A skill for Claude Code

Security, explained like you're not a security person.

You know you should "do security" but not where to start. This skill has a plain conversation about your business, then hands you a short, prioritized plan.

Get the skill See a real report ↓

Free · open source · nothing leaves your laptop.

BuildeRiot · first pass In progress

62/ 100

Solid basics. Real gaps in admin access.

26 items across 9 areas.

8gaps

6unverified

12in place

Who it's for

Built for the person who has to figure this out, not a security team.

Already have a CISO and a SOC 2 in flight? Skip this. Staring at a security questionnaire with no idea where to start? Keep reading.

Plain words, not buzzwords

Findings explained in sentences a founder can read at 11pm — no acronym soup.

Looks at the business, not just the code

Vendors, contracts, who owns what — most real risk starts outside the codebase.

Matched to your stage, not overkill

A pre-seed app doesn't need what a bank needs. It says what matters now, and what can wait.

See it for yourself

What a first pass actually looks like

BuildeRiot is a fictional startup we ran through the skill, so you see real output.

security-dashboard.html

BUILDERIOT

SummaryOverviewPlanCompliance

62/100

Solid basics, real gaps in admin access.

12 in place · 6 unverified · 8 need work.

8gaps

6unverified

12in place

Start here

MFA on cloud root & admin accounts

P0Missing

Fix ›

Server-side checks on every resource

P0Unknown

Fix ›

Secrets scanned & blocked from git

P0Partial

Fix ›

Summary — where you stand, in one screen

One score, three tallies, and a ranked list of what to fix first.

security-dashboard.html

BUILDERIOT

SummaryOverviewPlanCompliance

The basics

Cloud & infra

Auth & authorization

API

Secrets mgmt

Compliance

Overview — coverage by area

Every area scored at a glance. Lighter bar = assumed, not confirmed.

security-dashboard.html

BUILDERIOT

SummaryOverviewPlanCompliance

Need now2

DPA available for B2B customers

P0Missing

Publish sub-processor list

P1Missing

Need later1

Plan SOC 2 Type I readiness

P2Missing

Compliance — the paperwork, split by urgency

What's legally required now, separated from what can wait.

How it works

Four steps, one conversation.

Answer plain questions

What you do, who your customers are, what data you hold. No jargon required.

It reads your code first

It scans your repo first, so it doesn't ask what it can already see.

You fill the gaps together

Only the technical questions that apply to your stack.

You get a plan, not a lecture

A prioritized checklist and the dashboard shown above.

What you get

Two files. Both yours, both local.

Source of truth

`security-checklist.md`

Every item, its priority, its status, and the first step.
Plain markdown — readable by anyone, no tooling needed.
Everything else is generated from this file.

The dashboard

`security-dashboard.html`

Open it in any browser. No install, no account, no server.
Filter, check things off, drag items between now / next / later.
Every card copies a ready-made prompt for your coding assistant.

/overview

A plain-English status report on one topic.

/fixit

Fixes one item safely — with your approval.

/create-doc

Drafts the document a compliance item needs.

Where your data goes

Nowhere. It stays on your laptop.

It runs inside your own Claude Code session and saves a plain HTML file to your project. No account, no server, no third party.

Kept out of git by default.

Saved to your browser's local storage only.

No signup, no license key, no telemetry.

Get it

Two minutes to install.

Claude Code skills live in ~/.claude/skills/ (every project) or .claude/skills/ (this project only).

Every project

git clone https://github.com/advaha91/security4builders.git \
  ~/.claude/skills/security4builders

This project only

git clone https://github.com/advaha91/security4builders.git \
  .claude/skills/security4builders

Then ask Claude Code: "help me do a security assessment."