DeFroe

Security Notice Response — Security skill for Claude Code

Security community

Config-driven Claude Code skill: triage a security/malfunction notice for a client website, fix or delegate it, document it, and draft a client update email — with safe defaults.

How to install Security Notice Response

This entry records only its repository, not the path inside it, so there is no exact command to give. Open DeFroe/security-notice-response and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Security Notice Response does

Config-driven Claude Code skill: triage a security/malfunction notice for a client website, fix or delegate it, document it, and draft a client update email — with safe defaults.

Alternatives in Security

Security Scan Report — Generated: 2026-04-10 20:48 UTC Skills scanned: 134 Total findings: 836 Critical: 32 High: 50 Safe skills: 100 18.1k ★
Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Curate Security Results — Run Security Tests & Curate Results — Public-Safe Snapshots 295 ★

README

Security Notice Response

A [Claude Code skill](https://docs.claude.com/en/docs/claude-code/skills) for people who maintain live websites or apps for clients. Hosting providers, npm/GitHub, and registrars all send a steady stream of security scans, dependency advisories, and account notifications - and it's easy for them to either get ignored, or get fixed quietly with the client never finding out anything happened. This skill turns "notice arrived" into a repeatable path: triage it, fix it (or delegate the fix), record it internally, and tell the client in plain language - without reinventing the process, or the wording, every time.

It works across any number of client projects. Each project gets one small config file describing its own paths, contacts, and rules; the skill itself carries no client-specific assumptions.

Install

Clone this repo directly into your Claude Code skills folder:

git clone https://github.com/DeFroe/security-notice-response ~/.claude/skills/security-notice-response

Or download it and copy the folder contents into `~/.claude/skills/security-notice-response/` yourself. Either way, restart/reopen Claude Code so it picks up the new skill.

Quick start

Open a session in the client project you want to set this up for.
Paste in (or describe) the first notice you want handled - e.g. "hosting flagged 6 vulnerabilities on the Acme Retail site." If there's no project config yet, the skill will notice and walk you through creating one - a single Markdown file, security-response.config.md, in that project's repo (see references/project-config.md for the full schema, examples/example-project-config.md for a filled-in sample).
From there it runs the workflow: triage → fix (or hand off, if you configured a delegate) → internal documentation → a client-facing email draft → a log entry.

By default, client emails are **drafted for your approval**, never sent automatically. If you want a specific project to send withou