All 94 skillsQuality9 of 13
stryx:security
When code touches logins, permissions, secrets or encryption, or you ask "is this secure".
/stryx:securityInside its piece: 22 specks, one for each file on its shelf. Its twelve group-mates glow on the open book behind it. The light splits toward orange, the band of Quality.
In numbers
counted 2026-10-12 in the installed set- 19reference files
- 1helper scripts
- 22files in the skill
- 312KB on disk
- 17chapters
- 1agent works by this book
Use it when
in the skill’s own words- when code or a design touches security: a security audit
- scan or review
- "is this secure"
- vulnerabilities
- CWE Top 25 or OWASP Top 10
- STRIDE threat modeling
- MITRE ATT&CK
- Hardening an Electron app (contextIsolation, CSP, preload, IPC validation, openExternal, fuses)
- authentication
- authorization
- permissions
- JWT
- password hashing
- CORS
- CSRF
- XSS
- SQL or command injection
- path traversal
- input validation
- hardcoded secrets
- secret detection
- credentials
- .env
- safeStorage
- a leaked key
- encryption
- envelope DEK/KEK
- AES-256-GCM
- KDF
- PBKDF2 or Argon2
- key rotation
- recovery codes
- npm audit, license, depcheck or supply-chain audits
- A pre-commit security gate ("/security-pipeline", "security scan", "vulnerability check", "CWE scan", "STRIDE analysis")
- Vetting a third-party skill or plugin
- Cookie-consent compliance
Not for
another skill does it- Diagnosing a failed login or 401→ stryx:debug
- A general code review→ stryx:review
- Flutter mobile security→ stryx:flutter
- Secrets in Claude Code config→ stryx:config
On its shelf
22 files, 312 KB- references/19
- SKILL.md1
- evals/1
- scripts/1
Inside the book
17 chapters, by title only- Modes
- Core procedure: the 5-phase pipeline
- Verification gates
- Anti-premature-completion rules
- When a security fix keeps failing
- Invariants
- Scope boundaries
- More audit lenses
- Auditing a third-party skill or plugin
- Electron hardening checklist
- CWE quick reference
- STRIDE
- Dependency audit protocol
- Encryption quick reference
- Secure coding decision matrix
- MITRE ATT&CK
- Scanner scripts
Its helper
1 agent works by this book- stryx:security-agentWhen a project or a change needs a security audit with evidence.
Works with
the skills it names most- stryx:debug→Something is broken: a bug, an error, a crash, a failing test or wrong data.
- stryx:flutter→When writing, reviewing or testing Flutter or Dart app code.
- stryx:config→When Claude Code's own setup needs checking or tidying: CLAUDE.md, settings, permissions, memory.
- stryx:review→When code or a pull request should be checked before commit or merge.
- stryx:verify→When Claude is about to say done, fixed or ready to commit: fresh proof comes first.
- stryx:ai-power→When you are not sure which skill fits, or you say "load aipower": it is the map of all skills.
Claude loads it by itself when the moment comes; by hand, type the line at the top. It comes with the whole set: Installs all 94 skills, 32 agents and the brain program as one set. The skill’s own text is private source and is not shown here.