What is security-skills?

This repository is a collection of 16 security-testing skills packaged as a plugin for AI coding tools like Claude Code. Each skill is a markdown file that gives an AI assistant structured instructions for a specific stage of security work, from initial reconnaissance all the way through writing a final report. The goal is to bring a methodical approach to finding and fixing security problems in your own applications. The skills follow a defined lifecycle: discover what is exposed, map the risks, read the source code for vulnerabilities, run active tests against a staging environment, fix what you find, and document everything with severity scores. An entry-point skill called security-testing acts as the starting point. It confirms that you have authorization to test the target and then routes you to whichever phase is relevant. You can also call individual skills directly if you already know what phase you are in. The specialist skills cover a wide range of vulnerability categories. There are skills for checking whether one user can access another user's data (a common and serious flaw), for testing login and session handling, for finding SQL injection and similar input-based attacks, for reviewing API endpoints, for catching secrets like API keys accidentally left in code or version history, and for combining multiple smaller findings into a single high-impact attack path. A final pair of skills covers applying fixes and writing structured reports with CVSS severity scores. Installing the plugin takes one command using the npx skills CLI, or a couple of slash commands inside Claude Code. The skills themselves are plain markdown files, so you can also copy individual ones manually into whatever path your tool expects. The README is explicit that these skills are for testing systems you own or have written permission to test. The active testing skill in particular is scoped to staging environments and avoids destructive techniques.