DilshanSandhu25

Secure Build — Testing skill for Claude Code

Testing community

Two skills that make AI coding agents secure each feature as they build it — add the defense, write a test proving the misuse fails.

How to install Secure Build

This entry records only its repository, not the path inside it, so there is no exact command to give. Open DilshanSandhu25/secure-build and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Secure Build does

Two skills that make AI coding agents secure each feature as they build it — add the defense, write a test proving the misuse fails. Stops endpoints anyone can read.

Alternatives in Testing

Add Plugin — Integrate a spec-driven/skill framework as a bundled agtx plugin 1.5k ★
Add Scaffold — 按 14-phase 工作流为指定 app 编写清理 scaffold（含需求采集、实测勘测、TOML、safety test、UI 集成） 1.3k ★
Add Example Test App — Add a new example app or test app to the GT monorepo 1.1k ★

README

secure-build

**Stops your AI agent from shipping endpoints anyone can read.**

Two skills for AI coding agents that handle application security during the build instead of after it.

The problem they address: coding agents write the working version and leave security for later. You notice weeks in that any logged-in user can read any other user's data, and fixing it means revisiting every endpoint you've written. Doing it at write time costs minutes per feature.

Skill	What it does	When it runs
`secure-build`	Hardens each feature as it's written, with an abuse-case test proving the misuse fails	Automatically, at feature boundaries
`runtime-probe`	Probes a running dev instance for failures that only appear at runtime	Only when you ask, against a dev target

They're a pair. The first prevents, the second confirms. If the first is doing its job, the second should find very little — that's the intended outcome, not a failed probe.

Install

Both skills work in Claude Code and Codex CLI unchanged.

git clone https://github.com/YOURNAME/secure-build
cd secure-build
./install.sh

That copies both skills into `~/.claude/skills/` and `~/.codex/skills/`, whichever exist. For one skill only: `./install.sh secure-build`.

In Codex, start with `codex --enable skills`.

**By hand**, if you'd rather. Copy the `secure-build/` and `runtime-probe/` folders into `~/.claude/skills/` or `~/.codex/skills/`. For a project-scoped install your team gets automatically, copy them into `.claude/skills/` in your repo and commit. The folder names must stay as they are, with `SKILL.md` directly inside each.

Verify it works, in two minutes

`examples/vulnerable-api/` is a small orders API whose test suite passes 5/5 and which has two real security holes in it. Run the suite, run the skill, and watch what it finds — including whether its abuse tests genuinely fail before the fix is applied.

Don't take the claims in this README on trust. T