Security Agent Skills
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Security
1,976 skills
nivkazdan key-rotation-manager
Manage key rotation manager operations. Auto-activating skill for Security Advanced. Triggers on: key rotation manager, key rotation manager Part of the Security Advanced skill category. Use when working with key rotation manager functionality. Trigger with phrases like "key rotation manager", "key manager", "key".
4
om-scogo oauth
Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.
0 · bundle
mukul975-2 gdpr-ropa-audit
Guides the audit of Records of Processing Activities (RoPA) against GDPR Article 30 requirements for both controllers and processors. Activate when verifying RoPA completeness, validating mandatory fields, or preparing for supervisory authority inspections. Keywords: RoPA, Article 30, records audit, processing activities, controller records, processor records.
228 · bundle
mukul975-2 telehealth-privacy
Implements telehealth privacy compliance covering HIPAA requirements for virtual care, state licensing and recording consent laws, platform security with BAA requirements for telehealth vendors, cross-state prescribing rules, and OCR enforcement discretion during public health emergencies. Keywords: telehealth privacy, virtual care, HIPAA, recording consent, platform BAA, cross-state licensing, OCR enforcement.
228 · bundle
mukul975-2 hipaa-risk-analysis
Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.
228 · bundle
mukul975-2 breach-documentation
Maintains the GDPR Article 33(5) breach register documenting all personal data breaches regardless of whether supervisory authority notification was required. Covers mandatory register fields including facts, effects, and remedial actions, retention periods, audit readiness, and integration with the accountability framework. Keywords: breach register, Article 33(5), breach documentation, accountability, audit readiness, remedial actions.
228 · bundle
netanel-abergel chat-history
Search past WhatsApp/chat conversations stored in the audit log PostgreSQL database. Use when the user asks about past conversations, what was discussed, what someone said, finding a specific message, or referencing previous discussions. Also use to reply to or quote specific past messages.
6
ranbot-ai 7
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
6
whd4 idor-vulnerability-testing
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
0
whd4 red-team-tools-and-methodology
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.
0
danstrem2 wed
Security awareness demo - demonstrates supply chain risks in AI coding assistants. See the full research: https://x.com/theonejvo/status/2015892980851474595
2 · bundle
onourimpram bilingual-booklet-pairing
Use when paired tr.md and en.md files need a parity verdict, when titles, frontmatter, headings, or DOI sets may have drifted between languages, or when a bilingual document is approaching release and its translation coverage needs an audit.
2
b4san code-review
Review generated code for style, security, and architecture issues; suggest refactorings and performance improvements. Use after implementation is complete, before merging changes, or when refactoring existing code. Follows OWASP guidelines, SOLID principles, and best practices for maintainable code.
2
welitonevoc 007
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
1 · bundle
a5c-ai jwt
JWT implementation, token management, refresh patterns, and security.
1.7k · bundle
fradser reflect-skills-from-memory
This skill should be used when the user asks to "reflect on skills from memory", "audit marketplace skills against memory", "从记忆中检查 skills 的问题", "反思并修改 skill", "apply memory feedback to skills", or wants to turn accumulated memory feedback about this marketplace's skills into concrete skill fixes. Reads the project's persistent memory, re-verifies each known skill problem against current code, then fixes the skill or corrects the stale memory.
580
fradser writing-beats
Exploit-phase writing — assembles raw material into a journey of beats, grounding each term before a beat leans on it. Use when the user has raw material and wants it turned into an article.
580 · bundle
diegojcn varlock
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables",...
1
kk20300113-png design-review
Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)
0
jarbitechture fabric
Intelligent pattern selection for Fabric CLI. Automatically selects the right pattern from 242+ specialized prompts based on your intent - threat modeling, analysis, summarization, content creation, extraction, and more. USE WHEN processing content, analyzing data, creating summaries, threat modeling, or transforming text.
0 · bundle
snoodleboot-io minimal
API Security (Minimal)
2
srednoff888-art production-review
Use this skill before merging, deploying, or shipping changes. It reviews code for bugs, security, auth, data loss, migrations, observability, performance, and rollback risks.
1 · bundle
srednoff888-art secrets-env-rotation
Use this skill for secret inventory, env vars, rotation plans, safe dev/prod separation, leak response. Trigger when the task involves security work related to Secrets Env Rotation, implementation, audits, debugging, strategy, or validation.
1 · bundle
srednoff888-art supply-chain-sbom-sca
Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.
1 · bundle
javiarmesto skill-diagnostics
Perform a static audit of an AL workspace for Business Central against the project's copilot-instructions.md contract. Reports findings by class (Compliance, Code quality, Test coverage, Permissions) and severity (Blocker, Major, Minor, Nit) with file:line citations. Never modifies code. Never invents rules. Use when asked to audit a workspace, run a compliance check, review before PR, or diagnose contract drift.
0 · bundle
javiarmesto skill-permissions
AL permission set design for Business Central. Use when creating PermissionSets, implementing least-privilege access, or designing security models for extensions.
0
thatrebeccarae google-ads
Google Ads platform expertise. Audit campaigns, keywords, audiences, bidding, and conversion tracking. Use when the user asks about Google Ads, PPC, search advertising, Performance Max, Shopping ads, display campaigns, YouTube ads, or paid search optimization.
105 · bundle
thatrebeccarae facebook-ads
Meta Ads (Facebook & Instagram) platform expertise. Audit campaigns, audiences, creative strategy, pixel tracking, and CAPI. Use when the user asks about Facebook Ads, Instagram Ads, Meta Ads, social media advertising, Advantage+ campaigns, or Meta pixel/CAPI setup.
105 · bundle
keyargo jwt-decode
Decode and inspect a JWT (header, claims, expiry) without verifying signature
118 · bundle
keyargo secrets-scan
Scan text or a file for accidentally committed secrets (API keys, tokens)
118 · bundle
kensaurus audit-i18n
Audit and fix internationalisation for any web or mobile app. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".
8
kensaurus plan-backup-dr
Audit whether a project can actually recover from data loss — not just whether backups exist — then emit a phased DR plan. Use when "can we recover if the DB dies", "audit our backups", "what's our RPO/RTO", or "disaster recovery". Plan only. Destructive-op gates stay on plan-data-integrity.
8
kensaurus audit-realworld
Audit a full-stack app against the RealWorld ("Conduit") reference — its formal API spec, shared Bruno/Hurl E2E suite, and closest-stack reference implementation — to find what is. Use when "audit against realworld", "compare my app to realworld", "conduit conformance", "is my full-stack app complete", "full-stack gap.
8
kensaurus audit-gate-logic
Read-only audit of CI gate logic — silent bypass, ratchet gaming, conflicting conditions, required checks that are not, and accreted duplicate gates. Use when "can CI be bypassed", "why did a regression pass CI", "we have too many overlapping checks". Cost/speed → audit-cicd. Consolidation → housekeep-gates.
8
kensaurus audit-ux-journeys
Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) skips. Use when "audit user flows", "IA audit", "can users find X", "navigation audit", or "funnel drop-off". Full DS burndown → plan-uiux-unification.
8 · bundle
kensaurus plan-secrets-audit
Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".
8
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include oauth, gdpr-ropa-audit, telehealth-privacy. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.