Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
majiayu000 Bundle Threat Modeling 6Identify and analyze security threats. Use when designing systems, reviewing architecture, or assessing risk. Covers STRIDE methodology.
567 - majiayu000 Bundle Architecture Audit 2
Comprehensive **project** consistency review across code, documentation, diagrams, and configuration
567 - majiayu000 Bundle Risk Management Specialist 2
Expert IT Risk Manager with deep knowledge of ISO 27005 (IT risk management), ISO 31000 (enterprise risk management), and ISO 27001 integration. Specializes in optimizing workflows through the Data Reuse principle - leveraging existing Assets, Incidents, Controls, and Business Processes to streamline risk assessments. Automatically activated when user asks about risk management, risk assessment, risk treatment, risk appetite, risk acceptance, ISO 27005, ISO 31000, threat analysis, vulnerability assessment, or risk matrices.
567 - majiayu000 Bundle Project Wizard 3
Interactive setup wizard for creating new projects with proper structure, security configurations, GitHub repository, and Archon project tracking. Guides users through project creation from template with pre-commit hooks, branch protection, and customized documentation. Use when starting a new project, setting up a repository, or initializing a new codebase.
567 - majiayu000 Bundle Production Readiness 2
Run a comprehensive production readiness audit. Use when a user wants to check if their project is ready for deployment. Covers security, visual QA, code quality, testing, error handling, configuration/build, and performance.
567 - majiayu000 Bundle Codex Orchestrator 2
Orchestrate OpenAI Codex CLI with specialized subagents for code review, debugging, architecture analysis, security audits, refactoring, and documentation. This skill should be used when delegating focused development tasks to Codex subagents (gpt-5.4, gpt-5.4-pro, gpt-5-mini) via AGENTS.md persona injection.
567 - majiayu000 Bundle Ln 624 Code Quality Auditor 2
Code quality audit worker (L3). Checks cyclomatic complexity, deep nesting, long methods, god classes, method signature quality, O(n²) algorithms, N+1 queries, magic numbers/constants. Returns findings with severity, location, effort, recommendations.
567 - majiayu000 Bundle Review Code 17
Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps by running internal reviews and a peer review in parallel and returning combined findings. Single-concern with a type argument, or full review with no argument. Use when the user asks to "review my code", "full code review", "review my changes", "check for bugs", "scan for bugs", "review correctness", "security audit", "find vulnerabilities", "review security", "check API usage", "verify against docs", "check for cross-file duplication", "review consistency", "check for code reuse", "review simplicity", "find untested code", or "review test coverage".
567 - majiayu000 Bundle Audit Security 2
White-box security audit. Blue-teamer evaluates defensive posture, then red-teamers attack informed by defensive gaps. Iterates when exploit chains are discovered. Heavy and thorough by design.
567 - majiayu000 Bundle Defense In Depth 7
Apply layered security architecture. Use when designing security controls, hardening systems, or reviewing security posture. Covers multiple security layers.
567 - majiayu000 Bundle Secrets Management 7
Secure token storage, VS Code SecretStorage API, credential management, environment variable migration
567 - majiayu000 Bundle Security Review 28
Security-focused code review identifying high-confidence exploitable vulnerabilities with two-axis severity/confidence scoring, OWASP 2025 alignment, per-finding Haiku verification, and false positive filtering. Optional GitHub PR posting. Use when user runs /security-review, /review:security-review, requests a "security review", "security audit", "vulnerability scan", or mentions "find vulnerabilities", "check for exploits".
567 - majiayu000 Bundle Security Reviewer 5
Security review wrapper for vibe review flow. Detects OWASP-style risks, secret leaks, auth flaws, and unsafe input handling.
567 - majiayu000 Bundle Session Management 7
セッション管理（Session Management）機能の開発・修正を行う際に使用。OPSession, ClientSession, SSO, RP-Initiated Logout, Back-Channel Logout実装時に役立つ。
567 - majiayu000 Bundle Architecture Review 11
Systematic evaluation of software architecture across scalability, maintainability, security, performance, reliability, and cost dimensions. Use when designing systems, reviewing technical approaches, evaluating patterns, making architectural decisions, or assessing technical debt.
567 - majiayu000 Bundle Event Sourcing 2
Event sourcing patterns for storing state as a sequence of events. Use when implementing event-driven architectures, CQRS, audit trails, or building systems requiring full history reconstruction.
567 - majiayu000 Bundle Moai Security Encryption 2
Enterprise Encryption Security with AI-powered cryptographic architecture, Context7 integration, and intelligent encryption orchestration for data protection
567 - majiayu000 Bundle Review Security 5
White-box security audit. Blue-teamer and lead red-teamer run in parallel isolation for an independent first pass — neither sees the other's output during reconnaissance. A synthesis step categorizes findings into four prescriptive buckets (anchoring-suppressed, convergent, blue-flagged-unverified, divergent), producing a unified target list. Focused red-teamers then deep-dive each target. Iterates when exploit chains are discovered. Heavy and thorough by design. Advisory only — produces findings and proposes tickets; does not implement remediation.
567 - majiayu000 Bundle Security Hardening 3
Harden code against vulnerabilities as you build it. Use when handling untrusted input, authentication or authorization, data storage, or external integrations.
