Security Agent Skills
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Security
1,976 skills
owl-listener design-debt-audit
Identify, categorize, and prioritize accumulated design inconsistencies and structural problems across a product.
1.7k
owl-listener design-token-audit
Audit design token usage across a product for consistency and coverage, identifying hard-coded values and gaps.
1.7k
cloudflare-security-audit security-audit
Finds exploitable vulnerabilities in codebases through a structured multi-phase audit covering recon, hunting, validation, and reporting.
· bundle
antigravity aegisops-ai
Orchestrates Gemini 3 Flash to audit Linux Kernel patches for memory safety, detect cost drifts in Terraform plans, and generate hardened Kubernetes security contexts.
42.4k
antigravity cyber-audit
Runs read-only exposure checks for security advisories and writes a structured local audit report.
42.4k
agricidaniel ads-snapchat
Audits Snapchat Ads measurement, Snap Pixel, Conversions API, mobile and app campaigns, creative formats, audiences, budgets, brand safety, and reporting.
agricidaniel ads-validate
Validates Claude Ads contracts, bundles, scores, runs, capabilities, repositories, and releases with deterministic checks and recovery steps.
agricidaniel ads-attribution
Audit cross-platform attribution by reconciling conversion definitions, reporting windows, and data sources across browsers, servers, MMPs, and ad platforms.
agricidaniel ads-server-side-tracking
Audit server-side paid-media measurement, including tag management, conversion APIs, event taxonomy, deduplication, consent, hashing, data quality, and observability.
jakubantalik transitions-polish
Polishes existing motion against the transitions.dev motion-token scale by auditing duration, distance, scale, blur, and easing values and suggesting token-based corrections.
· bundle
dontbesilent2025 dbs-skill-cleaner
Scans installed or specified agent skills for advertising, covert commercial intent, task hijacking, suspicious external calls, and sensitive-data access. Reports findings first and quarantines only after explicit user confirmation.
· bundle
zhaoxuya520 radare2
Provides a command-line workflow for binary analysis with radare2, covering reconnaissance, disassembly, function analysis, string and import inspection, patching, binary diffing, and r2pipe scripting across PE, ELF, Mach-O, DEX, and WASM formats.
12.8k · bundle
zhaoxuya520 cloud-k8s
Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.
12.8k · bundle
zhaoxuya520 pwn-chain
Engineers reliable exploits from known vulnerabilities in binaries, covering stack overflows, heap exploitation, and kernel pwn with remote stabilization techniques.
12.8k · bundle
zhaoxuya520 js-reverse
Guides front-end JavaScript reverse engineering through a structured observe-capture-rebuild workflow using js-reverse MCP tools and optional jshookmcp for browser automation, CDP debugging, and runtime hooking.
12.8k · bundle
zhaoxuya520 windows-ad
Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.
12.8k · bundle
zhaoxuya520 apk-reverse
Provides a structured CLI workflow for Android APK reverse engineering, covering decompilation with jadx and apktool, smali modification, repackaging, signing, and Frida dynamic hooking, with optional native .so analysis via IDA or radare2.
12.8k · bundle
zhaoxuya520 api-security
Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.
12.8k · bundle
zhaoxuya520 attack-chain
Orchestrates multi-stage attack-path planning and execution across reconnaissance, initial access, privilege escalation, lateral movement, and impact assessment for authorized penetration testing.
12.8k · bundle
zhaoxuya520 llm-security
Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
12.8k · bundle
zhaoxuya520 macos-reverse
Guides authorized macOS and Mach-O reverse engineering covering codesign analysis, Objective-C/Swift symbol recovery, endpoint security surfaces, and Apple platform malware analysis.
12.8k · bundle
zhaoxuya520 pentest-tools
Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.
12.8k · bundle
zhaoxuya520 wifi-wireless
Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.
12.8k · bundle
zhaoxuya520 email-security
Analyzes email security including phishing dissection, SPF/DKIM/DMARC authentication checks, BEC fraud patterns, and OAuth token abuse research for authorized reviews.
12.8k · bundle
zhaoxuya520 ghidra-reverse
Performs free, open-source reverse engineering with Ghidra using headless or GUI modes, including decompilation, cross-references, and optional MCP workflows when IDA is unavailable.
12.8k · bundle
zhaoxuya520 mobile-reverse
Provides a structured methodology for authorized Android and iOS reverse engineering, covering static analysis, dynamic instrumentation with Frida and Objection, SSL pinning bypass, root/jailbreak detection evasion, and cryptographic key extraction.
12.8k · bundle
zhaoxuya520 firmware-pentest
End-to-end firmware and IoT penetration testing pipeline following OWASP FSTM methodology. Extracts, emulates, and exploits router, camera, and smart-home firmware using binwalk, EMBA, Firmadyne, and AFL++.
12.8k · bundle
zhaoxuya520 malware-analysis
Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.
12.8k · bundle
zhaoxuya520 protocol-reverse
Authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery with structured workflow and tooling.
12.8k · bundle
zhaoxuya520 digital-forensics
Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.
12.8k · bundle
zhaoxuya520 hardware-security
Guides authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot assessment, and offline firmware extraction support.
12.8k · bundle
zhaoxuya520 browser-automation
Unified automation entry point covering browser automation with Playwright and Windows desktop app automation with OpenReverse for GUI interaction, network capture, and reverse engineering workflows.
12.8k · bundle
zhaoxuya520 reverse-engineering
Provides structured reverse engineering techniques for analyzing compiled, obfuscated, packed, or virtualized targets including binaries, APKs, WASM, firmware, and custom VMs using static and dynamic analysis workflows.
12.8k · bundle
zhaoxuya520 supply-chain-security
Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.
12.8k · bundle
zhaoxuya520 src-hunter
Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.
12.8k · bundle
zhaoxuya520 competition-agent-cloud
Specialized CTF sandbox skill for analyzing prompt-to-tool chains, deployment drift, and supply-chain provenance in cloud, container, and CI/CD environments.
12.8k · bundle
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include security-audit, transitions-polish, dbs-skill-cleaner. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.