Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
majiayu000 Bundle Repo Assessing Criticality Confidence 2Universal classification system for checker and fixer agents using orthogonal criticality (CRITICAL/HIGH/MEDIUM/LOW importance) and confidence (HIGH/MEDIUM/FALSE_POSITIVE certainty) dimensions. Covers priority matrix (P0-P4), execution order, dual-label pattern for verification status, standardized report format, and domain-specific examples. Essential for implementing checker/fixer agents and processing audit reports
567 - majiayu000 Bundle Ciba 2
CIBA（Client Initiated Backchannel Authentication）機能の開発・修正を行う際に使用。Poll/Push/Pingモード、Login Hint解決、FCM通知実装時に役立つ。
567 - majiayu000 Bundle Ops Security Audit 2
Structured workflow for infrastructure security audits including compliance validation, vulnerability assessment, and security posture review.
567 - majiayu000 Bundle Axiom Privacy UX 2
Use when implementing privacy manifests, requesting permissions, App Tracking Transparency UX, or preparing Privacy Nutrition Labels - covers just-in-time permission requests, tracking domain management, and Required Reason APIs from WWDC 2023
567 - majiayu000 Bundle Moai Platform Clerk 3
Clerk modern authentication specialist covering WebAuthn, passkeys, passwordless, and beautiful UI components. Use when implementing modern auth with great UX.
567 - majiayu000 Bundle Shell Review 5
Audit shell scripts for correctness and common pitfalls. Use when reviewing bash/sh scripts before merging.
567 - majiayu000 Bundle 304 Frameworks Spring Boot Security 2
Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of cursor-rules-java project
567 - majiayu000 Bundle Ca Context Check 2
Optional manual drift audit — report stale provenance-tracked docs, then per stale doc offer re-scout, re-baseline, or defer. Not the daily loop; commit-gate auto-heal owns routine maintenance.
567 - majiayu000 Bundle Ca Checkpoint 2
Periodic multi-reviewer sweep of the whole codebase — surfaces a triaged checkpoint report.
567 - majiayu000 Bundle Research Repo 3
Scaffold or audit an entire research project repository organized around its source library. Use when starting, structuring, organizing, or reviewing a research repo. Build sources/{og,md,unprocessed}, references.bib, a PDF-to-Markdown converter, a repo-local process-source skill, AGENTS.md, .gitignore, .venv, and the relevant analysis/manuscript/review folders; or audit an existing layout. Not for one-PDF intake or publication replication packages.
567 - majiayu000 Bundle Phx Audit 5
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.
567 - majiayu000 Bundle Rust Review 3
Use this skill for Rust-specific code audits. Use when reviewing Rust code, auditing unsafe blocks, analyzing ownership patterns, scanning Cargo dependencies for security. Do not use when general code review without Rust - use unified-review. DO NOT use when: performance profiling - use parseltongue:python-performance pattern.
567 - majiayu000 Bundle Gathering Security 2
The drum sounds. Spider, Raccoon, and Turtle gather for complete security work. Use when implementing auth, auditing security, or hardening code end-to-end.
567 - majiayu000 Bundle System Design Interrogation 2
Use when planning system architecture to ensure nothing is missed. Provides structured questions covering scalability, security, data, and operational dimensions before implementation.
567 - majiayu000 Bundle Chezmoi Workflows 2
Dotfile backup, sync, and version control with chezmoi. Tracks shell configs (.zshrc, .bashrc, .zshenv), git (.gitconfig), editors (helix, vim, nvim), terminal tools (broot, starship, alacritty, kitty, wezterm), and XDG .config/ files. Operations include track, add, sync, push, pull, backup, restore, status, diff, re-add. Setup for chezmoi init, dotfiles remote, GitHub private repository, cross-machine sync, multi-account SSH. Handles merge conflicts, secret detection, Go templates.
567 - majiayu000 Bundle Codex Audit 2
Use Codex CLI for sandboxed auditing, debugging, and autonomous prototyping
567 - majiayu000 Bundle Polisci Review 2
You are coordinating a rigorous political science pre-submission audit.
567 - majiayu000 Bundle Moai Platform Firestore 3
Firebase Firestore specialist covering NoSQL patterns, real-time sync, offline caching, and Security Rules. Use when building mobile-first apps with offline support, implementing real-time listeners, or configuring Firestore security.
567 - majiayu000 Bundle System 3
System maintenance with three core operations - integrity check (find/fix broken references), document session (current transcript), document recent (catch-up since last update). Plus security workflows. USE WHEN integrity check, audit system, document session, document this session, document today, document recent, catch up docs, what's undocumented, check for secrets, security scan, privacy check, OR asking about past work ("we just worked on", "remember when we").
567 - majiayu000 Bundle AI Security 4
Use when scanning for security vulnerabilities: SAST, dependency audit, secret detection, and SBOM generation with OWASP mapping and CWE references.
567 - majiayu000 Bundle Heartwood Auth 2
Integrate Heartwood (GroveAuth) authentication into Grove applications. Use when adding sign-in, protecting routes, or validating sessions in any Grove property.
567 - majiayu000 Bundle Phx Review 5
Review code with parallel agents — tests, security, Ecto, LiveView, Oban. Use after implementation to catch bugs and anti-patterns before committing.
567 - majiayu000 Bundle Literature Review 11
Build or audit a literature review. Evidence map, gaps, synthesis plan.
567 - majiayu000 Bundle Paper Review Lite 2
Pre-submission audit. Argument, numerics, refs, writing, figures, replication.
567 - majiayu000 Bundle Survey Data Audit 2
Audit fielded survey response data for registered elements, data quality, bot and AI-automation screening, and sample integrity. Emits an appendix-ready quality report.
567 - majiayu000 Bundle Recon 3
Security reconnaissance. USE WHEN recon, reconnaissance, bug bounty, attack surface. SkillSearch('recon') for docs.
567 - majiayu000 Bundle Audit Code 2
Run a single-session code review audit on the codebase
567 - majiayu000 Bundle Arch Security Review 2
[Architecture] Use when reviewing code for security vulnerabilities, implementing authorization, or ensuring data protection.
567 - majiayu000 Bundle Decision Variance 4
Reconcile the project's architectural artifacts against the scaffold and prior decisions, then present each variance as a SMARTS analysis for the user to decide. Routed to when the user asks to arbitrate, reconcile, or consolidate architectural context, requests a variance report, mentions ADR conflicts, or asks which downstream artifacts the current state supports. Never decides alone — every arbitration is user-attributed and logged.
567 - majiayu000 Bundle Writing Rules 5
Creates behavioral rules in markdown to block dangerous commands or restrict AI behavior. Use when adding safety guardrails or preventing specific commands.
567 - majiayu000 Bundle Software Security 2
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
567 - majiayu000 Bundle Phx Audit 6
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.
567 - majiayu000 Bundle Py Test Swarm 2
Orchestrate hierarchical BioETL test swarms (L1/L2/L3) for full-audit, fix-failures, coverage-boost, optimize, and flakiness-scan with workload-based delegation, telemetry aggregation, flaky analysis, and final reporting in reports/test-swarm/task-id/FINAL-REPORT.md. Use when users request broad test campaigns, failure triage at scale, coverage expansion, or stability diagnostics across layers/providers.
567 - majiayu000 Bundle Versand Vor Check 2
Pflicht-Pre-Check vor jedem ausgehenden Versand — prueft Dokumentidentitaet (das richtige PDF? Stand vom richtigen Datum? Aktenzeichen passt?) Unterschrift (durch berechtigte Person? eigenhaendig oder qualifizierte elektronische Signatur?) Adressat (richtiges Gericht / Behoerde / Mandant? richtige Adresse beA-SAFE-ID EGVP-Adresse?) Anlagen (vollstaendig? im Inhaltsverzeichnis aufgefuehrt? Sigel richtig?) Versandweg (Post / beA / EGVP / E-Mail / De-Mail). Versandquittung sichern. Audit-Eintrag. Bei Mangel Versand sperren.
567 - majiayu000 Bundle Phx Deps Vet 4
Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after $phx-deps-audit findings or to initialize hex_vet.exs.
567 - majiayu000 Bundle 402 Frameworks Quarkus REST 2
Use when you need to design, review, or improve REST APIs with Quarkus REST (Jakarta REST) — including resource classes, HTTP methods, status codes, request/response DTOs, Bean Validation, exception mappers, optional runtime OpenAPI exposure (SmallRye), contract-first generation from OpenAPI, content negotiation, pagination, sorting and filtering, API versioning, idempotency (Idempotency-Key), optimistic concurrency (ETag / If-Match), HTTP caching (Cache-Control), API deprecation (Sunset / Deprecation headers), RFC 7807 Problem Details, ISO-8601 for time in contracts, and security-aware boundaries. This should trigger for requests such as Review or improve JAX-RS resources in a Quarkus project; Design HTTP APIs with validation and error handling on Quarkus; Add API versioning, idempotency, ETag concurrency, or deprecation headers; Implement pagination, sorting, or RFC 7807 Problem Details error responses. Part of cursor-rules-java project
567
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include repo-assessing-criticality-confidence, ciba, ops-security-audit. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.