Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
gabrielmoreira Skill Analyzing Certificate Transparency For PhishingMonitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
17 - gabrielmoreira Skill Extension Audit Methodology
Systematic 5-dimension audit framework for VS Code extensions — debug hygiene, dead code, performance, menu validation, dependency cleanup
17 - gabrielmoreira Skill Path Traversal Prevention
When copying files or serving content, user-controlled paths can escape the intended directory:
17 - gabrielmoreira Skill Exploiting Macos Dyld Hijacking And Process Injection
Exploiting macOS dynamic-linker and process-injection primitives during authorized engagements - DYLD_INSERT_LIBRARIES injection, @rpath/missing-dylib hijacking with re-export proxy libraries, dyld interposing and fishhook symbol rebinding, Objective-C method swizzling, and Mach task-port thread hijacking (task_for_pid) including arm64e PAC handling - using otool, codesign, install_name_tool, gcc/clang, and lldb, with EndpointSecurity detection notes.
17 - gabrielmoreira Skill Performing Wireless Security Assessment With Kismet
Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.
17 - gabrielmoreira Skill Performing Paste Site Monitoring For Credentials
Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
17 - gabrielmoreira Skill Performing Threat Emulation With Atomic Red Team
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
17 - gabrielmoreira Skill Analyzing Ethereum Smart Contract Vulnerabilities
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.
17 - gabrielmoreira Skill Performing OAUTH Scope Minimization Review
Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.
17 - gabrielmoreira Skill Error Message Sanitization
Raw error messages leak internal information to users:
17 - gabrielmoreira Skill Guide Advanced Remediation
Complex multi-step remediation scenarios for S360 Tenant Isolation violations that require code changes, Federated Identity Credential (FIC) setup, and bilateral coordination between service teams.
17 - gabrielmoreira Skill Remediate Pfx Certificates
Skill helps user to remove checked-in certificates from source code in case of exposed secrets
17 - gabrielmoreira Skill Shell Injection Prevention
Use execFileSync with args array instead of execSync with string concatenation to prevent shell injection
17 - gabrielmoreira Skill Implementing Application Whitelisting With Applocker
Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance requirements for software restriction, or preventing execution of unsigned or untrusted binaries. Activates for requests involving AppLocker, application whitelisting, software restriction, or executable control.
17 - gabrielmoreira Skill Bypassing Authentication With Forced Browsing
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
17 - gabrielmoreira Skill Exploiting Server Side Includes Esi Injection
Exploiting Server-Side Includes (SSI) and Edge-Side Includes (ESI) injection where unsanitized input is reflected into content processed by an SSI-enabled web server or an ESI-capable cache/proxy (Squid, Varnish, Fastly, Akamai, nodesi), enabling command execution, file inclusion, SSRF, cookie theft (incl. HttpOnly), and XSS/WAF bypass. Activates when reflected input may be parsed as SSI/ESI directives.
17 - gabrielmoreira Skill Hyperflow Audit
Hyperflow code review. Use when the user wants the current diff, a commit, branch, or PR reviewed — verbs like audit, review, "check for issues", "security check", "code review". Multi-level review (L1 quick → L5 exhaustive), writes findings to .hyperflow/audits/, then a fix-gate.
17 - gabrielmoreira Skill Analyzing Memory Forensics With Lime And Volatility
Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
17 - gabrielmoreira Skill Prioritizing Vulnerabilities With Cvss Scoring
The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r
17 - gabrielmoreira Skill Testing For Xss Vulnerabilities With Burpsuite
Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.
17 - gabrielmoreira Skill Performing Subdomain Enumeration With Subfinder
Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.
17 - gabrielmoreira Skill Documentation Quality Assurance
Systematic documentation audit, drift detection, preflight validation, and multi-pass quality pipelines
17 - gabrielmoreira Skill Performing Active Directory Vulnerability Assessment
Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.
17 - gabrielmoreira Skill Skill Safety Reviewer
Review a skill-requested filesystem, command, network, secret, or destructive action against an explicit sandbox policy without executing it.
17 -
majiayu000 Bundle Polisci ReviewRun a political science pre-submission audit with journal-aware personas, stage-aware standards, and evidence-grounded issue reporting.
567 - majiayu000 Bundle Section Review
First-principles, truth-seeking, zero-assumption section review. Decomposes the problem before judging the solution. Questions every decision. Red-teams inputs. Evaluates scalability, security, testability, performance, and maintainability. Names specific alternatives. Calibrates depth to project stage. Talks to a senior engineer who wants the real picture.
567 - majiayu000 Bundle The Audit
Strategic communication filter. Transforms raw emotional input into strategic output. Use when user says 'audit this', 'filter this', 'make this strategic', or before sending high-stakes communications.
567 - majiayu000 Bundle Audit Code Quality
Scan codebase for bad coding practices that violate fail-fast principles
567 - majiayu000 Bundle Auditing Libraries
This skill should be used when the user asks to "audit libraries", "check library conventions", "validate lib structure", "find convention violations", "review library organization", or wants to verify that existing libraries follow the _.ts/__.ts namespace pattern correctly. Identifies and reports violations.
567 - majiayu000 Bundle Capacitor Security
Comprehensive security guide for Capacitor apps using Capsec scanner. Covers 63+ security rules across secrets, storage, network, authentication, cryptography, and platform-specific vulnerabilities. Use this skill when users need to secure their mobile app or run security audits.
567 - majiayu000 Bundle Golang Clean Architecture
Clean Architecture audit for Go services. Use when reviewing layered architecture, dependency rules, or gRPC/usecase/repository patterns. Ensures proper separation of concerns and dependency inversion.
567 - majiayu000 Bundle Code Quality Gates
Use automatically before and after code changes. Ensures documentation, formatting, type safety, and audit standards.
567 - majiayu000 Bundle Code Review Expert
Expert-level code review focusing on quality, security, performance, and maintainability. Use this skill for conducting thorough code reviews, identifying issues, and providing constructive feedback.
567 - majiayu000 Bundle Content Versioning
Use when implementing draft/publish workflows, version history, content rollback, or audit trails. Covers versioning strategies, snapshot storage, diff generation, and version comparison APIs for headless CMS.
567 - majiayu000 Bundle Controls Extractor
Extract and analyze security controls from OSCAL catalogs, profiles, and SSPs. Use this skill to get detailed information about control hierarchies, statements, parameters, and implementation status for compliance analysis.
567 - majiayu000 Bundle Deps Health Inline
Inline orchestration workflow for dependency audit and updates. Provides step-by-step phases for dependency-auditor detection, priority-based updates with dependency-updater, and verification cycles.
567
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include analyzing-ethereum-smart-contract-vulnerabilities, performing-oauth-scope-minimization-review, remediate-pfx-certificates. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.