security-best-practices

Review Python, JavaScript, and Go code for common security vulnerabilities.

24.7k|1.7k|Updated Nov 25, 2025
One-click install
npx skills add https://github.com/openai/skills --skill security-best-practices-openai
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/openai/skills/tree/main/skills/.curated/security-best-practices
Command: npx skills add https://github.com/openai/skills --skill security-best-practices-openai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you identify and fix security vulnerabilities in your code, ensuring your applications are robust against common threats and follow secure-by-default coding practices.

Core Features & Use Cases

  • Vulnerability Scanning: Automatically detects common security flaws in code across various languages and frameworks.
  • Secure Coding Guidance: Provides actionable advice and best practices for writing more secure code from the start.
  • Use Case: A developer is building a new web service and wants to ensure it's secure. They can use this Skill to review their code for common vulnerabilities like SQL injection, XSS, and insecure configurations, receiving specific recommendations for improvement.

Quick Start

Use the security-best-practices skill to review the current project for security vulnerabilities.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review my Python or JavaScript code for common security vulnerabilities?

Security vulnerability reviews for Python and JavaScript code are performed by scanning for injection flaws, XSS, and CSRF, providing actionable guidance to fix identified issues and apply secure-by-default coding practices.

What's the best way to prevent XSS and SQL injection in frameworks like Django and Express?

Preventing XSS and SQL injection in frameworks like Django and Express involves applying secure-by-default coding guidance, which automatically detects and mitigates improper handling of user input and insecure configurations.

Does this security review support Go and FastAPI applications?

Yes, security reviews support Go and FastAPI applications, providing language and framework-specific guidance to identify and mitigate common vulnerabilities like injection flaws and insecure configurations across these specific stacks.

How can I find insecure configurations and improperly handled secrets in my web service?

Finding insecure configurations and improperly handled secrets in a web service requires a vulnerability scan that analyzes your codebase against security best practices, yielding specific recommendations to secure your application.

When do I need a focused security best-practice review instead of a general code review?

A focused security best-practice review is needed when building a new web service or hardening an existing one, specifically targeting vulnerability mitigation rather than general code quality or formatting improvements.

Why should I use secure-by-default coding practices for my Node.js and React application?

Using secure-by-default coding practices for your Node.js and React application ensures robust protection against common threats by proactively mitigating vulnerabilities like XSS and improper input handling from the start.