Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
augments-labs Bundle Complexity Audit 2Use when existing code should be examined for accidental complexity — abstraction nothing needs, ownership it should not hold, flexibility nobody uses, or custom machinery a library already provides. Fires on is this over-engineered, why is this so complicated, and do we still need all of this, even if nobody says complexity or audit. Skip implementation choices, review of an exact candidate, and structural work already approved.
- augments-labs Bundle Feasibility Check 2
Use before an accountable owner commits to a project or initiative, when whether it can be done under real technical, delivery, operational, security, data, or dependency constraints is still uncertain. Fires on can we actually build this, is this realistic by the deadline, and what would it take, even if nobody says feasibility. Skip proven or trivially reversible approaches.
-
atrislabs Skill Skill Improver 2Audit and improve Claude skills against the Anthropic skill guide. Use when creating new skills, improving existing ones, or preparing skills for ClawHub distribution. Triggers on skill audit, improve skill, new skill, skill quality, or ClawHub publish.
-
litestar-org Bundle Litestar Security 2Auto-activate for litestar_security, SecurityPlugin, SecurityConfig, CurrentUser, Principal, SecurityContext, requires_role, requires_scope, requires_authenticated, requires_tenant, requires_tenant_role, requires_capability, or requires_assurance. Not for raw auth guards alone — use litestar-auth-guards.
-
richard0901 Skill Security Review 2[OMX] Run a comprehensive security review on code
-
scoobydrew83 Bundle Conductor Init 2Initialize a repo for the Conductor Method loop: write init.sh, seed FEATURES.json from the spec, create CONTEXT.md and MEMORY_BANK.md, verify a one-command test and a one-command lint actually pass, and land the baseline commit `loop(0): baseline green + criteria defined`. Use whenever someone is standing up a builder/verifier loop on a repo that doesn't have one yet, or says "set up the conductor loop here", "initialize this repo for the loop", "do Phase 0", "get this repo loop-ready", "seed FEATURES.json", or asks why the verifier keeps returning BLOCKED on a fresh project (the answer is almost always missing acceptance criteria, which is what this skill installs). Also use on an existing repo to audit and repair a half-done Phase 0. Do NOT trigger to design the loop itself or write its prompts — that is `loop-creator`; this skill only prepares the ground the loop runs on.
- scoobydrew83 Bundle Conductor Doctor 2
Audit a repository's Conductor harness without changing it. Use when someone asks whether the loop is ready, why routing is blocked, whether state and policy agree, or to diagnose aliases, generated packages, criteria, evidence, queue transitions, and required tests. With `--library-root`, it also audits instruction aliases and the generated Marketplace package. It returns Conductor verdict PASS, FAIL, or BLOCKED with directly actionable repairs. Do NOT use it to silently repair a repository; it is read-only by design.
-
vchirrav-eng Skill Dast Zap 2Run OWASP ZAP for Dynamic Application Security Testing. Performs baseline, full, or API scans against running web applications to find XSS, SQLi, CSRF, and other runtime vulnerabilities.
- vchirrav-eng Skill Sast Detekt 2
Run detekt static analysis on Kotlin code with security-focused rules. Detects hardcoded secrets, insecure crypto, and code quality issues affecting security.
- vchirrav-eng Skill Sast Spotbugs 2
Run SpotBugs with Find Security Bugs plugin on Java code. Detects injection flaws, XXE, insecure crypto, SSRF, deserialization, and other JVM security bugs.
- vchirrav-eng Skill Sca NPM Audit 2
Run npm audit for Node.js dependency vulnerability scanning. Built-in SCA for npm projects with automatic fix suggestions.
- vchirrav-eng Skill Sca Pip Audit 2
Run pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.
- vchirrav-eng Skill Sast Cargo Audit 2
Run cargo-audit and cargo-geiger on Rust code. Audits dependencies for known vulnerabilities and detects unsafe code usage for memory safety review.
- vchirrav-eng Skill Container Scan Trivy 2
Run Trivy to scan container images for OS and library vulnerabilities, misconfigurations, and secrets. Comprehensive multi-target security scanner.
