Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
majiayu000 Bundle Code Review 6Review, analyze, and inspect code for Photo Map MVP project following Spring Boot, Angular 18, and shared project conventions. Check security, performance, naming, testing, and MVP scope compliance. U
567 - majiayu000 Bundle Spring Boot 2
Comprehensive Spring Boot 3.x best practices for building scalable, maintainable enterprise applications with Jakarta EE. Use this skill when creating Spring Boot applications, designing REST APIs, implementing security, writing tests, or architecting Spring Boot projects. Covers Controller-Service-Repository patterns, validation, error handling, testing strategies, performance optimization, and production-ready configurations.
567 - majiayu000 Bundle Test Review 2
Evaluate and upgrade test suites with TDD/BDD rigor, coverage tracking, and quality assessment. Triggers: test audit, test coverage, test quality, TDD, BDD, test gaps, test improvement, coverage analysis, test remediation Use when: auditing test suites, analyzing coverage gaps, improving test quality, evaluating TDD/BDD compliance DO NOT use when: writing new tests - use parseltongue:python-testing. DO NOT use when: updating existing tests - use sanctum:test-updates. Use this skill for test suite evaluation and quality assessment.
567 - majiayu000 Bundle Brand Voice 2
Develop or document a complete brand voice and tone system covering voice attributes, tone shifts by context, vocabulary preferences, grammar rules, and copy examples. Use this skill whenever the user wants to define how a brand sounds, write a voice and tone document, audit existing copy for voice consistency, train a team or AI assistant on brand voice, or refine the personality of brand writing. Triggers on brand voice, voice and tone, tone of voice, writing voice, brand personality, copy voice, voice document, voice guidelines, how should we write, voice training, voice audit. Also triggers when the user has copy that 'feels off' and the underlying issue is voice, even if not stated explicitly.
567 - majiayu000 Bundle Deep Analysis 2
Analytical thinking patterns for comprehensive evaluation, code audits, security analysis, and performance reviews. Provides structured templates for thorough investigation with extended thinking support.
567 - majiayu000 Bundle Localize 2
· Audit app i18n/l10n: hardcoded strings, locale catalogs, translations, fallback gaps. Triggers: 'i18n', 'internationalization', 'localization', 'locale', 'hardcoded strings', 'next-intl'.
567 - majiayu000 Bundle Reviewer 3
MUST BE USED for code review. Use PROACTIVELY when /review command is invoked or after any code changes to check correctness, architecture, and security.
567 - majiayu000 Bundle Crm Sync 2
Sync leads from Zoho CRM into the local SQLite database. Fetches all leads, performs upserts with change detection, and maintains full audit history.
567 - majiayu000 Bundle Spec Clarify 2
Resolve ambiguities and markers in validation.yaml interactively. Updates spec docs directly with full audit trail.
567 - majiayu000 Bundle Code Review 8
Review code changes following RT Stack conventions and best practices. 按照 RT Stack 规范和最佳实践审查代码变更。 Use when: - Reviewing pull requests - Checking code quality before commit - User mentions "review", "check code", "审查代码", "代码检查"
567 - majiayu000 Bundle PDF Toolkit 2
Audit PDF files for metadata leakage, page count, encryption, JavaScript, embedded files, and version. Use before sending a PDF externally, when redacting sensitive metadata, or running a PDF security review.
567 - majiayu000 Bundle Session End 2
Mandatory session close-out with IG audit, AAR, and optional HISTORIAN. Enforces clean session handoff.
567 - majiayu000 Bundle Pr Workflow 2
General guidelines for Commits, formatting, CI, dependencies, security
567 - majiayu000 Bundle Hook Authoring 2
Complete guide for writing Claude Code and SDK hooks with security-first design. Triggers: hook creation, hook writing, PreToolUse, PostToolUse, UserPromptSubmit, tool validation, logging hooks, context injection, workflow automation Use when: creating new hooks for tool validation, logging operations for audit, injecting context before prompts, enforcing project-specific workflows, preventing dangerous operations in production DO NOT use when: logic belongs in core skill - use Skills instead. DO NOT use when: complex multi-step workflows needed - use Agents instead. DO NOT use when: behavior better suited for custom tool. Use this skill BEFORE writing any hook. Check even if unsure.
