Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
brucevanfdm Bundle Find Exec 2Rule matrix security fixture for find_exec used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Fork Bomb 2
Rule matrix security fixture for fork_bomb used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Secret Google 2
Rule matrix security fixture for secret_google used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Secret Stripe 2
Rule matrix security fixture for secret_stripe used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Socket Localhost 2
Rule matrix negative fixture - socket connection to localhost only; not intended for production deployment.
- brucevanfdm Bundle Base64 Network 2
Rule matrix security fixture for base64_network used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Socket Connect 2
Rule matrix security fixture for socket_connect used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Localhost Ok 2
Rule matrix security fixture for localhost_ok used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Xor Obfuscation 2
Rule matrix security fixture for xor_obfuscation used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Env Var Safe Shell 2
Rule matrix negative fixture - safe environment variable usage without piping; not intended for production deployment.
- brucevanfdm Bundle Path Safe Realpath 2
Rule matrix negative fixture - uses realpath to validate file paths; not intended for production deployment.
- brucevanfdm Bundle Network Declared 2
Rule matrix security fixture for network_declared used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Path Traversal Open 2
Rule matrix security fixture for path_traversal_open used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Undeclared Network 2
Rule matrix security fixture for undeclared_network used by security rule matrix integration tests; not intended for production deployment.
- brucevanfdm Bundle Subprocess Test Example 2
Rule matrix negative fixture - subprocess usage in test helper; not intended for production deployment.
-
vril-labs Skill Spring Boot 2Expert guidance for Spring Boot application development with best practices for RESTful APIs, testing, security, and deployment
- vril-labs Skill Woocommerce 2
WordPress and WooCommerce development guidelines with PHP best practices, security standards, and extensibility patterns
-
h-mmer Bundle Hunt Business Logic 2Hunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral Workflow, CWE-639 Authorization Bypass via User-Controlled Key in business contexts, CWE-362 race conditions on financial flows). Built from 44 corpus reports plus 8.8K shared-platform reports across HackerOne, Bugcrowd, Huntr, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Lilishop coupon overpurchasing (CVE-2024-50654 CVSS 7.5), WWBN AVideo wallet double-spend TOCTOU (CVE-2026-34368, GHSA-h54m-c522-h6qr), Keycloak 2FA bypass (CVE-2025-3910, GHSA-5jfq-x6xp-7rw2), AlegroCart 1.2.9 negative-quantity price manipulation (Andrey Stoykov SecLists Apr 2025), Bagisto cart price manipulation (Rudransh Singh Rajpurohit Sep 2025), Doppler free-trial reset (Aditya Sunny Dec 2024), Stripe hasEverTrialed bypass (better-auth
-
jsgforever Bundle Skill Audit 2Read-only static security audit of Claude Code skills, commands, and plugins. Analyzes SKILL.md frontmatter, body content, supporting scripts, and hooks for security risks. Use this skill when the user asks to "audit a skill", "review skill security", "check SKILL.md for risks", "scan a plugin for dangerous patterns", "verify skill safety", "check skill permissions", "analyze skill hooks", "audit a skill from GitHub", "review a remote skill", "check a skill by URL", or needs a security assessment of any Claude Code skill, command, or plugin before enabling it.
- jsgforever Bundle Gitlab CI Validator 2
Validate, lint, audit, or fix .gitlab-ci.yml pipelines, stages, and jobs.
- jsgforever Bundle Terragrunt Validator 2
Validate, lint, audit, or check Terragrunt .hcl/terragrunt.hcl files, stacks, modules, compliance.
- jsgforever Bundle Botlearn Healthcheck 2
botlearn-healthcheck — BotLearn autonomous health inspector for OpenClaw instances across 5 domains (hardware, config, security, skills, autonomy); triggers on system check, health report, diagnostics, or scheduled heartbeat inspection.
- jsgforever Skill API Authentication 2
API authentication patterns including JWT, OAuth 2.0, API keys, and session-based auth. Covers token generation, validation, refresh strategies, security best practices, and when to use each pattern. Use when implementing API authentication, choosing auth strategy, securing endpoints, or debugging auth issues. Prevents common vulnerabilities like token theft, replay attacks, and insecure storage.
-
apache Skill Magpie Security Issue Import From Md 2Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect.
- apache Skill Magpie Security Issue Import From Pr 2
Open a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. The tracker lands in the `Assessed` board column with the scope label applied, `pr created` / `pr merged` reflecting the PR's state, and `Remediation developer` / `PR with the fix` body fields populated from the PR. Pairs with `security-cve-allocate` afterwards.
- apache Skill Magpie Security Issue Import From Scan 2
Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; applies only the operator's confirmed per-entry decisions. Publishes the report as a gist and can open a report-back PR.
- apache Skill Magpie Security Issue Import Via Forwarder 2
Optional sub-skill of `security-issue-import`, `security-issue-invalidate`, and `security-issue-sync` that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter but was relayed onto `<security-list>` by an upstream broker (the ASF security team, a third-party disclosure platform, or an internal SOC). Runs after the parent skill's generic classification cascade, dispatches through adapters declared in `forwarders.enabled` per `tools/forwarder-relay/README.md`, applies the matched adapter's preamble-detect + credit-extract + reporter- addressing rules, and hands the routing decision back. Never mutates tracker state on its own.
- apache Bundle Generate Cve JSON 2
Generate a CVE 5.x JSON document from an <tracker> tracking issue, ready to paste into the Vulnogram `#source` tab of the ASF CVE tool at https://cveprocess.apache.org/cve5/<CVE-ID>#source. The conversion is deterministic: same issue in, same JSON bytes out. Handles multiple credits (one per line) and multiple references (URLs extracted from the issue's "Public advisory URL" and "PR with the fix" fields; the "Security mailing list thread" field is treated as internal-only and never exported).
-
dojogenesis Skill Red Team 2Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.
- dojogenesis Skill Soc2 Compliance 2
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.
- dojogenesis Skill Threat Detection 2
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
- dojogenesis Skill Incident Response 2
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.
- dojogenesis Skill Isms Audit Expert 2
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.
-
njs14 Bundle Wizard 2Generate a runnable guide for human-only setup or migration steps, with hidden secret entry and safe repeatable updates. Use when login, account UI, or human judgment prevents direct automation.
- vril-labs Skill Code Review 4
Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.
-
irahardianto Skill Supply Chain Security 2SBOM generation, CVE scanning, supply chain attack detection, license compliance, dependency pinning, and artifact verification.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include find-exec, fork-bomb, secret-google. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.