The Best Security and Authentication Skills for Claude Code

Security skills are the easiest to install and the hardest to trust. Here is what three of them actually do — and the one check that matters more than any score.

Security is the dimension we score most conservatively and the one most people over-read. Across 628 skills, 92% score 9 or above, because almost everything published is genuinely clean. The interesting question is not "is this safe" but "does it do the specific thing I need".

These three are the security skills that scored 8.5 or higher and address different parts of the problem.

The skills worth installing

secure-code-guardian — 9.3 · Developer Tools

Authentication and authorization implementation, input handling, and secure defaults. The highest-scoring security skill in the directory. It is aimed at the writing phase — it tells the agent how to build auth correctly before the code exists, which is where most vulnerabilities are actually introduced.

security-reviewer — 9.0 · Developer Tools

The review phase counterpart: it reads existing code and produces a structured audit report with severity and remediation. Use it on code you already have, especially before a release or after accepting a large diff from an agent.

security-and-hardening — 8.5 · Developer Tools

Hardening rather than authoring: input validation, dependency handling, and defensive configuration. It overlaps with secure-code-guardian, but focuses on making an existing application harder to abuse rather than on getting the initial implementation right.

The distinction that matters

These three map onto three different moments — build it, review it, harden it — and that is the right way to choose between them. Installing all three is reasonable; installing one and expecting it to cover the others is not.

What they do not do is audit a third-party skill before you install it. That is a different problem: you need to read the skill's capability manifest — what it reads, what it sends, what it persists — and compare it against what its description claims. A skill that formats spreadsheets has no business reading your keychain.

How to choose

• Writing new auth? Start with secure-code-guardian.
• Have code to inspect? security-reviewer produces an artifact you can act on.
• Shipping an existing app? security-and-hardening addresses configuration and input handling.

One caveat worth repeating from our methodology: the security score is a floor, not a ranking signal. It matters enormously when it fails — a confirmed credential or exfiltration finding caps a skill at 39/100 — but among published skills it barely differentiates. Read the rationale on the skill page rather than trusting the number alone.

The full security write-up is at security.