/discover-security

name: discover-security
description: Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
license: MIT
metadata:
  author: rand
  version: "4.0"
compatibility: Designed for Claude Code. Compatible with any agent supporting the Agent Skills format.

Security Skills Discovery

Provides automatic access to comprehensive application security, vulnerability assessment, and security best practices skills.

When This Skill Activates

This skill auto-activates when you're working with:

• Authentication and authorization systems
• Input validation and sanitization
• Security headers (CSP, HSTS, CORS)
• Vulnerability scanning and penetration testing
• OWASP Top 10 vulnerabilities
• Secrets management (Vault, AWS Secrets Manager)
• SQL injection, XSS, or other attack prevention
• Security hardening and compliance
• Password hashing and credential management
• API security and access control

Available Skills

Quick Reference

The Security category contains 6 specialized skills:

1. **authentication** - Authentication patterns (JWT, OAuth2, sessions, MFA, password security) 2. **authorization** - Access control (RBAC, ABAC, policy engines, permissions) 3. **input-validation** - Input validation and sanitization (SQL injection, XSS, command injection) 4. **security-headers** - HTTP security headers (CSP, HSTS, X-Frame-Options, CORS) 5. **vulnerability-assessment** - Security testing (OWASP Top 10, scanning tools, pentesting) 6. **secrets-management** - Secrets handling (Vault, AWS Secrets Manager, key rotation)

Load Full Category Details

For complete descriptions and workflows:

Read ../security/INDEX.md

This loads the full Security category index with:

• Detailed skill descriptions
• Usage triggers for each skill
• Common workflow combinations
• Cross-references to related skills

Load Specific Skills

Load individual skills as needed:

Identity and access

Read ../security/authentication.md Read ../security/authorization.md

Input security

Read ../security/input-validation.md Read ../security/security-headers.md

Security operations

Read ../security/vulnerability-assessment.md Read ../security/secrets-management.md

Common Workflows

Secure Web Application

**Sequence**: Authentication → Authorization → Input validation → Security headers

Read ../security/authentication.md # User login Read ../security/authorization.md # Access control Read ../security/input-validation.md # XSS/SQL injection prevention Read ../security/security-headers.md # Browser protection

Security Audit

**Sequence**: Vulnerability assessment → Input validation → Headers → Secrets

Read ../security/vulnerability-assessment.md # OWASP Top 10 testing Read ../security/input-validation.md # Injection testing Read ../security/security-headers.md # Header configuration Read ../security/secrets-management.md # Credential security

API Security

**Sequence**: Authentication → Authorization → Input validation → Secrets

Read ../security/authentication.md # JWT/OAuth2 Read ../security/authorization.md # API access control Read ../security/input-validation.md # Request validation Read ../security/secrets-management.md # API key management

DevSecOps Pipeline

**Sequence**: Vulnerability assessment → Secrets → Input validation

Read ../security/vulnerability-assessment.md # Security scanning Read ../security/secrets-management.md # CI/CD secrets Read ../security/input-validation.md # SAST validation

Secure New Application

**Full security implementation from scratch**:

1. Identity and access

Read ../security/authentication.md Read ../security/authorization.md

2. Input protection

Read ../security/input-validation.md Read ../security/security-headers.md

3. Operations

Read ../security/secrets-management.md Read ../security/vulnerability-assessment.md

Skill Selection Guide

**Choose Authentication when:**

• Implementing user login systems
• Working with JWT, OAuth2, or sessions
• Adding multi-factor authentication
• Managing passwords and credentials

**Choose Authorization when:**

• Implementing access control
• Building role-based permissions (RBAC)
• Working with policy engines (OPA, Casbin)
• Preventing privilege escalation

**Choose Input Validation when:**

• Processing user input
• Preventing SQL injection
• Protecting against XSS attacks
• Validating file uploads
• Preventing command injection

**Choose Security Headers when:**

• Configuring Content Security Policy (CSP)
• Implementing HTTPS enforcement (HSTS)
• Setting up CORS for APIs
• Preventing clickjacking
• Hardening web applications

**Choose Vulnerability Assessment when:**

• Testing for OWASP Top 10
• Running security scans (SAST/DAST)
• Performing penetration tests
• Auditing application security
• Setting up security CI/CD

**Choose Secrets Management when:**

• Storing API keys or credentials
• Integrating with HashiCorp Vault
• Using AWS Secrets Manager or GCP Secret Manager
• Rotating encryption keys
• Managing CI/CD secrets

Integration with Other Skills

Security skills commonly combine with:

**API skills** (`discover-api`):

• API authentication and authorization
• API input validation
• API rate limiting (abuse prevention)
• Securing REST and GraphQL endpoints

**Database skills** (`discover-database`):

• SQL injection prevention
• Database connection security
• Credential management
• Row-level security

**Frontend skills** (`discover-frontend`):

• XSS prevention in React/Vue
• Content Security Policy
• Secure cookie handling
• Client-side validation

**Infrastructure skills** (`discover-infrastructure`, `discover-cloud`):

• Secrets management in deployments
• Network security
• Container security scanning

-