这是一个Claude Code的智能体技能包，专门教授Claude在15种主流技术栈中的安全编码实践。覆盖范围很广，包括Java Spring、Python Django/Flask/FastAPI、Ruby on Rails、React、Vue、Angular、Go、ASP.NET等Web框架，还有C、C++、TypeScript等编程语言，以及Terraform/OpenTofu基础设施即代码。安装一次后，Claude在编写、审查或重构代码时会自动应用相应的安全指导。适合使用这些技术栈的开发者，能显著提升代码安全性。
查看英文原文
@securityreviewai/secure coding skill A Claude Code agent skill that teaches Claude language and framework specific secure coding practices across 15 popular stacks. Install it once and Claude will apply the right guidance every time you write, review, or refactor code in any of these. Covered: Web frameworks Java Spring / Spring Boot Python Django Python Flask Python FastAPI Ruby on Rails React (incl. Next.js) Vue (incl. Nuxt) Angular Go (net/http, Gin, Echo, Fiber, Chi) ASP.NET (Core, MVC, Web API, Razor, Blazor) Languages C (C99–C23, systems / embedded / kernel adjacent) C++ (C++17/20/23) TypeScript (Node/Express/NestJS/Fastify/Deno/Bun + shared frontend) C language (non web: console, services, desktop, libraries) Infrastructure as Code Terraform / OpenTofu (AWS, Azure, GCP) Install Recommended — via skills CLI (vercel labs/skills) The skills CLI is the open agent skills package manager. It works with Claude Code, Cursor, Codex, OpenCode, and 40+ other agents, handles updates, and supports symlinks so one canonical copy is reused across agents. [安装/使用命令见下方] Update and remove: [安装/使用命令见下方] Alternative — standalone installer via npx If you don't want the skills CLI, this package also ships a self contained installer: [安装/使用命令见下方] After install (either method), restart Claude Code (or reload your project) so the skill is picked up. What it does Once installed, Claude consults the skill whenever you: add a new endpoint, form handler, or route (web frameworks) handle user input, query a database, or render user controlled content configure auth, session cookies, CORS, or security headers process file uploads or fetch URLs on behalf of the user (SSRF surface) deserialize data, call eval / Function / vm , or run a subprocess with user input write systems code in C/C++ that allocates memory, copies buffers, parses untrusted bytes, or calls system / exec tighten tsconfig.json or validate inputs at a TypeScript trust boundary (Zod / class validator / Valibot) work with cry