Agent Skills › relaticle/relaticle › spatie-security

spatie-security

GitHub

提供应用、数据库、服务器及代码的安全配置与审查指南，涵盖SSL、CSRF、密码哈希、权限管理及Git签名等最佳实践。

.claude/skills/spatie-security/SKILL.md relaticle/relaticle

Trigger Scenarios

配置应用安全（认证、授权）审查代码安全漏洞设置数据库或服务器配置管理凭证或创建Git签名

Install

npx skills add relaticle/relaticle --skill spatie-security -g -y

More Options

Non-standard path

npx skills add https://github.com/relaticle/relaticle/tree/main/.claude/skills/spatie-security -g -y

Use without installing

npx skills use relaticle/relaticle@spatie-security

指定 Agent (Claude Code)

npx skills add relaticle/relaticle --skill spatie-security -a claude-code -g -y

安装 repo 全部 skill

npx skills add relaticle/relaticle --all -g -y

预览 repo 内 skill

npx skills add relaticle/relaticle --list

SKILL.md

Frontmatter

{
    "name": "spatie-security",
    "license": "MIT",
    "metadata": {
        "author": "Spatie"
    },
    "description": "Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening."
}

Spatie Security Guidelines

Overview

Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.

When to Activate

Activate this skill when configuring application security (authentication, authorization, forms).
Activate this skill when setting up or reviewing database configurations.
Activate this skill when configuring servers or reviewing infrastructure.
Activate this skill when reviewing code for security vulnerabilities.
Activate this skill when configuring or creating signed Git commits.

Scope

In scope: Application security, database security, server configuration, credential management, signed Git commits.
Out of scope: Code style, business logic, UI/UX design.

Workflow

Identify the application, database, server, credential, or Git security concern.
Read references/spatie-security-guidelines.md and focus on the relevant sections.
Apply the narrowest relevant security controls without weakening existing protections.

Core Rules (Summary)

Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys.
Sign all Git commits.
Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests.
Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts.
Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic.
Protect devices, backups, sensitive data, and browser activity.