n-shadloo

Secure Code Auditor — Security skill for Claude Code

Security community

Backend security Agent Skill that helps AI audit code, detect vulnerabilities, and generate secure-by-default backend applications, with deep Django/DRF coverage and guidance for any backend stack.

How to install Secure Code Auditor

This entry records only its repository, not the path inside it, so there is no exact command to give. Open n-shadloo/secure-code-auditor and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Secure Code Auditor does

Backend security Agent Skill that helps AI audit code, detect vulnerabilities, and generate secure-by-default backend applications, with deep Django/DRF coverage and guidance for any backend stack.

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Query Token Audit — Audit token security to detect scams, honeypots, and malicious contracts across BSC, Base, Solana, and Ethereu 483 ★
Fix Secdeps — Audit and fix Dependabot security vulnerabilities across the monorepo 390 ★

README

secure-code-auditor

A Claude Agent Skill for backend security work. It reviews existing code for vulnerabilities and applies secure defaults while new code is written. The deep specialty is Django and Django REST Framework; underneath that sits a general OWASP layer that applies to any backend stack, so the same skill is useful whether or not you're on Django.

Why this exists

Backend security review is repetitive and easy to do inconsistently. The high- risk areas — access control, injection, auth and tokens, serializer exposure, secrets, deployment settings — are well understood, but they're spread across a lot of documentation and they change (Django ships security releases regularly). This skill packages that knowledge so an agent applies it the same way every time, and points a reviewer straight at the parts that matter.

It's organized on the OWASP Top 10 (2025) as a spine. Each category has two layers: a short, stack-agnostic explanation of the vulnerability and its defense, then a deep Django/DRF section with the actual settings, code, and gotchas. Findings always carry a CWE and an OWASP mapping; where a project is genuinely held to OWASP ASVS 5.0, they can carry an ASVS chapter as well. The methodology file maps all seventeen ASVS chapters onto the reference files, and says plainly which two are permanent non-goals for a backend skill, where the coverage is only partial, and where this skill covers ground ASVS scopes out entirely. ASVS has no chapter for agent and MCP tool surfaces, so that file carries a spine of its own: the OWASP LLM Top 10 2026 and Agentic Top 10, mapped section by section at entry-token level, with the entries a backend skill declares non-goals named rather than stretched to fit.

Security topics don't sort cleanly into ten boxes, so the router is grouped — the OWASP spine, then cross-cutting surfaces, then package decisions — and every topic that more than one file could plausibly own has a single named owner. Rate limiting, o