Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
jmagly-ai-writing-guide Skill Forensics HuntThreat hunt using Sigma rules against log sources
-
autohandai-community-skills Bundle Performing HTTP Parameter Pollution AttackExecute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.
- jmagly-ai-writing-guide Skill Induction Audit
Audit research-corpus induction quality — depth bands (stub/compact/good/full/deep), structural integrity (analysis doc + sidecar + PDF, honoring audit-exclude conventions), and per-source-type required sections (a blog isn't flagged for missing Benchmark Results). Plus additive frontmatter backfill for legacy docs. Runs via `aiwg corpus induction-audit` / `aiwg corpus frontmatter-backfill`.
- jmagly-ai-writing-guide Skill Security Assessment
Execute STRIDE threat modeling, vulnerability scanning, and security control validation with risk scoring
-
sboghossian-mini-claude-for-legal Skill Safety Client Confidentiality Cross TenantUse when verifying or explaining the cross-tenant data isolation guarantees that prevent one law-firm tenant's client data, documents, embeddings, and learned patterns from leaking to any other tenant. Covers the architectural implementation (storage-layer partitioning, row-level security, query enforcement), the operational rule for queries that reference other tenants, and the audit trail for cross-tenant administrative operations. Core to demonstrating GDPR/PDPL compliance and bar-rules confidentiality in multi-tenant legal AI deployments.
- autohandai-community-skills Bundle Testing For JSON Web Token Vulnerabilities
Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
- autohandai-community-skills Bundle Analyzing Ransomware Leak Site Intelligence
Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.
- autohandai-community-skills Bundle Detecting Container Escape With Falco Rules
Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.
- autohandai-community-skills Bundle Implementing Anti Phishing Training Program
Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv
- autohandai-community-skills Bundle Implementing API Schema Validation Security
Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
-
techwavedev Skill Django Perf ReviewDjango performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.
- autohandai-community-skills Bundle Performing Authenticated Vulnerability Scan
Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett
- autohandai-community-skills Bundle Performing False Positive Reduction In Siem
Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
- autohandai-community-skills Bundle Performing Ssl Tls Inspection Configuration
Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.
- autohandai-community-skills Bundle Conducting Internal Network Penetration Test
Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.
- autohandai-community-skills Bundle Exploiting Prototype Pollution In Javascript
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
- autohandai-community-skills Bundle Implementing API Security Posture Management
Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle.
- autohandai-community-skills Bundle Implementing Digital Signatures With Ed25519
Ed25519 is a high-performance digital signature algorithm using the Edwards curve Curve25519. It provides 128-bit security with 64-byte signatures and 32-byte keys, offering significant advantages ove
- autohandai-community-skills Bundle Implementing Memory Protection With Dep Aslr
Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
- autohandai-community-skills Bundle Performing Active Directory Penetration Test
Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
- autohandai-community-skills Bundle Performing Soap Web Service Security Testing
Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.
- autohandai-community-skills Bundle Performing Wireless Network Penetration Test
Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.
- autohandai-community-skills Bundle Analyzing Office365 Audit Logs For Compromise
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
- autohandai-community-skills Bundle Analyzing Threat Actor Ttps With Mitre Attack
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh
- sboghossian-mini-claude-for-legal Skill Template Vendor Security Questionnaire Responses
Use when completing enterprise vendor security questionnaires for law-firm or in-house procurement of Louis. Provides pre-approved standard responses to common security, compliance, and data-governance questions — SOC 2, ISO 27001, GDPR, penetration testing, tenant isolation, encryption, audit logs, data export, and residency. Reduces sales-cycle friction for enterprise deals.
- techwavedev Skill GRAPHQL Architect
Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems.
- autohandai-community-skills Bundle Building Threat Intelligence Feed Integration
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
- autohandai-community-skills Bundle Configuring Tls 1 3 For Secure Communications
TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-R
- jmagly-ai-writing-guide Bundle Best Practices Audit
Research-grounded validation of a target (file, directory, or topic) against external best practices and vendor docs. Produces a cited, evidence-grounded comparison.
- techwavedev Skill Differential Review
Security-focused code review for PRs, commits, and diffs.
- techwavedev Skill Gha Security Review
Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.
- autohandai-community-skills Bundle Performing Cryptographic Audit Of Application
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
- autohandai-community-skills Bundle Performing Ip Reputation Analysis With Shodan
Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.
- autohandai-community-skills Bundle Conducting Social Engineering Penetration Test
Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
- jmagly-ai-writing-guide Skill Test Conformance
Audit a codebase's testing regime using a reusable protocol, source/runner reconciliation, sampled oracle review and evidence-backed conformance reports.
- jmagly-ai-writing-guide Skill Research Quality Audit
Audit a research corpus for shallow stubs, missing sources, and doc-depth issues. Detects docs written from abstracts rather than full papers; can dispatch expansion agents.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include forensics-hunt, performing-http-parameter-pollution-attack, security-assessment. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.