skills with skillrank, then make the vetted ones run everywhere your team codes. Install BuildBetter CLI to carry security conventions across every agent and keep a full audit trail of what checked each change.