Hunt the Security Holes in Your Code with Anthropic's Free Claude Skills
Anthropic open-sourced the four Claude Code skills it built with security teams: map where an attacker gets in, scan those spots, double-check every finding, and write the fixes. How to run them on your own code, and the catch
Anthropic, the creators of Claude, published a set of Claude Code skills that find security holes in source code, based on what they learned working with security teams. It's past 7,500 stars on GitHub.
Here's what each skill does, how to run them on your own project, and what to watch out for.
What the four skills do
| Command | What it does |
|---|---|
| /threat-model | Maps where an attacker could get in, so the scan aims at the risky spots first |
| /vuln-scan | Reads your source and lists each security hole with its file and line |
| /triage | Re-checks every finding with three independent votes, drops duplicates and false alarms, ranks by danger |
| /patch | Writes a candidate fix for each confirmed hole as a diff you review (never applied for you) |
In the repo's own example run on a small test program: 5 findings, 4 confirmed after triage, 3 patches written, every patch accepted by an independent reviewer agent.
Free, for your email
Get the full setup steps + the copy-paste setup prompt
The rest of this guide (5 more sections, 1 copy-paste prompt) opens right here. The setup prompt, one paste into Claude that sets it all up, comes by email only. Use your real address.
Unlocks: Step 1: try it on the built-in test target · Step 2: run it on your own code · The catch · Also built into Claude Code · Sources
50,000+ follow where these guides come from. No spam, reply “unsubscribe” any time.