Hunt the Security Holes in Your Code with Anthropic's Free Claude Skills
Anthropic open-sourced the four Claude Code skills it built with security teams: map where an attacker gets in, scan those spots, double-check every finding, and write the fixes. How to run them on your own code, and the catch
Anthropic, the creators of Claude, published a set of Claude Code skills that find security holes in source code, based on what they learned working with security teams. It's past 7,500 stars on GitHub.
Here's what each skill does, how to run them on your own project, and what to watch out for.
What the four skills do
| Command | What it does |
|---|---|
| /threat-model | Maps where an attacker could get in, so the scan aims at the risky spots first |
| /vuln-scan | Reads your source and lists each security hole with its file and line |
| /triage | Re-checks every finding with three independent votes, drops duplicates and false alarms, ranks by danger |
| /patch | Writes a candidate fix for each confirmed hole as a diff you review (never applied for you) |
In the repo's own example run on a small test program: 5 findings, 4 confirmed after triage, 3 patches written, every patch accepted by an independent reviewer agent.
Keep reading
Free, for an email.
Unlocks 5 more sections, 1 copy-paste prompt, the document version, and every other guide on the site, for free. Enter your email once to keep reading.
45,000+ follow where these guides come from.No spam. Unsubscribe in one click.