Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
majiayu000 Bundle Hunting Subdomain Takeover<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567 - majiayu000 Bundle License Compliance Scanner
Scan license compliance scanner operations. Auto-activating skill for Security Fundamentals. Triggers on: license compliance scanner, license compliance scanner Part of the Security Fundamentals skill category. Use when working with license compliance scanner functionality. Trigger with phrases like "license compliance scanner", "license scanner", "license".
567 - majiayu000 Bundle Localsetup Keepass Secrets
Resolve logical secret IDs through KeePass using repo-local mapping files; optionally bulk-create or rotate secrets without ever writing values into tracked files.
567 - majiayu000 Bundle Managing Emtala Compliance
Evaluates emergency department practices against EMTALA requirements with documentation checklists. Use when assessing EMTALA compliance, reviewing MSE requirements, or documenting transfer obligations.
567 - majiayu000 Bundle Nw Security And Governance
Database security (encryption, access control, injection prevention), data governance (lineage, quality, MDM), and compliance frameworks (GDPR, CCPA, HIPAA)
567 - majiayu000 Bundle Opencrow Reversing Toolbox
Use the Anaconda `ctf` environment and installed reverse-engineering tooling for binary analysis, symbolic execution, disassembly, emulation, and binary patching. Use when Codex needs `angr`, `claripy`, `capstone`, `unicorn`, `ghidra-headless`, `radare2`, `objdump`, `strace`, `ltrace`, `binwalk`, or related tools.
567 - majiayu000 Bundle Pentest Engagement Planner
Define legal scope, rules of engagement, and authorization artifacts for downstream pentest execution.
567 - majiayu000 Bundle Railway Secrets Management
Railwayプラットフォーム上でのシークレット管理を専門とするスキル。環境変数設定、シークレットローテーション、アクセス制御を体系的に支援し、セキュアで運用しやすいデプロイメント環境を実現します。 Anchors: • Web Application Security (Andrew Hoffman) / 適用: 脅威モデリングとリスク評価 / 目的: セキュアなシークレット管理設計 • Railway Documentation / 適用: Variables API・Service Variables / 目的: Railway固有機能の理解と活用 • The Twelve-Factor App / 適用: 環境変数による設定管理 / 目的: クラウドネイティブな設定パターン Trigger: Use when configuring Railway secrets, rotating credentials, designing access control, managing environment-specific variables, or implementing secure secret management practices on Railway platform. Keywords: railway secrets, environment variables, secret rotation, railway variables api, service variables, railway security, credential management
567 - majiayu000 Bundle Security Scanning Patterns
Security vulnerability scanning, secret detection, dependency auditing, and OWASP best practices. Use when performing security audits, scanning for vulnerabilities, detecting exposed secrets, checking dependencies, validating security headers, implementing OWASP patterns, or when user mentions security, vulnerabilities, secrets, CVE, OWASP, npm audit, security headers, or penetration testing.
567 - majiayu000 Bundle Session Management Ssg Ssr
Expert skill for implementing session management in SSG (Static Site Generation) and SSR (Server-Side Rendering) contexts. Covers stateless authentication with JWT, database session management, client-side session handling, and security best practices for different rendering strategies. Use when implementing session management in static sites (SSG), handling authentication in server-side rendered applications (SSR), or implementing stateless authentication with JWT tokens.
567 - majiayu000 Bundle Cryptography
Cryptographic primitives and recipes for Python including symmetric encryption, asymmetric cryptography, key derivation, and X.509 certificate handling
567 - majiayu000 Bundle Solidity Security
Smart contract security patterns, vulnerability prevention, gas optimization, and audit preparation for Solidity development. Use when writing, auditing, or hardening smart contracts against reentrancy, overflow, access control, oracle manipulation, and front-running attacks.
567 - majiayu000 Bundle Web Application Pentesting
Lead web application penetration testing coordinator that orchestrates comprehensive security assessments by spawning specialized vulnerability testing subagents. Delegates all vulnerability testing to specialized subagents in .claude/agents directory.
567 - majiayu000 Bundle Ethical Hacking Methodology
This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.
567 - majiayu000 Bundle Deliverability Health Check
Audit your email deliverability by analyzing bounce rates, open rate anomalies, and sending patterns across reps and sequences to catch domain reputation issues early.
567 - majiayu000 Bundle Ck Research
Research technical solutions, analyze architectures, gather requirements thoroughly. Use for technology evaluation, best practices research, solution design, scalability/security/maintainability analysis.
567 - majiayu000 Bundle Managing Billing Compliance
Structures billing compliance programs with audit methodology and corrective action protocols. Use when auditing billing practices, managing compliance programs, or implementing corrective actions.
