Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle JWT Misuse Anti PatternSecurity anti-pattern for JWT misuse vulnerabilities (CWE-287). Use when generating or reviewing code that creates, validates, or uses JSON Web Tokens. Detects 'none' algorithm attacks, weak secrets, sensitive data in payloads, and missing expiration. Use when this capability is needed.
- tomevault-io Bundle Mit Licensing
Audit dependency licenses for MIT compatibility. Use when the user wants to check if their project's dependencies are compatible with MIT license, find problematic licenses (GPL, AGPL, etc.), or generate a license audit report. Supports Node.js (npm/pnpm) and Rust (Cargo) projects. Use when this capability is needed.
- tomevault-io Bundle Rust Security Audit
Audits Rust code for memory-unsafety and security vulnerabilities the generic security audit cannot see — `unsafe` soundness/UB, Send/Sync errors, FFI, supply chain (RUSTSEC/cargo-audit/deny), deserialization DoS, and crypto/secret misuse. Use when reviewing Rust changes that touch `unsafe`, FFI, crypto, deserialization, or dependencies. For runtime bugs use `agentwright:rust-correctness-audit`; for idioms/API design use `agentwright:rust-best-practices-audit`. Use when this capability is needed.
- tomevault-io Bundle Rust Async Audit
Audit async Rust / tokio code for blocking calls, lock-across-await, cancellation safety, runtime mixing, and concurrency anti-patterns. Use when reviewing tokio code, troubleshooting async performance issues, or auditing a tokio-based binary/service. Do NOT use for general Rust review (use rust-review) or error refactors (use rust-error-design). Use when this capability is needed.
- tomevault-io Bundle Code Review Github
Use when performing code review for GitHub pull requests. Analyzes code changes, identifies critical and moderate issues, runs tests, and posts review comments. Reviews code quality, security, and adherence to project standards.
- tomevault-io Bundle Resolve Jira Issue
Use when resolving JIRA issues. Fixes bugs, refactors code, performs code and security reviews, ensures 100% test coverage, runs CI checks, and creates pull requests. Links PRs to JIRA issues and updates issue status.
- tomevault-io Bundle Audit Expert
Expert-level security auditing, compliance, code review, and vulnerability assessment Use when this capability is needed.
- tomevault-io Bundle Social Engineering Audit
Assess social engineering attack surface in applications and organizations. Identifies pretexting vectors, OSINT exposure, phishing susceptibility in authentication flows, and human-factor vulnerabilities in security architecture. Use when auditing auth flows, help desk procedures, password reset mechanisms, or organizational security posture. Use when this capability is needed.
- tomevault-io Bundle Static Security Analyzer
Wrapper around Tizen Studio static analyzer. Detects memory leaks, buffer overflows, and coding vulnerabilities in C/C++/JavaScript. Use when this capability is needed.
- tomevault-io Bundle Discover Cryptography
Automatically discover cryptography skills when working with encryption, TLS, certificates, PKI, and security Use when this capability is needed.
- tomevault-io Bundle Django Development
Comprehensive guide for building Django web applications following Django 5.2 standards and industry best practices. Use when developing Django projects, implementing models/views/templates, configuring settings, handling forms, ensuring security, or deploying Django applications. Use when this capability is needed.
- tomevault-io Bundle Audit Report Daily
基于 .claude/runs/ 目录的审计数据自动生成工作日报。日报每个数字都可追溯到审计记录。当用户说"生成日报"、"今天做了什么"、"写报告"、"总结一下今天的工作"，或通过 cron 每日 08:03 自动触发时使用。 Use when this capability is needed.
- tomevault-io Bundle Review Project
Analyze project health including structural issues, security vulnerabilities, performance concerns, and code stability metrics. Use when auditing codebases, reviewing project quality, checking for security issues, identifying architectural problems, measuring code health, or generating quality reports. Use when this capability is needed.
- tomevault-io Bundle Xss Prevention
XSS attack prevention with input sanitization, output encoding, Content Security Policy. Use for user-generated content, rich text editors, web application security, or encountering stored XSS, reflected XSS, DOM manipulation, script injection errors. Use when this capability is needed.
Audited - tomevault-io Bundle Sheshiyer Skill Clusters Django Security
Django Security Best Practices
- tomevault-io Bundle Backend Security
Configure Spring Security 6.x with JWT authentication for Spring Boot 3.4.x. Use this when asked to set up authentication, JWT tokens, login/register endpoints, or secure API endpoints. Use when this capability is needed.
