# Teach Claude Code a security-response skill with live-write guards

> Write a Claude Code skill that inventories your estate from GitHub, fans out exposure/mitigation/patch/rollout agents, labels every claim verified/read/assumed, proves fixes in capped containers, and blocks live writes behind a PreToolUse ask hook.

- **Category:** [Coding](https://stepgleam.com/categories/coding)
- **Difficulty:** Advanced
- **Time:** ~75 minutes
- **Tools:** Claude Code, GitHub CLI (gh), Docker
- **Reliability score:** 88/100
- **Steps:** 6
- **Last updated:** 2026-10-31
- **Published:** 2026-10-31

## Tools used

- [Claude Code](https://code.claude.com/docs/en/overview) — Orchestrator session, skills, subagents, PreToolUse hooks
- [GitHub CLI (gh)](https://cli.github.com/) — Sweeps non-archived repos via gh search code for lockfiles and Dockerfiles
- [Docker](https://docs.docker.com/) — Throwaway containers where Babker proves mitigations before trusting them

## What you'll get

A security-response skill directory (inventory, four briefs, report template, live-guard hook) that produces a go/no-go SECURITY_RESPONSE.md per target without unsupervised production writes.

## Who this is for

Teams that already use Claude Code and face multi-app security advisories across mixed hosting.

## Before you start

Michael Babker (Happy Dog lead engineer, 28 Oct 2026) turned agency security-release day into a Claude Code skill after a session once changed a live edge policy without asking. He has run it twice: a PHP RCE replay and a same-day Symfony security release across four maintained branches. This guide follows his post. Exact full SKILL.md and brief files are unpublished, so those stay gaps — the shape, dispatch prompt, hook JSON, and lessons he names are what we keep.

## Steps

### Step 1: Capture the incident that made the skill necessary

**Tool:** Claude Code

Babker's spark: on the PHP multipart RCE response (CVE-2026-109618 / 109619), Claude Code helped — except *"at one point a session changed a live edge security policy without asking first."* Nothing broke; he still treated an unsupervised production write as a second incident. The skill's center is that rule: agents may read everything; they may not change live systems without a per-step human approval.

**Why this step:** Without a named failure mode, the skill becomes generic advice.

[Open step 1](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-1)

### Step 2: Scaffold the skill: inventory, four briefs, report template, guard hook

**Tool:** Claude Code

His skill directory holds `SKILL.md`, an estate inventory, **four briefs** (exposure mapper, mitigation engineer, patch builder, rollout planner), a report template, and a guard hook. The main session orchestrates only: it does not investigate itself; it hands work out, merges results, holds approvals, and owns commits. Exact file contents are unpublished — recreate the shape from his description.

**Why this step:** Four parallel questions keep one agent from inventing the whole response.

[Open step 2](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-2)

### Step 3: Start every response outside the repos: ID, workspace, single advisory.md

**Tool:** Claude Code

Every run: orchestrator gets an ID and a workspace in his **home directory, deliberately outside every repository**, because a map of exposures does not belong in VCS. It reads the advisory once and writes one `advisory.md` (affected/fixed versions, vector, upstream commits, vendor mitigations, confidence). Four agents must not work from four slightly different readings.

**Why this step:** One shared advisory file is what makes the four reports mergeable.

[Open step 3](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-3)

### Step 4: Dispatch the three parallel agents with a short prompt that points at files

**Tool:** Claude Code

His dispatch prompt is intentionally short — it points at files instead of retyping them:

**Why this step:** Long pasted prompts drift; file-backed briefs stay versioned with the skill.

**Prompt:**

```
Response <id>, workspace <dir>. Read ~/.claude/skills/security-response/briefs/_common.md, then ~/.claude/skills/security-response/briefs/<brief>.md, and follow both. Scope: <the targets and components in play, plus anything already known or ruled out>.
```

[Open step 4](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-4)

### Step 5: Treat GitHub as the estate source of truth and label every claim

**Tool:** GitHub CLI (gh)

Inventory is a baseline, not truth. The skill sweeps the GitHub org's non-archived repos with `gh search code` over lockfiles, Dockerfiles, and CMS version files. Unplaced hits get hosting inferred from deploy workflows / `vercel.json` / Railway config — or marked **"hosting unknown"**, never dropped. Every claim is labeled **Verified** (command + output saved), **Read** (cited file/page), or **Assumed** (with why). A target whose exposure is all assumed is reported unknown, not safe.

**Why this step:** His PHP run found two containers the inventory had missed plus ~a dozen unmapped hosts.

[Open step 5](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-5)

### Step 6: Prove mitigations in capped containers; block live writes with PreToolUse ask

**Tool:** Docker

Mitigation engineer derives candidates from the upstream fix, proves each in a throwaway container (vulnerable reproduces → mitigation blocks → business traffic still works), and keeps a "Doesn't help" section. After two agents froze his ARM Mac under unbounded x86 builds (~960% CPU), shared briefs now cap CPU/memory, fix `-j3`, one build at a time, prefer ARM images. Live rule: nothing changes staging/production/policy/registry/remote branch until he approves **that exact step**. Backstop: global `PreToolUse` hook running `live-guard.py` that returns **ask** on `kubectl apply`, `gcloud … update`, `ssh`, `git push`, registry push, Railway deploy, non-localhost HTTP writes — never deny, biased to ask. Skill frontmatter registration failed inside subagents; he moved it to global settings and confirmed with a harmless matching command.

**Why this step:** Container proof plus an ask-hook is how he keeps tireless reading without a second incident.

[Open step 6](https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards#step-6)

## Pro tips

- Label every claim verified, read, or assumed; never merge an assumed exposure as safe.
- Register the live-guard PreToolUse hook in global settings — Babker found skill frontmatter hooks never fired inside subagents.

## Common mistakes

- Letting the agent change staging or production after a vague "go ahead with the plan" — approvals do not carry across steps or targets.
- Running unbounded x86 containers under ARM emulation; two of his agents hit ~960% CPU and froze the laptop until briefs capped CPU/memory and compile -j3.

## FAQ

### Is this the same as a generic checklist skill?

No. The checklist skill turns a repeated procedure into SKILL.md. This one is a multi-agent security response with evidence labels, container proof, and a live-write ask hook.

### Do subagents get approval power?

Babker: subagents hold no approvals. They read freely and write exact commands into the rollout plan, then stop.

---

Canonical guide: https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards
Read this guide as Markdown: https://stepgleam.com/guides/teach-claude-code-a-security-response-skill-with-live-write-guards.md