- vchirrav-eng Skill Sast Eslint Security 2
Run ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.
- vchirrav-eng Skill Secret Scan Gitleaks 2
Run Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.
- vchirrav-eng Skill API Security Spectral 2
Run Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.
- vchirrav-eng Skill Mobile Security Mobsf 2
Run MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.
- vchirrav-eng Skill Secret Scan Trufflehog 2
Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.
- vchirrav-eng Skill Secure Coding Generate 2
Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g., [INPUT-04], [AUTH-07]) plus a rules-applied summary.
- vchirrav-eng Skill API Security Schemathesis 2
Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
-
allgpt-co Skill Gsd Audit Milestone 2Audit milestone progress and status
-
dirien Skill Review 2Review code changes for quality, security, and correctness
-
benjaminshoemaker Skill Vision Audit 2Audit project alignment with VISION.md, identify SDLC gaps, and generate feature proposals. Use when reviewing strategic direction or planning new features.
- benjaminshoemaker Bundle Feature Audit 2
Multi-source audit of a shipped feature against its original plans, product vision, UI/UX best practices, and live browser inspection. Produces consolidated findings with prioritized recommendations.
- benjaminshoemaker Skill Security Scan 2
Run dependency audits, secrets detection, and static analysis to find CVEs, leaked credentials, and insecure code patterns. Use at phase checkpoints or before releases.
- benjaminshoemaker Skill Criteria Audit 2
Validate EXECUTION_PLAN.md for verification metadata, manual reasons, and testability. Use when preparing Phase 1 or after editing EXECUTION_PLAN.md.
- benjaminshoemaker Bundle Data Flow Audit 2
Detect split data source anti-patterns and scattered business rule duplication where the same logic is reimplemented across multiple files and languages. Catches semantic duplication that syntactic tools like jscpd miss. Use at phase checkpoints or when investigating data consistency issues.
-
cockroachlabs Bundle Auditing Cis Benchmark 2Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS/FAIL/MANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.
- cockroachlabs Bundle Hardening User Privileges 2
Hardens CockroachDB user privileges by auditing and tightening role-based access control, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. Use when reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices.
- cockroachlabs Bundle Managing Tls Certificates 2
Manages TLS certificates for CockroachDB clusters including CA certificate configuration, client certificate authentication, certificate rotation, and troubleshooting SSL/TLS connection errors. Use when setting up client certificate auth, resolving SSL connection failures, rotating certificates, or configuring mTLS for CDC changefeeds.
-
kangwang42 Bundle Epi Project Audit 2六层审查流行病学与生物统计项目的数据链、代码、结果、表图、正文和交付一致性，并以证据判定是否可正式交付。用于项目质控、结果复核、审稿前自查或全面一致性检查；只审查时不修改文件。开工先遵循 biostat-principles，含咨询包时同时核对 consulting-delivery。单个 Word、表格、图片、PDF 或一段文字的局部修改与文件检查使用对应内容和文件操作 skill，不触发本技能。
- kangwang42 Bundle Consulting Delivery 2
把已完成并验证的 R 或 Python 分析打包为客户可独立复现、可直接阅读且保留真实溯源的咨询交付物。用于“给客户交付”“打包结果”或在 05_reports/ 建正式结果包；不用于未完成分析或内部探索。开工先遵循 biostat-principles，文本终审配合 academic-humanizer，最终检查配合 epi-project-audit。
-
viewway Bundle Code Review 4Systematic code review patterns covering security, performance, maintainability, correctness, and testing
- viewway Bundle Security Assurance 2
Ensures system security through audits and automated scans
-
bkywksj Skill Security Permissions 2Tauri 安全与权限管理技能,指导 Capabilities 配置和安全最佳实践。 触发场景: - 需要配置 Capabilities 权限 - 需要理解 Tauri 安全模型 - 需要处理 CSP(内容安全策略) - 功能不可用可能是权限问题 触发词: 权限、Capabilities、安全、CSP、permission、安全策略、sandbox
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include complexity-audit, feasibility-check, skill-improver. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.