Blake Sims

Claude Code · DO NOW

Security Setup

Paste-in brief: Claude builds you a tailored /security-audit skill

On this page 6 sections
  1. Four cumulative levels
  2. How to use
  3. Option 1 · Tell Claude to fetch the brief
  4. Option 2 · Copy the full brief and paste it
  5. What gets installed
  6. Why this exists

Four cumulative levels#

You pick how much time you have today. The skill remembers where you got to, so you can level up later.

  • 5 min Level 1 - Quick scan. NPM minimum package age, CISA KEV diff against installed software, force-push status on owned repos. This is the weekly-runnable level.
  • 15 min Level 2 - Deep hardening. Disable force-push, audit SSH config, find loose .env files, dependency scan with OSV.dev + GitHub Advisory.
  • 1 hour Level 3 - Blast radius. Two halves you can pick from. 3A: encrypted secrets with varlock. 3B: Docker sandbox so Claude runs containerised.
  • Half day+ Level 4 - Off-machine dev. Spin up a VPS, harden it, replicate Levels 1-3 there. Get development off your personal machine entirely.

How to use#

Open Claude Code on every machine you develop on (laptop, dev server, all of them). Pick one of the options below.

Option 1 · Tell Claude to fetch the brief#

Fetch https://guide.zenaitutoring.com/security-setup/instructions.md and follow the instructions exactly.

Option 2 · Copy the full brief and paste it#

View raw

After pasting: Claude will recon your machine, ask three short questions, then install ~/.claude/skills/security-audit/SKILL.md. From then on, run /security-audit weekly (Sundays are a good default).

What gets installed#

The skill the agent builds for you (tailored to your OS, package managers, and how you work).

~/.claude/skills/security-audit/SKILL.md

The skill itself. Invoked with /security-audit. Knows what level you're at and what to scan.

~/.config/security-audit/state.json

Per-machine memory: level completion, machine role, tracked projects, settled findings, last scan timestamp.

~/.config/security-audit/scans/YYYY-MM-DD-security-audit.md

One dated note per scan. Findings, fixes, anything deferred. Same pattern as the doc-system worklog.

~/.config/security-audit/sources.json

Vulnerability feeds the skill queries: OSV.dev, GitHub Advisory, CISA KEV, NVD. Extensible without editing the skill.

Why this exists#

Supply-chain attacks against NPM maintainers are an active wave - poisoned packages, credential-exfil scripts triggered by pre-commit hooks, force-pushed commits that overwrite history. The 5-minute fix (NPM minimum package age) protects against most of it. The remaining levels stack on top.

The frame is assume-breach: encrypted secrets so nothing useful is stolen, read-only skill mounts so the agent can't rewrite its own rules, backups so deletion isn't catastrophic, sandboxes so the blast radius stays contained.

Files in this bundle

Each source remains directly readable and curl-able.