Premium Coding

Security Best Practices skill

Secure-by-default coding advice and written security reports by language.

A Premium skill. Premium opens soon.

By: OpenAI
Licence: Apache-2.0
Installs: 10.9K
Works in: 17 apps

Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.

Then check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is ---security.md. You should also check if there is a -general--security.md which is agnostic to the framework you may be using.

If working on a web application which includes a frontend and a backend, make sure you have checked for reference documents for BOTH the frontend and backend!

If you are asked to make a web app which will include both a frontend and backend, but the frontend framework is not specified, also check out javascript-general-web-frontend-security.md. It is important that you understand how to secure both the frontend and backend.

If no relevant information is available in the skill's references directory, think a little bit about what you know about the language, the framework, and all well known security best practices for it. If you are unsure you can try to search online for documentation on security best practices.

From there it can operate in a few ways.

The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.

The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.

The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe anyways the project fails to follow security best practices guidance. The report should be prioritized and have clear sections of severity and urgency. Then offer to start working on fixes for these issues. See #fixes below.

Workflow Decision Tree

If the language/framework is unclear, inspect the repo to determine it and list your evidence.

If matching guidance exists in references/, load only the relevant files and follow their instructions.

If no matching guidance exists, consider if you know any well known security best practices for the chosen language and or frameworks, but if asked to generate a report, let the user know that concrete guidance is not available (you can still generate the report or detect for sure critical vulnerabilities)

No example output yet, so this is the start of the skill’s own instructions.

What Security Best Practices makes

Spots your project's languages and frameworks, then loads the matching security guidance and uses it while writing or reviewing code. It can also produce a prioritised security report on request.

Bundled guides cover Python (Django, FastAPI, Flask), JavaScript and TypeScript (Express, Next.js, React, Vue, jQuery) and Go. The report is saved as a markdown file with an executive summary, severity sections and line numbers.

Best for: Developers using common web stacks who want secure defaults without being security experts.

Detects your languages and frameworks first
Guides for Python, JavaScript, TypeScript and Go stacks
Writes secure code by default or flags big issues passively
Optional prioritised report with line numbers

Example prompts

Type something like this once the skill is added. Your app opens the skill when the request matches.

Write this Flask endpoint securely
Give me a security best-practices report for this repo
Review my Next.js app for security problems
What should I fix first in this Express server?

What’s inside

14 files in the skill folder, with its Apache-2.0 licence kept inside. Only text instructions and reference files, no program files.

SKILL.md the instructions
agents/ 1 files
references/ 10 files
LICENSE licence
LICENSE.txt licence

Which apps it works in

A skill is a folder of plain files, so any app that reads the open skills format can use it. Pick your app for its page.

How to add Security Best Practices to your app

Step by step for each app. We say where to click, so you never need to leave this page.

ChatGPTby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Open the ChatGPT desktop app and look for Skills in the sidebar, where standalone skills are listed.
3 Add the “security-best-practices” folder there if your version offers it. If you do not see Skills yet, use this skill in Claude or Codex instead.
4 In a chat, type @ and pick the skill, or just ask. Ask for what you want, for example: “Write this Flask endpoint securely”

To make your own, describe the workflow to @skill-creator in ChatGPT Work and it drafts a skill for you.

More ChatGPT skills

Claude appby Anthropic

1 Download the skill (.zip) with the button at the top of this page.
2 In the Claude app, open Settings > Features.
3 Upload the .zip file.
4 Ask for what you want, for example: “Write this Flask endpoint securely”

The current Claude Help Center lists Free, Pro, Max, Team and Enterprise. Organization policy can restrict uploads and sharing. Chat runs code in an isolated environment; uploading a skill does not give it your local project, coding-agent tools or unrestricted network access.

More Claude app skills

Codexby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Codex and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Codex

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Codex skills

Claude Codeby Anthropic

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.claude/skills
3 Or paste the install prompt below into Claude Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Claude Code

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.claude/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: claude plugin marketplace add <owner/repo>

Built-in installer: claude plugin install <plugin>@<marketplace>

To use the skill in one project only, put it in .claude/skills inside that project instead.

More Claude Code skills

Cursor

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.cursor/skills
3 Or paste the install prompt below into Cursor and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Cursor

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.cursor/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .cursor/skills inside that project instead. Cursor also reads ~/.agents/skills, ~/.claude/skills, ~/.codex/skills.

More Cursor skills

GitHub Copilotby GitHub

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into GitHub Copilot and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into GitHub Copilot

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.copilot/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gh skill install <owner/repo> <skill> --agent github-copilot --scope user

To use the skill in one project only, put it in .github/skills inside that project instead. GitHub Copilot also reads ~/.agents/skills.

More GitHub Copilot skills

Gemini CLIby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.gemini/skills
3 Or paste the install prompt below into Gemini CLI and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Gemini CLI

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.gemini/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gemini skills install <git-url>

To use the skill in one project only, put it in .gemini/skills inside that project instead. Gemini CLI also reads ~/.agents/skills.

More Gemini CLI skills

Windsurf

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.codeium/windsurf/skills
3 Or paste the install prompt below into Windsurf and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Windsurf

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.codeium/windsurf/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .windsurf/skills inside that project instead.

More Windsurf skills

Kiro

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.kiro/skills
3 Or paste the install prompt below into Kiro and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Kiro

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.kiro/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .kiro/skills inside that project instead.

More Kiro skills

Antigravityby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.gemini/antigravity/skills
3 Or paste the install prompt below into Antigravity and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Antigravity

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.gemini/antigravity/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Antigravity skills

OpenCode

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.config/opencode/skills
3 Or paste the install prompt below into OpenCode and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into OpenCode

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.config/opencode/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .opencode/skills inside that project instead. OpenCode also reads ~/.agents/skills, ~/.claude/skills.

More OpenCode skills

Cline

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Cline and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Cline

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Cline skills

Amp

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.config/agents/skills
3 Or paste the install prompt below into Amp and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Amp

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.config/agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: amp skill add <github-url> --global

To use the skill in one project only, put it in .agents/skills inside that project instead. Amp also reads ~/.agents/skills, ~/.config/amp/skills, ~/.claude/skills.

More Amp skills

Gooseby Block

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Goose and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Goose

To use the skill in one project only, put it in .agents/skills inside that project instead. Goose also reads ~/.claude/skills.

More Goose skills

OpenClaw

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.openclaw/skills
3 Or paste the install prompt below into OpenClaw and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into OpenClaw

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.openclaw/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: openclaw skills install @owner/<slug>

Built-in installer: openclaw skills install @owner/<slug> --global

Built-in installer: openclaw skills install git:owner/repo@ref

To use the skill in one project only, put it in skills inside that project instead. OpenClaw also reads ~/.agents/skills.

More OpenClaw skills

Hermes Agentby Nous Research

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.hermes/skills
3 Or paste the install prompt below into Hermes Agent and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into Hermes Agent

I downloaded the agent skill "Security Best Practices" as security-best-practices.zip. Unzip it and copy the security-best-practices folder into ~/.hermes/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: hermes skills install <owner/repo/skill>

More Hermes Agent skills

VS Codeby Microsoft

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-best-practices” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into VS Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Write this Flask endpoint securely”

Install prompt: paste this into VS Code

To use the skill in one project only, put it in .github/skills inside that project instead. VS Code also reads ~/.claude/skills, ~/.agents/skills.

More VS Code skills

Questions about Security Best Practices

Which languages are covered?

Python, JavaScript, TypeScript and Go, with specific guides for several frameworks.

What if my framework has no guide?

The skill falls back on general best practice and tells you concrete guidance was not available if you ask for a report.

Is the Security Best Practices skill free?

It is a Premium skill on Best Agent Skills. Premium opens soon, with monthly, yearly and lifetime plans on the pricing page.

Who made the Security Best Practices skill?

OpenAI. We did not write it. Best Agent Skills curates skills like this one, explains them in plain words and shows how to add them to your app. It is shared under the Apache-2.0 licence (Copyright [yyyy] [name of copyright owner]).

Security Best Practices skill

What Security Best Practices makes

Example prompts

What’s inside

Which apps it works in

How to add Security Best Practices to your app

Questions about Security Best Practices

Skills like Security Best Practices