Security Agent Skills
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Security
1,976 skills
26bb lore
Markdown project memory for AI agents. Use for decisions, architecture, conventions, monorepo scopes, `.lore/`, or `lore` commands; not native `/init`/`/compact` or generic init/compress/audit/query.
0 · bundle
rulebase-co cx-control-testing
Use to test whether a support control actually operates, the way an auditor would test it, rather than confirming it exists on paper. Trigger for "test our controls", "does this control actually work", second-line assurance over support, control effectiveness testing, preparing for an internal audit, or a control that passed review and then failed in practice.
1
rulebase-co cx-dashboard-review
Use to audit a CX dashboard for tiles nobody acts on and metrics nobody agrees on — assign an owner per tile, apply kill criteria, and run an actionability test before adding or keeping a chart. Trigger for "clean up the dashboard", "too many metrics", "which KPIs should we keep", dashboard audit, metrics review workshop, "nobody looks at this anymore", or before a BI migration or exec-pack refresh.
1
rulebase-co cx-audit-trail-integrity
Use to verify that the chain from conversation to evaluation to decision is complete and reconstructible, so a QA score or a customer outcome can be explained months later. Trigger for "can we prove why this decision was made", "is our audit trail complete", "reconstruct how this score was produced", evidencing an AI-assisted decision, or an auditor asking how a conclusion was reached.
1
theheavenlyd3mon skills-audit
Systematic methodology for auditing the Hermes Skills Hub (and external sources) to identify gaps, overlaps, redundancies, and conflicts when building a skill library for any project. Covers browsing, targeted searching, cross-referencing with web/GitHub, comparing candidates against existing inventory, verifying install safety, and planning installation order. Use when starting a new project and assembling tools, or when evaluating whether to add external skills beyond what's currently installed.
28 · bundle
smith6jt-cop notebook-config-audit
Audit Jupyter notebooks for hardcoded values that contradict configuration cells. Trigger when: (1) notebook behavior differs from documented settings, (2) updating notebook version, (3) finding inconsistent values across cells.
3
michaelschecht openclaw-action
OpenClaw Action
0
brycewang-stanford fletcher
Defamiliarization audit for empirical output. Systematically interrogates every feature of a figure, table, or set of results — not just the main finding. Named for Jason Fletcher, who asked about the spike at t=1 when everyone else was looking at t=2. Use when you have output and are about to interpret or report it.
1k
brycewang-stanford aer-submission
Use when running the final pre-submission audit for an AER, AER:Insights, or AEJ manuscript — length, format, cover letter, per-author disclosure statements, file packaging, and routing among the AEA journal family. Apply immediately before clicking submit.
1k · bundle
sickn33 lore
Markdown project memory for AI agents. Use for decisions, architecture, conventions, monorepo scopes, `.lore/`, or `lore` commands; not native `/init`/`/compact` or generic init/compress/audit/query.
45.1k · bundle
adobe workflow-orchestrator
Orchestrates end-to-end lifecycle workflows for the Adobe Dispatcher Apache HTTP Server module in AEM 6.5 LTS, from design and implementation through validation, release readiness, and incident troubleshooting.
142 · bundle
adobe unbounded-query
Detects and triages explicitly-unbounded AEM queries (p.limit=-1 or setLimit(-1)) that cause OOMs, safely capping only where provably safe and escalating others for human pagination.
142 · bundle
openclaw clawhub-moderation
Moderate ClawHub platform resources including skills, users, org publishers, plugin packages, and staff email using the repo-local admin CLI tool.
9.1k
openclaw convex-performance-audit
Audits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification.
9.1k · bundle
huggingface hf-cloud-sagemaker-iam-preflight
Discovers, validates, or creates a SageMaker execution role before deploying or training, preventing IAM-related deployment failures.
10.8k · bundle
antigravity network-101
Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments, enabling hands-on practice with service enumeration, log analysis, and security testing.
42.4k
zhaoxuya520 reverse-skill-router
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
12.8k · bundle
zhaoxuya520 radio-sdr
Guides authorized RF/SDR security research for signal identification, demodulation analysis, and replay feasibility studies in shielded lab environments.
12.8k · bundle
zhaoxuya520 binary-diff
Migrates symbols and reverse-engineering results from an older binary version to a newer one using LLM-based structured diffing of disassembly and pseudocode, enabling rapid offset and function-name mapping when PDBs are missing.
12.8k · bundle
zhaoxuya520 thick-client
Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.
12.8k · bundle
zhaoxuya520 docs-generator
Generates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and security reports after reverse engineering, penetration testing, or CTF tasks.
12.8k · bundle
zhaoxuya520 threat-hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
zhaoxuya520 database-security
Performs authorized database security assessments across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis, checking exposure, authentication, authorization, dangerous configurations, and exploit paths.
12.8k · bundle
zhaoxuya520 patch-diff-exploit
Analyzes vendor security patches via binary diffing to reverse-engineer vulnerabilities, write proof-of-concept exploits, and weaponize N-day exploits against unpatched systems.
12.8k · bundle
zhaoxuya520 browser-extension-reverse
Guides authorized reverse engineering of Chrome and Firefox browser extensions, covering manifest analysis, background workers, and credential or traffic logic recovery.
12.8k · bundle
zhaoxuya520 competition-stego-media
Inspects metadata, hidden channels, and appended payloads in media files to recover concealed data in steganography challenges.
12.8k · bundle
zhaoxuya520 competition-mailbox-abuse
Trace mailbox abuse chains including OAuth consent, forwarding rules, delegate access, and message rerouting in a CTF sandbox environment.
12.8k · bundle
zhaoxuya520 competition-firmware-layout
Analyze the structure, boot chain, and update mechanism of a firmware image, then trace the shortest path to the decisive artifact or secret.
12.8k · bundle
petar-nauka fact-check
Verifies claims, articles, screenshots, and URLs through source-grounded analysis with an evidence ledger, source credibility evaluation, and manipulation detection. Supports quick checks, full fact-check cards, two-source comparisons, and prebunking in multiple languages and policy contexts.
74 · bundle
systemtce 04-security
Guides securing and deploying the Dify platform in production, covering SSRF protection, code sandboxing, Docker/Kubernetes deployment, monitoring, and recovery.
34 · bundle
agentskillexchange snyk-agent-scan
Scans AI agents, MCP servers, and skills for security vulnerabilities from the command line, detecting prompt injections, tool poisoning, toxic flows, malware payloads, and credential handling issues across 15+ risk categories.
28
agentskillexchange owasp-zap-scanner
Runs OWASP ZAP security scans against web applications using Java or Docker, with setup guidance and links to upstream documentation.
28
agentskillexchange checkov-iac-scanner
Scans infrastructure-as-code files for security and compliance misconfigurations using Checkov, with support for Terraform, Kubernetes, and other formats.
28
agentskillexchange csp-policy-analyzer
Parses and evaluates Content Security Policy headers using csp-parse and csp-evaluator libraries. Identifies overly permissive directives, missing protections, and generates tightened policy recommendations.
28
agentskillexchange circleci-orb-auditor
Audits CircleCI orb versions and configurations using the CircleCI v2 API, flags deprecated orbs, provides pinning recommendations, and checks security advisories from the orb registry.
28
tinh2 gdpr
Audits codebases for GDPR and CCPA/CPRA compliance by inventorying PII fields, mapping data collection points, reviewing consent mechanisms, verifying data subject rights, tracing third-party data sharing, and checking retention policies.
13
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include radio-sdr, docs-generator, database-security. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.