Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
autohandai-community-skills Bundle Performing Web Application Vulnerability TriageTriage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation.
- autohandai-community-skills Bundle Analyzing Threat Actor Ttps With Mitre Navigator
Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
- autohandai-community-skills Bundle Building Attack Pattern Library From Cti Reports
Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering and threat-informed defense.
-
jmagly-ai-writing-guide Skill Auth Factor DesignDecision aid for authentication factor architecture — have/know/are mapping, coercion resistance, FIDO2 PIN/UV policy, and PRF hot-path anti-patterns.
- jmagly-ai-writing-guide Skill Deprecation Policy
Compare API/ABI surfaces between refs, flag incompatible changes, and generate deprecation/changelog notes for library projects
- jmagly-ai-writing-guide Skill Supply Chain Trust
Decision aid for supply-chain trust beyond CVE/SBOM — pinning depth, reproducible builds, snapshot pins, firmware locking, and vendor+hash-lock for critical-path deps.
- jmagly-ai-writing-guide Skill Committer 2fa Audit
Audit source-control organization settings for strong 2FA/MFA requirements across all committers
- jmagly-ai-writing-guide Skill Bun Release Age Gate
Configure Bun's install.minimumReleaseAge gate (7-day default, 10-day high-sensitivity) for JavaScript projects on Bun. Includes Corepack-equivalent version detection and lockfile-caveat warning.
- jmagly-ai-writing-guide Skill Degraded Mode Design
Decision-aid skill for fail-closed vs fail-open behavior. Forces a degraded-mode matrix and rejects "type Y to override" prompts in favor of multi-step ceremonies
- jmagly-ai-writing-guide Skill NPM Release Age Gate
Configure and review npm min-release-age controls for JavaScript projects, including 7-day default gates, 10-day high-sensitivity profiles, npm version requirements, and safe override handling.
- jmagly-ai-writing-guide Skill Chain Of Trust Design
Decision aid for bootstrap and verification chains — forces the 'what authenticates the authenticator' question; patterns for signed bootstrap, measured boot, recovery.
- jmagly-ai-writing-guide Skill Pnpm Release Age Gate
Configure pnpm's minimumReleaseAge gate (7-day default, 10-day high-sensitivity) plus blockExoticSubdeps for workspace-scope dep-source enforcement. Includes Corepack detection and lockfile-caveat warning.
- jmagly-ai-writing-guide Skill Yarn Release Age Gate
Configure Yarn's npmMinimalAgeGate (7-day default, 10-day high-sensitivity) for JavaScript projects on Yarn 4.x or later. Includes Corepack detection and lockfile-caveat warning.
- jmagly-ai-writing-guide Skill NPM Supply Chain Audit
Audit npm projects for Shai-Hulud-class supply-chain exposure: lifecycle scripts, Git dependency prepare hooks, release-age gaps, publish-token exposure, trusted publishing, signed releases, and verifier docs.
- jmagly-ai-writing-guide Skill Strict Toolchain Audit
Check build and CI configuration for warning-as-error, strict typechecking, and language-specific compiler/linter floors
- jmagly-ai-writing-guide Skill Secret Handling Runtime
Decision aid for runtime secret hygiene — fd passing, scratch surface, error-path safety, identifier hygiene, and avoiding the SECRETS_ENV aggregation anti-pattern.
- jmagly-ai-writing-guide Skill Cargo Supply Chain Audit
Audit Rust/Cargo crates for supply-chain exposure: crates.io metadata + checksum verification against Cargo.lock, .crate tarball hash and .cargo_vcs_info.json provenance, previous-vs-patched .crate source diff, Cargo.toml dependency + build-script review, cargo audit / cargo deny / cargo vet trust policy, and publisher / trusted-publishing / yank / release-anomaly checks.
-
techwavedev Skill Semgrep Rule CreatorCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
- techwavedev Skill Web Security Testing
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
- autohandai-community-skills Bundle Exploiting Zerologon Vulnerability Cve 2020 1472
Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
- jmagly-ai-writing-guide Skill Confusable Unicode Audit
Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata
- jmagly-ai-writing-guide Skill Physical Threat Modeling
Threat library for physical-access threats STRIDE and OWASP Top 10 miss — evil-maid, DMA, hostile peripheral, travel-host, coercion, cold-boot, side-channel.
- jmagly-ai-writing-guide Skill Pr Reviewer
Review GitHub pull requests for code quality, security, and best practices. Use for automated PR feedback and approval workflows.
- jmagly-ai-writing-guide Bundle Security Disclosure Track
Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure
- jmagly-ai-writing-guide Skill Crypto Primitive Selection
Decision aid for choosing AEAD, KDF, MAC, and signature primitives — flags anti-patterns (CBC-without-MAC, ad-hoc KDF, key reuse, PBKDF2-on-high-entropy).
- jmagly-ai-writing-guide Skill Security Engineering Quickref
AUTO-INVOKE when user mentions cryptography, AEAD, KDF, chain of trust, signing key, auth factor, MFA, secret hygiene, supply chain trust, physical threat, DFIR readiness, or incident evidence handoff. Security-engineering quick reference — decision domains for crypto primitives, chain-of-trust, auth factors, degraded modes, supply-chain trust, physical-threat modeling, and DFIR readiness routing.
- jmagly-ai-writing-guide Skill Supply Chain Hardening Quickstart
Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.
- techwavedev Skill Pentest Checklist
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "foll...
- techwavedev Bundle Privacy By Design
Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption.
- techwavedev Bundle Solidity Security
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementin...
- autohandai-community-skills Bundle Executing Red Team Exercise
Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.
- autohandai-community-skills Bundle Performing Threat Emulation With Atomic Red Team
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
- autohandai-community-skills Bundle Performing Threat Intelligence Sharing With Misp
Use PyMISP to create, enrich, and share threat intelligence events on a MISP platform, including IOC management, feed integration, STIX export, and community sharing workflows.
- autohandai-community-skills Bundle Building Adversary Infrastructure Tracking System
Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.
- autohandai-community-skills Bundle Building Threat Intelligence Enrichment In Splunk
Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
- techwavedev Skill Red Team Tactics
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include performing-web-application-vulnerability-triage, analyzing-threat-actor-ttps-with-mitre-navigator, auth-factor-design. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.