Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
aibot88 Bundle Implementing Database Audit Logging 2Process use when you need to track database changes for compliance and security monitoring. This skill implements audit logging using triggers, application-level logging, CDC, or native logs. Trigger with phrases like "implement database audit logging", "add audit trails", "track database changes", or "monitor database activity for compliance".
3 - aibot88 Bundle Audit Openclaw Host Security Posture And Hardening Gaps
This skill uses OpenClaw’s healthcheck workflow to inspect the host running the assistant, surface risky exposure, and turn the findings into a staged hardening plan. It is for operator-style audits with explicit approval gates, not a generic software listing or a replacement for OS administration.
3 -
sandeeprdy1729 Skill Data Governance 2Comprehensive guide to data governance. Master the concepts, implementation, best practices, and real-world applications of data governance in professional environments.
1 - aibot88 Bundle Review REST API Designs Before Implementation For Versioning
Review an API design, endpoint set, or OpenAPI spec before implementation and return prioritized findings on design quality, security, resilience, and missing contract decisions.
3 - aibot88 Bundle Run AI Assisted Security Triage With Role Based Soc Runbooks
Use ai-runbooks to give AI assistants role-specific SOC personas, investigation steps, and incident-response procedures for structured security triage.
3 - aibot88 Bundle Run Autonomous White Box Pentests Against Web Apps And Apis
Analyze a web app's source code, execute real exploit attempts against the running target, and return proof-backed findings before release.
3 - aibot88 Bundle Sweep Github For Leaked Secrets And Exposed Credentials With
Search public GitHub broadly for leaked secrets and triage exposures when the workflow is recon and remediation, not generic secret scanning.
3 -
holobiomicslab Skill File System Audit And Validation 2Use when after invoking the saveAnnotations function on a MetaboAnnotatoR annotations object to confirm that all four expected output file types (global results file, ranked results file, per-feature ranked spectra PDFs, and pseudo-MS/MS MGF file) have been written to the output directory without.
- holobiomicslab Skill Lipid Type Category Enumeration 3
Use when when you have downloaded or cloned a lipidomics library repository (such as LipidMatch) and need to audit the breadth of lipid-type coverage to ensure the library meets minimum requirements for your analysis scope (e.g., ≥60 distinct lipid categories).
-
tools-only Bundle Workflow Builder 2Design, build, and maintain autonomous OpenClaw workflows (stewards). Use when creating new workflow agents, improving existing ones, evaluating automation opportunities, or debugging workflow reliability. Triggers on "build a workflow", "create a steward", "automate this process", "workflow audit", "what should I automate".
7 - tools-only Bundle Claude Md Manager 2
Create, audit, and maintain CLAUDE.md documentation files that configure Claude Code for projects. Use this skill when (1) initializing a new project with Claude Code configuration, (2) reviewing or improving existing CLAUDE.md files, (3) organizing project instructions using progressive disclosure patterns, (4) converting repeated instructions into permanent documentation, or (5) setting up agent_docs/ structures for larger codebases. Handles the WHAT/WHY/HOW framework, conciseness optimization, and file import patterns.
7 - tools-only Bundle Draft Polisher 2
Audit-style editing pass for `output/DRAFT.md`: remove template boilerplate, improve coherence, and enforce citation anchoring. **Trigger**: polish draft, de-template, coherence pass, remove boilerplate, 润色, 去套话, 去重复, 统一术语. **Use when**: a first-pass draft exists but reads like scaffolding (repetition/ellipsis/template phrases) or needs a coherence pass before global review/LaTeX. **Skip if**: the draft already reads human-grade and passes quality gates; or prose is not approved in `DECISIONS.md`. **Network**: none. **Guardrail**: do not add/remove/invent citation keys; do not move citations across subsections; do not change claims beyond what existing citations support.
7 - tools-only Bundle Audit Plan 2
Perform a high-level flow audit of an implementation plan, analyzing phase-to-phase dependencies, data flow consistency, ordering logic, stale artifacts, and risk assessment. Use when asked to 'audit the plan', 'check plan flow', 'review plan dependencies', 'find plan discrepancies', or 'assess plan coherence'. Do NOT use for per-phase template compliance (use /review-plan) or creating plans (use /create-plan).
7 - tools-only Bundle Security Audit 4
Perform a security audit of code changes or related code paths. Use when asked to assess security risks in a PR/MR, issue, or feature area and report findings with severity and remediation.
7 - tools-only Bundle Sf Soql 4
Advanced SOQL skill with natural language to query generation, query optimization, relationship traversal, aggregate functions, and performance analysis. Build efficient queries that respect governor limits and security requirements.
7 - tools-only Bundle Sf Apex 3
Generates and reviews Salesforce Apex code with 2025 best practices and 150-point scoring. Use when writing Apex classes, triggers, test classes, batch jobs, or reviewing existing Apex code for bulkification, security, and SOLID principles.
7 - tools-only Bundle Quality Auditor 2
Review recent changes for correctness, simplicity, security, and test coverage.
7 - tools-only Bundle Security Scout 2
Used by /flow-next:prime to scan for security configuration including GitHub settings, CODEOWNERS, and dependency updates. Do not invoke directly.
7 - tools-only Bundle 659 Description Skill E3a3925d
Audit skill lifecycle by tracing call chains, detecting circular dependencies, finding instruction contradictions, identifying duplicated datasets, analyzing bidirectional coherence, discovering scriptable sequences, and learning patterns. Use when checking skill coherence, validating skill workflow, finding semantic gaps in plugin structure, or auditing plugin before marketplace submission. Generates audit reports to .claude/audits/ with findings by dimension.
7 - tools-only Bundle Claude Settings Audit 2
Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.
7 - tools-only Bundle Semgrep 2
Run Semgrep static analysis scan on a codebase using parallel subagents. Automatically detects and uses Semgrep Pro for cross-file analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases and triage.
7 - tools-only Bundle Doc Drift Auditor 3
Audits documentation accuracy against actual implementation. Analyzes git history to identify when code and documentation diverged, extracts actual features from source code, compares against documentation claims. Generates comprehensive audit reports categorizing drift (implemented but undocumented, documented but unimplemented, outdated documentation, mismatched details). Uses git forensics, code analysis, and evidence-based reporting with specific file paths, line numbers, and commit SHAs.
7 - tools-only Bundle 396 Reference Set 02 Access Control 8dd17c5f
<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 396 Reference Set 02 Access Control A00cc97c
<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 2141 Security Controls And Assets D536cfa9
Security Controls and Asset Categories
7 - tools-only Bundle Python Security Expert 2
Expert security auditor specializing in Python application security, DevSecOps, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/JWT), OWASP standards, and security automation. Use PROACTIVELY for security audits, DevSecOps integration, or compliance implementation in Python applications.
7 -
thedixitjain Skill Differential Review 2Security-focused code review for PRs, commits, and diffs.
2 - tools-only Bundle 528 Techsmith Security Basics 119d6ce9
techsmith-security-basics
7 - tools-only Bundle 423 Reference Set 06 Tls Cipher String 18d2f4a7
<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 423 Reference Set 06 Tls Cipher String 98e8ce57
<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 839 Reference Set 02 Access Control 9ced2093
<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 537 Vastai Security Basics F4a7c1a9
vastai-security-basics
7 - tools-only Bundle 871 Reference Set 06 Tls Cipher String 40f872d8
<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 401 Reference Set 03 Injection Prevention Java 0247ca9c
<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 401 Reference Set 03 Injection Prevention Java 7f56a12a
<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7 - tools-only Bundle 425 Reference Set 06 Transport Layer Protection 60ac3b0b
<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->
7
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include implementing-database-audit-logging, audit-openclaw-host-security-posture-and-hardening-gaps, data-governance. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.