Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle FabricNative Fabric pattern execution for Claude Code. USE WHEN processing content with Fabric patterns (extract_wisdom, summarize, analyze_claims, threat modeling, etc.). Patterns run natively in Claude's context - no CLI spawning needed. Only use fabric CLI for YouTube transcripts (-y) or pattern updates (-U). Use when this capability is needed.
- tomevault-io Bundle Triaging Security Reports
Use when a vulnerability or security report arrives for triage, when assessing a CVE/RCE/OGNL/injection claim against the code, or when drafting a reply to a security researcher — to research the claim from source without trusting the reporter and without fabricating your own facts.
- tomevault-io Bundle Solidity Auditor
Security audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo) or a specific filename. Use when this capability is needed.
- tomevault-io Bundle AI
Expert-level parsing and remediation of `humble` HTTP security header reports. Use when this capability is needed.
- tomevault-io Bundle Appsec
Application security - OWASP, validation, secrets. Use when securing the app. Use when this capability is needed.
- tomevault-io Bundle Typescript Security
Secure coding practices for building safe TypeScript applications. Use when this capability is needed.
- tomevault-io Bundle Smart Contract Security Review
Security review for Scalus/Cardano smart contracts. Analyzes @Compile annotated validators for vulnerabilities like redirect attacks, inexact value validation, missing token verification, integer overflow, and self-dealing. Use when reviewing on-chain code, before deploying validators, or when /security-review is invoked. Requires explicit path argument. Use when this capability is needed.
- tomevault-io Bundle Security
This skill should be used when reviewing code for security vulnerabilities, performing security audits, or when the user asks about "security review", "vulnerability", "XSS", "CSRF", "injection", "race conditions", "OAuth security", "OIDC pitfalls", "timing attacks", or "access control". Provides a comprehensive vulnerability taxonomy and review methodology. Use when this capability is needed.
- tomevault-io Bundle Vbs Scan Security
Use when scanning code for security vulnerabilities. Use when user says "scan security", "kiểm tra bảo mật", "security audit", "review security", or invokes `/vbs-scan-security`. For large scans (>20 main-language files OR >30 total OR >14 days) processes chunks sequentially. Outputs bilingual reports (vi/en).
-
marketcalls Bundle ElectrobunBuild large-scale algo trading desktop apps with Electrobun. Use when creating desktop apps, trading platforms, broker integrations, market data UIs, WebSocket connections, authentication systems, or any Electrobun project. Covers architecture, security, performance, storage, RPC, and all Electrobun APIs.
-
mhaggis Skill Attack Navigator LayersCreates MITRE ATT&CK Navigator layers and analyzes coverage. Use when generating coverage layers, gap analysis, threat actor comparisons, or checking detection coverage against ATT&CK.
Audited -
microsoft-foundry Bundle Cookbook ReviewReview Microsoft Foundry Forgebook cookbook notebooks for quality, correctness, developer experience, and publication readiness. Use this whenever the user asks to review a notebook, judge a recipe, audit a cookbook entry, check registry.yaml metadata, assess whether a Foundry example is ready to publish, remove AI-sounding cookbook prose, or improve a tutorial/recipe before submission. Triggers on "review this notebook", "is this recipe good", "cookbook quality", "Forgebook review", "check my Foundry notebook", "ready to publish", "audit this recipe", and similar requests even when the user does not explicitly say "skill" or "rubric".
- tomevault-io Bundle Ktnyt Cclsp Cclsp
Security Review
- tomevault-io Bundle Validate Gsdk
Validates PlayFab Game Server SDK (GSDK) integrations in game server projects. Use when asked to check, validate, audit, or fix a GSDK implementation. Supports C++, C#, Java, Unity, and Unreal SDKs.
- tomevault-io Bundle Docs Writing
Conventions for writing and maintaining tako documentation pages under website/content/docs/. Page templates (transport / extractor / middleware / plugin / concept / tutorial / guide / reference), the frontmatter schema, meta.json sidebar wiring, RustExample-backed examples, and the audit-script contract. Invoke whenever a new public type ships and needs a docs page, or when fixing rot in an existing page. Use when this capability is needed.
- tomevault-io Bundle Security Audit
Run a full security audit across all focus areas in parallel, reporting findings to peersyst/security Use when this capability is needed.