567 - majiayu000 Bundle Documentation Audit 4
Full audit and update of BioETL project documentation for v5.22+. Use when asked to review docs for staleness, reconcile docs with code, sync RULES.md and REQUIREMENTS.md, update architecture/provider/contract docs, reflect ADR-010/ADR-014/ADR-017, or identify dead documentation.
567 - majiayu000 Bundle Fristenbuch Fuehren 2
Zentrales Fristenbuch für die Kanzlei mit Haupt- und Vorfristen über alle Rechtsgebiete. Berechnet Fristbeginn nach den jeweiligen Verfahrensordnungen (ZPO StPO SGG FGO VwGO FamFG AO BGB) Vier-Tages-Fiktionen bei Postzustellung (PostModG seit 1.1.2025; bis 31.12.2024 drei Tage). Trennt Notfristen (BRAO-Haftungsrisiko) von Beobachtungsfristen. Setzt Vorfristen typisch fuenf Werktage vor Hauptfrist; bei BRAO-relevanten Notfristen sieben Werktage. Eskalation an Sekretariat und zuständigen Anwalt bei Vorfristerreichung. Audit-Trail jeder Fristaenderung.
567 - majiayu000 Bundle Performance Tuning 2
Optimize Linux system performance. Configure kernel parameters, analyze bottlenecks, and tune resources. Use when improving system performance.
567 - majiayu000 Bundle Authentication Patterns 2
Authentication patterns: API keys, OAuth, token management, credentials.
567 - majiayu000 Bundle Compliance Auditor 2
Expert technical compliance auditor specializing in SOC 2, ISO 27001, HIPAA, and PCI-DSS audits — from readiness assessment through evidence collection to certification.
567 - majiayu000 Bundle Migration Patterns 6
Database migration creation with mandatory RLS policies and ARCHitect approval workflow. Use when creating migrations, adding tables with RLS, or updating Prisma schema.
567 - majiayu000 Bundle Security Best Practices 2
Expert security decisions for iOS/tvOS: when Keychain vs UserDefaults, certificate pinning trade-offs, API key protection strategies, and secure data lifecycle management. Use when storing sensitive data, implementing authentication, or hardening app security. Trigger keywords: Keychain, security, certificate pinning, encryption, API key, token storage, secure storage, biometric, jailbreak, data protection
567 - majiayu000 Bundle Security Scan 11
Scan for security vulnerabilities in dependencies, code patterns, and secrets. Uses project-documented tooling where available. Use at phase checkpoints or before releases to check for vulnerabilities.
567 - majiayu000 Bundle Site To IOS App 2
Turns a website, PWA, dashboard, or marketplace into an iOS app. Use when the user has a live site or web app and asks to put it on the App Store, wrap it in an app, ship an iOS version, or convert a PWA to native. Covers URL audit, shell-vs-native strategy, App Store Guideline 4.2 wrapper-rejection risk, native value requirements, screenshots, metadata, privacy answers, and the release gate. Not for: building a native iOS app when no website exists; repairing or releasing an existing Capacitor shell; Android conversions; or keyword and listing audits on an app that already shipped.
567 - majiayu000 Bundle Subagent Driven Development 8
The implementation engine. Routed to by /sprint (full plan, autonomous) and by executing-plans (scoped batch, checkpoint-gated). One fresh subagent per task — test-first via tdd — followed by spec-compliance review, quality review, and fresh-run verification. No single context accumulates drift, and nothing is accepted on a subagent's word.
567 - majiayu000 Bundle Ln 630 Test Auditor 2
Test suite audit coordinator. Delegates to 5 workers (Business Logic, E2E, Value, Coverage, Isolation). Aggregates results into docs/project/test_audit.md.
567 - majiayu000 Bundle 1password Direnv Secrets 2
Configures 1Password CLI with direnv for fast secret loading using op-run pattern. Activates for: 1Password + direnv setup, slow secrets (>2 sec), environment variables from 1Password, .env.op files,
567 - majiayu000 Bundle Performance Optimization 12
Diagnose and fix web performance issues including Core Web Vitals (LCP, INP, CLS), bundle size, asset optimization, render performance, and runtime efficiency. Use this skill whenever the user wants to improve page speed, fix Core Web Vitals, optimize assets, reduce bundle size, debug slow renders, or systematically improve a site's performance. Triggers on performance, page speed, Core Web Vitals, LCP, INP, CLS, FID, TTFB, bundle size, code splitting, image optimization, lazy loading, render blocking, slow page, performance audit, Lighthouse score. Also triggers when traffic or conversion is dropping due to perceived slowness.
567 - majiayu000 Bundle Ln 623 Code Principles Auditor 3
Code principles audit worker (L3). Checks DRY (10 types), KISS/YAGNI, error handling, DI patterns. Returns findings with severity, location, effort, pattern_signature.
567 - majiayu000 Bundle Security Specialist 3
提供安全审计、风险评估和合规检查能力。当需要进行安全审查、风险评估或合规验证时使用。
567 - majiayu000 Bundle Software Security Appsec 2
Modern application security patterns including OWASP Top 10:2025, zero trust architecture, supply chain security, authentication, authorization, input validation, and cryptography for 2024-2025
567 - majiayu000 Bundle Vulnerability Analysis 2
Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
567
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include threat-modeling, project-wizard, production-readiness. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.