567 - majiayu000 Bundle Audit Performance Thread Safety
Audit codebase for performance bottlenecks and thread-safety issues
567 - majiayu000 Bundle Input Validation Xss Prevention
Validate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input, prevent cross-site scripting, use Zod schemas, or handle any user-generated content. Triggers include "input validation", "validate input", "XSS", "cross-site scripting", "sanitize", "Zod", "injection prevention", "validateRequest", "safeTextSchema", "user input security".
567 - majiayu000 Bundle Moai Core Proactive Suggestions
Proactive suggestions for code quality, security, and best practices
567 - majiayu000 Bundle Security Requirement Extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
567 - majiayu000 Bundle Agentuity CLI Auth Ssh Delete
Delete an SSH key from your account. Requires authentication. Use for managing authentication credentials
567 - majiayu000 Bundle Angular Folder Structure
Define, audit, and enforce an Angular 20 Feature-first + Shared + Core folder architecture with clear pages/templates/components boundaries, lazy feature routing, and deterministic data-access placement. Use when users ask to create folder structure, refactor app architecture, review Angular project organization, standardize scalable boundaries, or prepare codebases for lazy loading, microfrontends, and library extraction.
567 - majiayu000 Bundle Doubt Driven Development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
567 - majiayu000 Bundle Nuget Package Management
Manage NuGet packages using Central Package Management (CPM) and dotnet CLI. Never edit .csproj or Directory.Packages.props XML directly - use dotnet add/remove/list commands. Use shared version variables for related packages. Covers workspaces, security audits, and version management.
567 - majiayu000 Bundle Pmtl Production Baseline
PMTL_VN production-grade coding and runtime baseline. Use when implementing or refactoring features that need repo-specific defaults for logging, validation, security posture, caching, monitoring, deployment boundaries, and documentation sync.
567 - majiayu000 Bundle Professional Rust Review
Use when reviewing Rust code for craft quality, when writing new Rust code that should follow professional patterns, or when the user asks to judge, audit, or improve Rust code against best practices. Covers type design, function signatures, trait architecture, error handling, visibility, macros, testing, and performance patterns.
567 - majiayu000 Bundle Formulare Checkout Ecommerce
Prüft Formulare, Login, Suche, Warenkorb, Checkout, Zahlungsstrecke und elektronische Verträge in Webshops. Fokus BFSG/E-Commerce, Fehlermeldungen, Labels, Pflichtfelder, Zeitlimits und Bestellabschluss. Output: Checkout-Audit.
567 - majiayu000 Bundle Workspace Cleanup Audit
Read-only repository hygiene scanner for directories under ~/Workspace. Use when asked to audit cleanup chores, detect build or cache artifact buildup, find large transient files, or rank cleanup issues by severity with the repo and directory where each issue is found.
567 - majiayu000 Bundle Codex Execution Quality Gate
Run verification checks before completion using lint/test, security scanning, and optional bundle plus tech debt analysis. Use at final gate steps and block completion when mandatory failures are detected.
567 - majiayu000 Bundle Analyzing Dotnet Assemblies
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567 - majiayu000 Bundle Analyzing Network Flow Data
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567 - majiayu000 Bundle Auditing Privacy Compliance
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567 - majiayu000 Bundle Code Security Audit
Perform security audits on code changes, diffs, or branches to find high-confidence exploitable vulnerabilities. Use when asked to "audit security", "review for vulnerabilities", "security scan", "check for security issues", "audit this PR", "review these changes for security", or "find vulnerabilities in diff". Distinct from security-review (which provides secure coding patterns/checklists) — this skill actively audits code changes using a structured methodology with false positive filtering. Includes Python scripts for GitHub Action CI integration and PR evaluation.
567 - majiayu000 Bundle Cyber Incident Response 72h
Sofortmassnahmen bei aktivem Cyber-Vorfall Ransomware Datenexfiltration oder Insider-Threat. Anwendungsfall Cyberangriff ist entdeckt und IT-rechtliche Meldepflichten sowie Beweissicherung muessen binnen Stunden eingeleitet werden. Normen Art. 33 DSGVO 72-Stunden-Meldung Datenpanne Art. 34 DSGVO Betroffeneninformation NIS2UmsuCG § 32 BSIG n.F. §§ 202a 303b StGB. Prüfraster Sofort-Eindaemmung Forensik-Sicherung DSGVO-Meldepflicht NIS-2-Fruehwarnung 24 Stunden Strafanzeige Cybersecurity-Versicherer Beweiskette. Output Sofortmassnahmen-Protokoll mit 72-Stunden-Plan Meldungsformulierung und Chain-of-Custody-Dokumentation. Abgrenzung zu fachanwalt-it-recht-cyber-vorfall-sofortmassnahmen und fachanwalt-it-recht-datenschutz-folgenabschaetzung.
567 - majiayu000 Bundle Executing Vishing Campaigns
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
567
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include hunting-subdomain-takeover, license-compliance-scanner, localsetup-keepass-secrets. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.