Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
frank-luongt Skill Mobile Security Coder 2<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Backend Security Coder 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Threat Modeling Expert 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Container Security Guide 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill API Security Best Practices 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Security Scanning Security Sast 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Security Compliance Compliance Check 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
- frank-luongt Skill Security Scanning Security Dependencies 2
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
-
lord1egypt Skill Data Managed Agents Self Hosted Sandboxes 2Reference documentation for running Managed Agents tool execution in self-hosted infrastructure, including environment setup, workers, webhook-driven wake, orchestration, monitoring, credentials, and security responsibilities
2 - frank-luongt Skill Vulnerability Scanner 4
<!-- AUTO-GENERATED by export-plugins.py — DO NOT EDIT -->
- frank-luongt Skill API Security Patterns 4
<!-- AUTO-GENERATED by export-plugins.py — DO NOT EDIT -->
- lord1egypt Skill Security Headers 2
Implementing Content Security Policy (CSP), CORS, and essential security headers in web server responses.
2 -
rudironsoni Skill Dotnet API Security 4Secures ASP.NET Core APIs. Identity, OAuth/OIDC, JWT bearer, passkeys, CORS, rate limiting.
- rudironsoni Skill Dotnet API Security 5
Secures ASP.NET Core APIs. Identity, OAuth/OIDC, JWT bearer, passkeys, CORS, rate limiting.
- rudironsoni Skill Dotnet Security Owasp 5
Hardens .NET apps per OWASP Top 10 -- injection, auth, XSS, deprecated security APIs.
- rudironsoni Skill Dotnet API Security 6
Secures ASP.NET Core APIs. Identity, OAuth/OIDC, JWT bearer, passkeys, CORS, rate limiting.
- rudironsoni Skill Dotnet Security Owasp 6
Hardens .NET apps per OWASP Top 10 -- injection, auth, XSS, deprecated security APIs.
-
holobiomicslab Skill Multidimensional Feature Detection And Alignment 2Use when when you have acquired LC-IMS-MS/MS data (mzML or mzML.gz format) from multiple samples and need to detect features that exploit simultaneous separation in m/z, drift time, and retention time to improve detection sensitivity and reduce false positives.
-
netvar1337 Bundle Semgrep 2Use to run Semgrep security/quality scans, including multi-language parallel workers.
- netvar1337 Skill Analysis 2
Use to triage/audit IDA binaries: suspicious behavior, crypto/network, multi-table queries.
- netvar1337 Bundle Pwn Chain 2
从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调'CTF 本地通 → 真实远程稳定打通'的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。
- netvar1337 Bundle Driver Comm 2
Usermode↔kernel driver communication: IOCTL design, shared sections, events, security descriptors, stealth IOCTL.
- netvar1337 Bundle Wifi Wireless 2
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
- netvar1337 Bundle Zeroize Audit 2
Use when auditing C/C++/Rust secret handling for missing or optimized-away zeroization.
- netvar1337 Bundle Docs Generator 2
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.
- netvar1337 Bundle Firmware Pentest 2
固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。
- netvar1337 Bundle Patch Diff Exploit 2
N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。
- netvar1337 Bundle Secrets Automation 2
Use when setting up unattended secret access (service accounts, vault scoping, non-echoing tokens).
- netvar1337 Skill Differential Review 2
Use for security-focused review of PRs/commits/diffs with blast-radius analysis.
- netvar1337 Bundle Repository Hardening 2
Use to harden a repo end-to-end: inventory, baselines, issues/PRs, security, merge-ready pub.
- netvar1337 Bundle Reverse Skill Router 2
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- netvar1337 Skill Windows 0day Hunting 2
Use when hunting new Windows privilege-escalation or security-boundary vulnerabilities in first-party services, scheduled tasks, recovery flows, security products, profile handling, or other privileged workflows. Drives evidence-first attack-surface mapping, state-machine analysis, controlled experiments, exploit-chain construction, variant hunting, and reproducibility testing.
- netvar1337 Bundle Stack Buffer Overflow 2
Stack buffer overflow exploit development: smash framing, saved RIP/SEH control, canaries, overlap, ROP setup, Windows/Linux differences.
- netvar1337 Skill Audit Context Building 2
Use for line-by-line architectural context building before vuln/bug hunting.
- netvar1337 Bundle Constant Time Analysis 2
Use when reviewing crypto code for timing side channels / secret-dependent behavior.
- netvar1337 Bundle Requesting Code Review 2
Use for pre-commit review: security scan, quality gates, auto-fix.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include mobile-security-coder, backend-security-coder, threat-modeling-expert. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.