Security Agent Skills

Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.

Security

1,976 skills

github

codeql

Configure and run CodeQL code scanning through GitHub Actions workflows or the standalone CLI for security analysis.

36.2k · bundle

github

dependabot

Configure and manage GitHub Dependabot for automated dependency updates, security alerts, and vulnerability scanning across multiple ecosystems.

36.2k · bundle

github

gdpr-compliant

Apply GDPR-compliant engineering practices across your codebase, covering API design, data models, authentication, logging, retention, and cloud infrastructure.

36.2k · bundle

github

resemble-detect

Detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using the Resemble AI platform.

36.2k · bundle

github

security-review

Scans codebases for security vulnerabilities by reasoning about code context, data flow, and component interactions, covering injection flaws, secrets exposure, authentication issues, and weak cryptography across multiple languages.

36.2k · bundle

github

sql-code-review

Performs comprehensive SQL code review across all major databases, analyzing security, performance, maintainability, and anti-patterns.

36.2k

github

agent-governance

Add governance, safety, and trust controls to AI agent systems with policy enforcement, intent classification, and audit trails.

36.2k

github

threat-model-analyst

Performs STRIDE-A threat model analysis of repositories and systems, producing architecture overviews, DFD diagrams, prioritized findings, and executive assessments. Supports both single analysis and incremental updates with change tracking.

36.2k · bundle

github

cloud-design-patterns

Provides 42 technology-agnostic cloud design patterns for distributed systems, covering reliability, performance, messaging, security, and deployment to help architects design robust workloads.

36.2k · bundle

github

postgresql-code-review

Review PostgreSQL code for best practices, anti-patterns, and quality standards including JSONB, arrays, custom types, schema design, functions, and security features like Row Level Security.

36.2k

github

apple-appstore-reviewer

Audits iOS app source code and metadata to identify App Store rejection risks and optimization opportunities, producing a structured compliance report.

36.2k

github

data-breach-blast-radius

Quantifies the business and regulatory impact of a potential data breach by inventorying sensitive data, tracing data flows, scoring exposure vectors, and estimating regulatory fines using law-sourced figures.

36.2k · bundle

github

github-actions-hardening

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

36.2k · bundle

github

github-actions-efficiency

Audit GitHub Actions workflow efficiency and recommend fixes to reduce CI minutes and costs.

36.2k · bundle

github

aws-well-architected-review

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

36.2k

github

aws-resource-health-diagnose

Analyze AWS resource health, diagnose issues from CloudWatch logs and metrics, and create a remediation plan for identified problems.

36.2k

github

github-codespaces-efficiency

Audit and improve GitHub Codespaces efficiency by analyzing devcontainer configurations, machine sizing, prebuild strategy, and idle timeout settings.

36.2k · bundle

github

ai-prompt-engineering-safety-review

Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness, providing detailed improvement recommendations with frameworks, testing methodologies, and educational content.

36.2k

github

azure-smart-city-iot-solution-builder

Design and plan end-to-end Azure IoT and Smart City solutions: requirements, architecture, security, operations, cost, and a phased delivery plan with concrete implementation artifacts.

36.2k · bundle

trailofbits

c-review

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

6k · bundle

trailofbits

trailmark

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

6k · bundle

trailofbits

codeql

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with support for multiple languages, scan modes, and data extension models.

6k · bundle

trailofbits

vector-forge

Uses mutation testing to systematically identify gaps in test vector coverage for cryptographic algorithms, then generates new test vectors that close those gaps. Measures effectiveness by comparing mutation kill rates before and after.

6k · bundle

trailofbits

rust-review

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

trailofbits

sharp-edges

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes in API designs, configuration schemas, and cryptographic library ergonomics.

6k · bundle

trailofbits

semgrep

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

6k · bundle

trailofbits

zeroize-audit

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

6k · bundle

trailofbits

sarif-parsing

Parse, analyze, and process SARIF files from static analysis tools like CodeQL and Semgrep, including filtering, deduplication, aggregation, and CI/CD integration.

6k · bundle

trailofbits

aflpp

Fuzz C/C++ projects with multi-core support using AFL++, a fork of AFL with better performance and advanced features.

6k · bundle

trailofbits

mermaid-to-proverif

Translates Mermaid sequence diagrams of cryptographic protocols into ProVerif formal verification models (.pv files) for proving security properties like secrecy, authentication, and forward secrecy.

6k · bundle

trailofbits

libafl

Build custom fuzzers with a modular Rust library, supporting advanced mutation strategies, custom feedback mechanisms, and non-standard target architectures.

6k · bundle

trailofbits

trailmark-structural

Runs full Trailmark structural analysis by building a graph and computing pre-analysis passes for hotspots, taint, blast radius, privilege boundaries, and attack surface.

6k · bundle

trailofbits

atheris

Fuzz Python code and C extensions with coverage guidance and AddressSanitizer support using a libFuzzer-based fuzzer.

6k · bundle

trailofbits

ossfuzz

Set up continuous fuzzing infrastructure for open-source projects using Google's OSS-Fuzz platform, including building and running fuzz harnesses locally and enrolling new projects.

6k · bundle

trailofbits

libfuzzer

Coverage-guided fuzzer built into LLVM for C/C++ projects. Use for fuzzing C/C++ code that can be compiled with Clang.

Frequently asked questions

What are Security agent skills?

Which Security skills are most installed?

Popular Security skills on SkillMD right now include security-review, gdpr-compliant, threat-model-analyst. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.

Do Security skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.