Security Best Practices Skill (OpenAI) for Claude Code

OpenAI's skill that makes your agent follow language-specific security guides when it writes code, and write a prioritized security report on request.

Installs: 11.7K; on skills.sh
Stars: 28.4K; on GitHub
Files: 12; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill points your agent at a folder of security guides, one per language and framework. The agent first works out which languages and frameworks your project uses, then reads the matching guides. The folder has 10 guides: Go backend, Express, general frontend JavaScript, jQuery, Next.js, React, Vue, Django, FastAPI and Flask.

It works three ways. The agent can write secure-by-default code, quietly flag major problems while it works, or write a full report in security_best_practices_report.md (or a path you choose) with findings sorted by severity and line numbers. It only triggers when you ask for security guidance or a review, and only for Python, JavaScript/TypeScript and Go.

Good for

Developers building Python, JavaScript, TypeScript or Go web apps who want secure defaults
Teams that want a severity-sorted security report of a codebase
Reviewers who want fixes made one finding at a time, with commit messages

Install security-best-practices

Claude Code

Copy this prompt.

Install the security-best-practices skill in Claude Code. Run this command:

npx skills add https://github.com/openai/skills --skill security-best-practices

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Sections in SKILL.md

Overview
Workflow
Workflow Decision Tree
Avoid Using Incrementing IDs for Public IDs of Resources
A note on TLS

Key facts

Author: OpenAI (openai/skills)
Repo: openai/skills, folder skills/.curated/security-best-practices
Installs on skills.sh: 11,671 as of 2026-11-02
GitHub stars: 28,447 for the whole openai/skills repo, 2026-11-02
License: Apache License 2.0 (LICENSE.txt in the skill folder)
Last repo commit: 2026-10-28
What is inside: 13 files including SKILL.md: 10 security guides in references/, LICENSE.txt and agents/openai.yaml
Repo status: The openai/skills README says the repository is deprecated and points to openai/plugins for current examples

What it includes

Looks at the repo to find every language and framework in use.
For a web app it checks both the frontend and the backend, and lists its evidence if the stack is unclear.
Files · Identify languages and frameworks
Reads the guide files that match your stack from references/.
Guide names follow <language>-<framework>-<stack>-security.md, plus a general guide per language where one exists. If no guide matches, the skill says the agent may search online.
Files · Load matching reference guides
Uses the guides when writing new code.
The primary mode, useful when starting a project or adding code.
Write · Write secure-by-default code
Flags critical issues it notices while working.
It focuses on the largest-impact problems and asks whether you want them fixed.
Read · Passive detection
Writes a prioritized report file when you ask for one.
The report has an executive summary, sections by severity, numeric finding IDs and line numbers. The default file is security_best_practices_report.md, and the agent can ask where you want it.
Write · Security report
After you read the report, makes fixes one by one.
Each fix gets a short comment, follows your normal commit and test flow, and the agent checks for regressions before changing behavior.
Runs code · Fix one finding at a time

From the official docs

Permissions

Low risk

The skill reads your code and writes a report file, and can edit code and make commits after you approve fixes. Review each fix before it is committed.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can edit code and make commits
Fixes only start after you ask. Ask for one finding at a time and check the diff, because SKILL.md itself warns that fixes may cause regressions. github.com
It may search online
If no bundled guide matches your stack, the agent may search the web. github.com

Technical details

Turning on read-only	No switch. SKILL.md says that after a report, fixes begin when you ask for them.
Talks to	SKILL.md says the agent may search online for security guidance when no guide matches
Sign-in and keys	SKILL.md names no key or sign-in.
Scopes	Reads your project files to find languages and frameworks Writes security_best_practices_report.md or another path you give Edits code and may commit, after you ask for fixes

Questions

What does the security-best-practices skill do?

It makes your agent load security guides for your language and framework, then write safer code, flag big problems, or produce a severity-sorted report. It covers Python, JavaScript/TypeScript and Go.

How do I install it?

Use the install box at the top of this page. The openai/skills README also documents installing by name inside Codex with $skill-installer, but it says the repository is deprecated.

When does it trigger?

Only when you explicitly ask for security best practices, a security review or report, or secure-by-default coding help. SKILL.md says not to trigger for general code review or debugging.

Which frameworks have a guide?

Express, Next.js, React, Vue and jQuery for JavaScript and TypeScript, plus a general frontend guide. Django, FastAPI and Flask for Python. A general Go backend guide. Other stacks get the agent's own knowledge and, if needed, an online search.

Does it change my code on its own?

Not in report mode. After the report it waits for you to ask for fixes, and for a critical issue it finds on the side it asks first. When fixing, it works on one finding at a time and follows your usual commit and test flow.

Is it safe to use?

It bundles no scripts, but the agent reads your code, writes a report file, and edits code once you approve fixes. SKILL.md also lets it search online when no guide matches.

Does it need an API key?

SKILL.md names no API key. The folder holds instructions and guide files.

Information

updated Nov 2, 2026

Repository: openai/skills
Folder: skills/.curated/security-best-practices

openai/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 1

https://github.com/openai/skills/blob/HEAD/skills/.curated/security-best-practices/SKILL.md · github.com