Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
markus41 Skill Onedrive Organizer 2Design OneDrive for Business folder structure and governance policy specifications to ensure consistent file organization, security, and compliance for financial services firms.
- markus41 Skill Cc Security Compliance 2
Security & Compliance
- markus41 Skill Hook Script Library 3
Security-hardened hook script implementations — ready-to-paste templates for security-guard, auto-format, inject-context, session-init, on-stop, and lessons-learned-capture
- markus41 Skill Supply Chain Security 2
This skill should be used when triaging dependency advisories, code-scanning alerts, or committed secrets — reachability analysis, revoke-first remediation, provenance, and maintenance risk signals.
-
lvtd-llc Bundle Influence Audit 2Use when auditing landing pages, emails, sales scripts, pricing flows, fundraising asks, product UX, or negotiations for persuasion mechanisms, pressure tactics, manipulation risk, fake urgency, fake social proof, authority misuse, or ethical rewrites.
- markus41 Skill Hook Script Library 4
Security-hardened hook script implementations — ready-to-paste templates for security-guard, auto-format, inject-context, session-init, on-stop, and lessons-learned-capture
-
aaaaqwq Bundle Ads 2Ads — Multi-Platform Paid Advertising Audit & Optimization
1 - aaaaqwq Bundle Skill Security Auditor 2
Skill Security Auditor
1 - aaaaqwq Bundle Afrexai Compliance Engine 2
Compliance & Audit Readiness Engine
1 -
gaelic-ghost Bundle Choose Macos Virtualization Shape 2Choose the smallest macOS-hosted boundary for development, compatibility, or authorized security research. Use when deciding among the host, containers, container machine, full Linux or macOS VMs, remote systems, or physical Macs.
- gaelic-ghost Bundle Macos Sandbox File Access Workflow 2
Design and diagnose macOS file access. Use for App Sandbox, App Groups, user selection, security-scoped bookmarks across relaunches, helpers or extensions, stale access, TCC overlap, POSIX or ACL, Data Vault, and SIP denials.
- gaelic-ghost Bundle Inspect Macos Runtime Activity 2
Correlate suspicious macOS process, file, network, permission, and log activity. Use for unexpected processes, downloads, open files, DNS, privacy prompts, alerts, file mutations, injected executables, and Endpoint Security evidence.
- gaelic-ghost Bundle Research Macos Security Control 2
Research one macOS security control on an exact build, separating public contracts, private evidence, and hypotheses. Use for TCC, sandbox, entitlements, Gatekeeper, XProtect, Hardened Runtime, SIP, or system-policy changes.
- lvtd-llc Bundle Linkedin Post Writing 2
Draft, revise, and audit LinkedIn feed posts for professional visibility, personal brand, audience value, comments, and ethical reach. Use when writing LinkedIn posts, feed updates, text posts, document or video captions, hashtag/mention plans, post hooks, or short-form LinkedIn content.
- lvtd-llc Bundle Linkedin Comment Writing 2
Write and audit LinkedIn comments and reply strategies that add professional value, start useful discussion, and increase ethical visibility. Use when drafting comments on LinkedIn posts, replying to comments, improving comment prompts, or planning comment-based engagement without spam.
- lvtd-llc Bundle Linkedin Article Newsletter Writing 2
Plan, draft, repurpose, and audit LinkedIn articles and newsletters that demonstrate expertise and support a professional content strategy. Use when writing long-form LinkedIn articles, newsletter editions, article teasers, follow-me articles, issue plans, or post-to-newsletter repurposing.
- lvtd-llc Bundle Documentation Information Architecture 2
Audit, organize, and redesign developer documentation information architecture, including content inventory, navigation, landing pages, sequences, hierarchies, webs, breadcrumbs, sidebars, metadata, redirects, migration, platform/tool selection, and maintainable IA decisions. Use when restructuring docs sites, improving findability, planning doc migration, evaluating docs tooling, or organizing large documentation sets.
-
griddynamics Bundle Security 3Run authorized, evidence-preserving security reviews and prepare remediation inputs.
- griddynamics Bundle Solr Schema 2
To design and audit Solr schemas: field types, analyzers, docValues, solrconfig.
- griddynamics Bundle Security 4
Run authorized, evidence-preserving security reviews and prepare remediation inputs.
-
henriquescastilho Bundle Monitoring Darkweb Sources 2Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.
- henriquescastilho Bundle Analyzing Network Packets With Scapy 2
Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing
- henriquescastilho Bundle Extracting Iocs From Malware Samples 2
Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
- henriquescastilho Bundle Exploiting JWT Algorithm Confusion Attack 2
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
- henriquescastilho Bundle Exploiting Race Condition Vulnerabilities 2
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
- henriquescastilho Bundle Conducting Social Engineering Pretext Call 2
Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
- henriquescastilho Bundle Detecting Ransomware Precursors In Network 2
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
- henriquescastilho Bundle Exploiting Nosql Injection Vulnerabilities 2
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
- henriquescastilho Bundle Performing OAUTH Scope Minimization Review 2
Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.
- henriquescastilho Bundle Exploiting Prototype Pollution In Javascript 2
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
- henriquescastilho Bundle Performing Cryptographic Audit Of Application 2
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
- henriquescastilho Bundle Exploiting Zerologon Vulnerability Cve 2020 1472 2
Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
-
legioncodeinc Bundle Security Stinger 2Security audit for SvelteKit, Neon/Drizzle, WorkOS, Stripe, Vercel, Doppler, and GoHighLevel. First gate of the Ship Gate - scans, triages, and remediates vulnerabilities before quality-stinger.
- legioncodeinc Bundle Legal Docs Stinger 2
SaaS legal document generation and maintenance specialist. Covers Terms of Service, Privacy Policy, DPA, MSA, and Cookie Notice using the template+lawyer-review path. Anchored in Termly/Iubenda generators and GDPR/CCPA/Quebec Law 25/LGPD compliance postures. Use when the user says "generate a privacy policy", "draft a DPA", "set up our Terms of Service", "review a customer DPA redline", "which legal doc generator should I use", "GDPR compliance for SaaS", or when legal-docs-worker-bee is invoked. Do NOT use for technical data-protection controls (security-worker-bee), database schema for personal-data fields (db-worker-bee), or contract negotiation strategy beyond the DPA (legal team).
- legioncodeinc Bundle Adr Writing Stinger 2
Architecture Decision Records specialist covering Nygard format (Context / Decision / Consequences), MADR extended template, Y-statement framing, supersession and deprecation lifecycle, Log4brains and adr-tools CLI integration, and the \\\"decisions, not docs\\\" philosophy. Use when authoring a new ADR, superseding an existing decision, auditing the ADR log, setting up Log4brains, or onboarding a team to ADR practice. Do NOT use for general knowledge-base authoring (library-worker-bee), code entity extraction (wiki-worker-bee), or security review of the decisions themselves (security-worker-bee).
- legioncodeinc Bundle Get Started Stinger 2
Initializes a repo to a healthy baseline: library/ docs, GitHub CI, README, .gitignore, CODEOWNERS, SECURITY.md, CHANGELOG.md. Use when bootstrapping a repo or auditing one for missing hygiene files.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include onedrive-organizer, cc-security-compliance, hook-script-library. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.