- tomevault-io Bundle Stefan Stepzero Shipkit Shipkit UX Audit
shipkit-ux-audit - Lightweight UX Guidance
- tomevault-io Bundle Takemi Ohama AI Plugins QA Security Scan
QA Security Scan Skill
- tomevault-io Bundle Tech Debt Analyzer
This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation. Use when this capability is needed.
- tomevault-io Bundle Dev Goraebap Grimoire Audit Public Rules
audit-public-rules
- tomevault-io Bundle Compliance Review
Use when reviewing proposed features and data flows against GDPR, CCPA, HIPAA, and other privacy regulations. Covers regulatory applicability, PII data flow mapping, consent mechanism assessment, retention policies, and right-to-deletion compliance. Do not use for data sensitivity tiering (use data-classification) or audit logging design (use audit-trail-design).
- tomevault-io Bundle Navigation Design
Use when designing navigation architecture for mobile or cross-platform features including screen hierarchy, deep linking schemes, and state preservation strategies. Covers stack navigation, modal flows, universal links, and process death recovery. Do not use for platform guideline compliance (use platform-audit) or hardware API integration (use device-integration).
- tomevault-io Bundle Github Visibility
Toggle GitHub repo between private and public with security hardening, contribution lockdown, and pre-flight safety checks. Use when this capability is needed.
- tomevault-io Bundle Florianbuetow Claude Code Business Logic
Business Logic Security (BIZ)
- tomevault-io Bundle Kata Audit Milestone
Verify milestone achievement against its definition of done, checking requirements coverage, cross-phase integration, and end-to-end flows. Triggers include "audit milestone", "verify milestone", "check milestone", and "milestone audit". This skill reads existing phase verification files, aggregates technical debt and gaps, and spawns an integration checker for cross-phase wiring. Use when this capability is needed.
- tomevault-io Bundle Sinatra Security
Security best practices for Sinatra applications including input validation, CSRF protection, and authentication patterns. Use when hardening applications or conducting security reviews. Use when this capability is needed.
- tomevault-io Bundle Anti Cheat Systems
Guide for modern game anti-cheat architecture, Windows kernel monitoring, and detection tradeoffs. Use this skill when analyzing EAC, BattlEye, Vanguard, FACEIT AC, kernel callbacks, handle protection, manual-map detection, boot-start drivers, BYOVD, DMA threats, or behavioral telemetry in game security research. Use when this capability is needed.
- tomevault-io Bundle Dma Attack Techniques
Guide for PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security. Use this skill when researching pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation in game security research. Use when this capability is needed.
- tomevault-io Bundle Security Auditor
Audits code for security vulnerabilities including OWASP Top 10 and authentication issues. Use when this capability is needed.
- tomevault-io Bundle Clarification Phase
Executes the /clarify phase using AskUserQuestion tool to resolve ambiguities through structured questions (≤3), prioritization, and answer integration. Use when spec.md contains [NEEDS CLARIFICATION] markers, when requirements need disambiguation, or when running /clarify command to resolve critical scope/security/UX ambiguities before planning. (project) Use when this capability is needed.
- tomevault-io Bundle Iso 42001 AI Governance
AI governance readiness and gap assessment using ISO/IEC 42001:2023. Evaluate AI management-system practices for risk management, accountability, transparency, security, and continuous improvement. Use when this capability is needed.
- tomevault-io Bundle Rust Quality Checker
Validate Rust code quality with rustfmt, clippy, cargo check, and security Use when this capability is needed.
- tomevault-io Bundle Security Engineering
Application security and infrastructure security expert. Use when reviewing code for vulnerabilities, implementing authentication/authorization, securing APIs, hardening infrastructure, threat modeling, implementing encryption, or conducting security audits. Covers OWASP Top 10, secure coding, DevSecOps, and compliance. Use when this capability is needed.
- tomevault-io Bundle Python Project
Scaffold and harden Python projects using reusable defaults (pyproject/setuptools-scm, src layout, Ruff, pytest, Typer, Pydantic) plus best practices for CLI tools, systemd services, APIs/UI apps, IaC/automation, security/networking, and AI/ML workflows. Use when this capability is needed.
- tomevault-io Bundle Plan Auditor
Expertise in validating that the codebase matches a specific plan. Use when the user asks to "validate the plan", "check implementation", or "audit the code". Use when this capability is needed.
- tomevault-io Bundle Hashing Passwords
CRITICAL security skill teaching proper credential and password handling. NEVER store passwords, use bcrypt/argon2, NEVER accept third-party credentials. Use when handling authentication, passwords, API keys, or any sensitive credentials. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include jwt-misuse-anti-pattern, mit-licensing, rust-security-audit. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.