Agent skill · OpenAI
Security Best Practices Review skill for Claude Code, Codex and Cursor
Officialname: security-best-practices★ 28k (repo)pushed 2026-09-08Apache-2.0SKILL.md on GitHubchecked 2026-11-07
What it does, in the publisher's words
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.
Install Security Best Practices Review
The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs
npx skills add openai/skills --skill security-best-practices
Copy the skill folder into ~/.claude/skills (all projects) or .claude/skills (this repo). Claude Code picks it up without a restart. docs
npx skills add openai/skills --skill security-best-practices -a claude-code # or by hand: git clone --depth 1 https://github.com/openai/skills.git /tmp/security-best-practices-src cp -r /tmp/security-best-practices-src/skills/.curated/security-best-practices ~/.claude/skills/security-best-practices
Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs
git clone --depth 1 https://github.com/openai/skills.git /tmp/security-best-practices-src cp -r /tmp/security-best-practices-src/skills/.curated/security-best-practices ./security-best-practices zip -r security-best-practices.zip security-best-practices
It's in OpenAI's own catalog: ask Codex for $skill-installer security-best-practices, or use the skills CLI. docs
$skill-installer security-best-practices
gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs
gh skill install openai/skills security-best-practices
Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs
npx skills add openai/skills --skill security-best-practices -a cursor
Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs
gemini skills install https://github.com/openai/skills.git --path skills/.curated/security-best-practices
OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs
npx skills add openai/skills --skill security-best-practices -a opencode
Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs
npx skills add openai/skills --skill security-best-practices -a windsurf
Works with
Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.
What's in the SKILL.md
- Overview
- Workflow
- Workflow Decision Tree
- Avoid Using Incrementing IDs for Public IDs of Resources
- A note on TLS
Bundled files
- LICENSE.txt
- agents/openai.yaml
- references/golang-general-backend-security.md
- references/javascript-express-web-server-security.md
- references/javascript-general-web-frontend-security.md
- references/javascript-jquery-web-frontend-security.md
- references/javascript-typescript-nextjs-web-server-security.md
- references/javascript-typescript-react-web-frontend-security.md
- references/javascript-typescript-vue-web-frontend-security.md
- references/python-django-web-server-security.md
- references/python-fastapi-web-server-security.md
- references/python-flask-web-server-security.md
Loaded only when the instructions point to them.
Facts
- Skill name
- security-best-practices
- Publisher
- OpenAI (official)
- Repo
- openai/skills
- License
- Apache-2.0
- SKILL.md size
- 1,378 words, 82 lines
- Bundled files
- 12, 10 docs
- Repo stars
- 28k (as of 2026-10-24)
- SKILL.md checked
- 2026-11-07
More skills from openai/skills
- ChatGPT Apps: Scaffolds and debugs ChatGPT apps built with the Apps SDK: an MCP server plus widget UI.
- GitHub: Address PR Comments: Works through review comments on the current branch's pull request using the gh CLI.
- GitHub: Fix CI: Reads failing GitHub Actions checks with gh, summarizes the cause and proposes a fix.
- Image Generation: Generates or edits raster images such as illustrations, sprites, mockups and transparent cutouts.
- Linear: Reads, creates and updates Linear issues and projects from the agent.
- OpenAI Docs: Looks up current OpenAI API and Codex documentation and helps pick a model.
- Playwright Browser Automation: Automates a real browser from the terminal for form filling, snapshots, scraping and UI debugging.
- Security Threat Model: Writes a threat model for a repository: trust boundaries, assets, attack paths and mitigations.
- Skill Installer (Codex): Codex's built-in helper that installs skills from the curated list or any GitHub repo path.
Related security & auth skills
- Sign In With Google (Web) · Google
- Agentic Actions Auditor · Trail of Bits
- CodeQL Scan · Trail of Bits
- Constant-Time Analysis · Trail of Bits
- Differential Security Review · Trail of Bits
- Semgrep Rule Creator · Trail of Bits
- Sharp Edges · Trail of Bits
- Security Review (Sentry) · Sentry
FAQ
What does the security-best-practices skill do?+
Reviews code for language- and framework-specific security issues and suggests safer defaults. In its own SKILL.md, OpenAI describes it as: "Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help."
How do I install the security-best-practices skill?+
Run npx skills add openai/skills --skill security-best-practices and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/security-best-practices/SKILL.md; in Codex and Cursor in .agents/skills/security-best-practices/.
Does Security Best Practices Review work in Codex, Cursor and Copilot, or only Claude?+
It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.
Who maintains Security Best Practices Review?+
OpenAI, the company or project behind it, in the openai/skills repo on GitHub, last pushed 2026-09-08. License: Apache-2.0.
Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers