Security Playbook — Security skill for Claude Code

security-playbook

A security skill pack for AI coding agents. Drop it into any project to give your agent secure coding instincts — behavioral guardrails, OWASP-aligned rules for code and LLM apps, infrastructure hardening, and static analysis guidance.

Built by [Prismor](https://prismor.dev). For live threat intelligence and runtime enforcement, see [prismor](https://github.com/PrismorSec/prismor).

---

Quick start

Add this to your project's `CLAUDE.md`:

At the start of every session, read `https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.md` and follow its instructions.

That's it. Your agent will load behavioral guardrails, OWASP secure coding rules, and LLM security guidance automatically.

For Cursor/Windsurf, add the same line to `.cursorrules` or `.windsurfrules`.

---

What's inside

Skill	What it does
`behavioral-security/`	Guardrails the agent enforces on itself — blocks destructive commands, protects secrets, resists prompt injection
`code-security/`	OWASP Top 10 secure coding rules across Python, JS, Go, Java, C/C++, plus Docker, K8s, Terraform
`llm-security/`	OWASP Top 10 for LLM Applications 2025 — prompt injection, excessive agency, data poisoning, RAG security
`static-analysis/`	How to run scans, write custom Semgrep rules, and enforce patterns in CI
`semgrep/`	Ready-to-use Semgrep rule configurations

The single entry point is [`security.md`](security.md) — point your agent there and it will load what it needs.

---

Integration

Claude / Claude Code

Add to your project's `CLAUDE.md`:

At the start of every session, read the raw `security.md` from the security-playbook repo and follow its instructions:
https://raw.githubusercontent.com/PrismorSec/security-playbook/main/security.md

Or if yo