What does this skill do, and when should you use it?
This skill is intended for explicit requests involving security best-practice guidance, security reviews, reports, or secure-by-default coding. It supports Python, JavaScript/TypeScript, and Go, and identifies the languages and primary frameworks in scope. It reads matching reference material to guide secure code, passive detection of major issues, or prioritized vulnerability reports. It comes from the deprecated openai/skills catalog, whose README points current examples to the OpenAI Plugins repository.
Identifies all relevant languages and primary frameworks; reads matching security documents from the skill's references directory; uses that guidance to write secure-by-default code or passively flag major vulnerabilities; produces reports with an executive summary, numbered findings, severity, urgency, impact statements, and code line numbers when requested; proposes fixes one finding at a time.
- A Python developer requests secure-by-default guidance for a backend service.
- A JavaScript or TypeScript team wants a security review and prioritized vulnerability report.
- A Go service maintainer wants major security issues identified with suggested fixes.
- A full-stack project needs security guidance checked for both its frontend and backend.
- A team wants high-impact security issues flagged passively while code is being developed.
How do you install this skill?
- Core guidance depends on the references directory, which is not fully supplied; verify all relevant files in the actual package.
- The fallback permits online searching; verify network reachability, source trustworthiness, and that sensitive code is not sent to external services.
- Report path, permissions, overwrite behavior, and post-fix testing or rollback procedures are unspecified.
- License, versioning, changelog, and maintenance/update ownership are not documented.
- Local filesystem
The README says curated skills can be installed in Codex with $skill-installer security-best-practices, followed by a Codex restart. The repository is deprecated, and the README recommends the OpenAI Plugins repository for current skill and plugin examples. Further installation details are not provided in the source material.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/openai/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/.curated/security-best-practices" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- review this Python project against security best practices and produce a report
- help me write this TypeScript code securely by default.
Make an explicit security request, such as “review this Python project against security best practices and produce a report” or “help me write this TypeScript code securely by default.” The skill is limited to Python, JavaScript/TypeScript, and Go; it should not trigger for general code review, debugging, or non-security tasks.
What are this skill's strengths and limitations?
- Clear supported-language and activation scope.
- Can address both frontend and backend frameworks.
- Supports secure-by-default coding, passive vulnerability detection, and formal reports.
- Report requirements include severity, priority, identifiers, and code line numbers for easier tracking.
- Limited to Python, JavaScript/TypeScript, and Go.
- The supplied material does not include the references directory, so framework coverage cannot be confirmed.
- No test suite or validation results are provided.
- The repository is deprecated, and the individual skill license file was not supplied.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Security Best Practices Review this page ✓ OpenAI · Official | 52 · Use with care | ★ 28k | 4mo ago | — |
| Clawtributor Security Reporter | 54 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
| Security Audit Skill by Cloudflare | 59 · Recommended | ★ 30k | 1mo ago | MIT |
| Prism Scanner — AI Agent Skill Security Scanner | 55 · Use with care | ★ 27 | 6mo ago | Apache-2.0 |
| Picoclaw Security Posture Review | 57 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
The README names the OpenAI Plugins repository as the current source for Codex skill and plugin examples. No other functional alternative is named in the source material.
How did FollowSkills review this skill?
The skill clearly restricts triggering, supported languages, secret handling, disabling protections, and evidence-based findings. However, it permits online searching when references are missing, and its file-writing, fix workflow, external-data boundaries, and rollback expectations are not fully specified, so points are deducted.
SKILL.md, the agent metadata, and the supplied reference specs are broadly consistent and define workflows, decision logic, report structure, and abnormal cases. Still, key behavior depends on an unshown references directory and model knowledge fallback; static evidence cannot reproduce the key paths, so the score is conservatively limited and reduced.
Trigger conditions, exclusions, and supported Python, JavaScript/TypeScript, and Go scenarios are fairly clear, with generation, passive review, and active audit modes. Input/output contracts, non-fit boundaries, Chinese-language support, and mainland-China reachability are not established, and core fallback research may depend on overseas services, so points are deducted.
The material is layered into overview, workflow, decision tree, report format, fixes, and general advice, and agent metadata is present. License, version, changelog, maintenance ownership, update path, and complete installation/reference prerequisites are not documented in the supplied skill evidence, so points are deducted.
The skill can guide secure coding, identify issues during editing, and produce structured reports; the references contain actionable rules and remediation patterns. However, output quality depends on the target repository, complete reference coverage, and reviewer judgment, with no statically verifiable representative outputs, so the score remains below the static ceiling.
Rule IDs, detection hints, evidence requirements, and remediation formats provide some audit traceability. There are no committed tests, CI execution artifacts, or independent reproduction materials, and the supplied external citations are not directly verifiable here, so only a low score is justified.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →