Claude Code security skills
Short answer: pair a review skill with a scanner skill. Sentry's security-review reads your code like a reviewer. Trail of Bits' semgrep and codeql skills run real static analysis tools. Our database tags 8,736 open-license skills for security, and these 5 come from Sentry, OpenAI, Trail of Bits and Anthropic.
Want picks for your own repo? Scan your project free. You see the match count and 2 picks. The full list is $9 once, up to 30 ranked picks for that scan.
5 security skills to start with
| Skill | Repo | License | What it covers | Install |
|---|---|---|---|---|
| security-review | getsentry/skills | CC-BY-SA-4.0 | Security code review for vulnerabilities | npx skills add getsentry/skills --skill security-review --agent claude-code |
| security-best-practices | openai/skills | Apache-2.0 | Language and framework security checks with fixes | npx skills add openai/skills --skill security-best-practices --agent claude-code |
| semgrep | trailofbits/skills | CC-BY-SA-4.0 | Runs a Semgrep scan with rulesets picked for your languages | npx skills add trailofbits/skills --skill semgrep --agent claude-code |
| codeql | trailofbits/skills | CC-BY-SA-4.0 | Runs CodeQL data flow and taint analysis | npx skills add trailofbits/skills --skill codeql --agent claude-code |
| claude-security | anthropics/claude-plugins-official | Apache-2.0 | Scans the repo, a branch diff or one commit | npx skills add anthropics/claude-plugins-official --skill claude-security --agent claude-code |
The npx skills command comes from the open skills CLI. The --agent claude-code flag puts the skill in .claude/skills/, where Claude Code looks for it. Swap the flag for cursor or codex to install the same SKILL.md for those agents.
Review skill or scanner skill
A review skill gives Claude Code a checklist. It reads the code and reports what looks unsafe. A scanner skill runs a tool such as Semgrep or CodeQL and has Claude Code explain the results. The scanner skills need that tool on your machine. Read each SKILL.md first so you know what it runs.
Related guides
For general PR review, see Claude Code skills for code review. For Python and Django projects, the Python guide lists stack picks. New to skills? Start with how to install Claude Code skills.
FAQ
Does Anthropic publish a security skill?
Yes. claude-security is in Anthropic's claude-plugins-official repo, and it is in the table above.
Can a skill replace a security audit? No. A skill helps Claude Code find common issues before review. High-risk code needs a paid audit or a security team.
Do the Semgrep and CodeQL skills install those tools? The skill holds instructions. Install Semgrep or the CodeQL CLI on your own, then the skill tells Claude Code how to run them.
Are these skills free? All 5 are open license. Check each license in the table before you use it at work.
Checked 2026-10-24. Prices and policies change. Confirm on the source before you buy.
Sources
- https://skillspicker.com/pricing/
- https://code.claude.com/docs/en/skills
- https://github.com/vercel-labs/skills
More guides
- Best Claude Code skills for Next.js: 3 free picks and how to install them (2026)
- Best Claude Code skills for Python: 6 free picks and how to install them (2026)
- Claude Code frontend design skill: how to install it, plus 4 more UI picks (2026)
- Claude Code Playwright skill: 5 picks and how to install them (2026)
- Claude Code skills for code review: 5 free picks with install commands (2026)
- Claude Code skills for React and React Native: 6 free picks (2026)