567 - majiayu000 Bundle Developer 2
Senior-level development guidance for this project. Use when writing code, implementing features, refactoring, reviewing code architecture, or when best practices and security considerations are needed. (project)
567 - majiayu000 Bundle Docs Sync 3
Analyze main branch implementation and configuration to find missing, incorrect, or outdated documentation in docs/. Use when asked to audit doc coverage, sync docs with code, or propose doc updates/structure changes. Only update English docs under docs/** and never touch translated docs under docs/ja, docs/ko, or docs/zh. Provide a report and ask for approval before editing docs.
567 - majiayu000 Bundle Tech Debt 3
Identify and resolve technical debt with focus on finding and cataloging issues. Use when asked to find code smells, audit TODOs, identify complexity, improve code quality, or assess technical debt. Triggers on: "use tech-debt mode", "tech debt", "find TODOs", "code smells", "technical debt audit", "find complexity", "code quality audit". Full access mode - can modify files and run tests.
567 - majiayu000 Bundle Review Docs 2
ドキュメントとコードの乖離を監査。APIエンドポイント、スキーマ、設定ファイルとドキュメントを比較し、不整合をレポート。定期的なドキュメントヘルスチェックに使用。
567 - majiayu000 Bundle Code Reviewer 2
Review code for correctness, maintainability, performance, and security. Produce actionable, prioritized feedback and concrete fixes aligned with repo standards.
567 - majiayu000 Bundle Fact Checking 2
Use when reviewing code changes, auditing documentation accuracy, validating technical claims before merge, or user says "verify claims", "factcheck", "audit documentation", "validate comments", "are these claims accurate".
567 - majiayu000 Bundle Integrations 2
External API integrations with OAuth2, async HTTP, and proper error handling
567 - majiayu000 Bundle Web Security 2
Exploits web application vulnerabilities. Use when working with SQL injection, XSS, SSRF, SSTI, command injection, path traversal, authentication bypass, deserialization, or any web-based CTF challenge.
567 - majiayu000 Bundle Context Audit 2
Audit current context composition and identify optimization opportunities. Use when context window is overloaded, agents are underperforming, or applying the R&D framework to optimize token usage.
567 - majiayu000 Bundle Gsd Audit Uat 2
Cross-phase audit of all outstanding UAT and verification items
567 - majiayu000 Bundle Deep Audit 2
· Run 5-wave repo audits, persist findings, and generate phased tasks. Triggers: 'deep audit', 'full audit', 'comprehensive review', 'audit report', 'mega review', 'deep review'. Not for quick sweeps (use full-review).
567 - majiayu000 Bundle Governance 4
Engineering standards and code governance enforcement. Triggers during code review discussions, PR descriptions, commit preparation, and when discussing code quality. Ensures compliance with standards.md and runs audit checks. Trigger phrases include "code review", "review this", "commit", "standards", "compliance", "code quality", "best practices", "before I merge".
567 - majiayu000 Bundle Heal Skill 2
Repair skill hygiene, and deep-audit SKILL.md quality (absorbed from /skill-auditor). Triggers: "heal-skill", "heal skill", "repair skill hygiene", "skill-auditor", "audit skill", "skill audit".
567 - majiayu000 Bundle Sc Analyze 2
Comprehensive code analysis, quality assessment, and issue diagnosis. Use when analyzing code quality, security vulnerabilities, performance bottlenecks, architecture reviews, or troubleshooting bugs and build failures.
567 - majiayu000 Bundle Dependency Audit 2
Scan project for outdated or vulnerable dependencies, enforce dependency policies, check licenses, and generate upgrade recommendations.
567 - majiayu000 Bundle Qms Audit Expert 2
ISO 13485 internal audit expertise for medical device QMS. Use for audit planning and execution, nonconformity classification, CAPA verification, external audit preparation, or audit program management.
567 - majiayu000 Bundle Scope Discipline 2
Use when about to send a request to, scan, enumerate, exploit, or otherwise interact with any host, IP, URL, or asset — before the first packet reaches a target
567 - majiayu000 Bundle Auth Patterns 3
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
567 - majiayu000 Bundle Firebase Auth 2
Implements Firebase Authentication with email, OAuth, phone auth, and custom tokens. Use when building apps with Firebase, needing flexible auth methods, or integrating with Firebase ecosystem.
567 - majiayu000 Bundle Secure Coding 2
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567 - majiayu000 Bundle Create Hook 2
Create Claude Code hooks with proper patterns, security best practices, and configuration. Use this skill when building PreToolUse, PostToolUse, SessionStart, or other hook types for plugins.
567 - majiayu000 Bundle Security Scan 3
对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。
567
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include code-review, spring-boot, test-review. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.