- tomevault-io Bundle Aspectrr Deer Deer
Elasticsearch Security Troubleshooting
- tomevault-io Bundle Perseus API
Deep-dive API security analysis (REST, GraphQL, WebSocket, gRPC, OAuth, Cache) Use when this capability is needed.
- tomevault-io Bundle Debug Audit On Second Miss
Bug 修复 / 排查场景，连续 2 次假设或 patch 没命中根因时强制停手出 audit。Use when 同一 bug 已经试过 ≥2 次修复、症状仍在或换了形态再现、即将动「第 3 刀」时；触发关键词：「还是有这个问题」「又出现了」「同样的报错」「再试一次」「这次应该」。不适用于一次就 reproduce + 一次修好的场景。 Use when this capability is needed.
- tomevault-io Bundle Go Project Conventions
Project conventions with module caching, linting, security checks, and tests via Make Use when this capability is needed.
- tomevault-io Bundle Bidirectional Differential
Audit coherence across an arrow of intent by running two parallel fresh Claude sessions — one reconstructs code from a single EARS, the other reconstructs the EARS from stripped code — then classifies the drift between them. Use when the user invokes /differential-audit, asks to audit EARS-to-code drift for a feature or segment, wants a differential round-trip on a specific spec, or reaches Phase 6 code-complete in linked-intent-dev with arrow-maintenance overlay present and a touched-EARS set to consider. Surfaces intent that the code encodes but the EARS doesn't state, and requirements the EARS states but the code under-pins. Requires docs/arrows/ overlay. Heavy per-EARS cost in subprocess spawns and Anthropic API spend; scope via the opening conversation before running. Use when this capability is needed.
- tomevault-io Bundle Rust Security Checklist
Use before merging security-relevant Rust changes. Catches common local-service security regressions. Use when this capability is needed.
- tomevault-io Bundle Test
Run the TMI comprehensive test suite including unit tests, integration tests, API tests, and CATS security fuzzing. Use when asked to run tests, verify code changes, or check for regressions. Use when this capability is needed.
- tomevault-io Bundle Howells Arc Audit
<tool_restrictions>
- tomevault-io Bundle Django
Build secure Django apps avoiding ORM pitfalls, N+1 queries, and common security traps. Use when this capability is needed.
- tomevault-io Bundle Hahwul Dalfox Dalfox
Dalfox: XSS Scanning Skill
- tomevault-io Bundle Railway
Railway.com deployment and management - deployment, logs, migrations, troubleshooting, monorepo strategies, security, and CLI reference. Use when deploying to Railway, configuring services, managing environment variables, or debugging deployment issues. Use when this capability is needed.
- tomevault-io Bundle Remorses Kimaki Kimaki
You are a senior security engineer conducting a focused security review of the changes on this branch.
- tomevault-io Bundle Review Code
Perform a comprehensive multi-dimensional code review covering correctness, security (OWASP 2025), performance, and maintainability. Use when reviewing pull requests, staged changes, or specific files. Use when this capability is needed.
- tomevault-io Bundle Trivy
Run Aqua Trivy for comprehensive security scanning of containers, filesystems, git repos, and IaC. Use when scanning container images, detecting vulnerabilities, secrets, misconfigurations, or generating SBOMs. Use when this capability is needed.
- tomevault-io Bundle Komunite Tezgah Tezgah
SaaS API Security — Güvenlik ve Kalite Katmanı
- tomevault-io Bundle Intent Plan
Transform approved Intent into executable phased plan with strict TDD. Each step requires tests first (happy/bad/edge/security cases), then implementation. Use after /intent-review when ready to start development. Use when this capability is needed.
- tomevault-io Bundle Auxten Clickmem Clickmem
ClickMem — Memory Audit
- tomevault-io Bundle Patch Diff Analyzer
Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches. Use when this capability is needed.
- tomevault-io Bundle Audit Docs
Audit all documentation under docs/ against the actual codebase and fix any inaccuracies Use when this capability is needed.
- tomevault-io Bundle Gtasks CLI
Google OAuth2 client secret — can also be set in config file under [credentials] Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include fabric, triaging-security-reports, solidity-auditor. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.