Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle Security ReportPer-repo static security report (CC-05.7 path). Use when this capability is needed.
- tomevault-io Bundle Cqrs Event Sourcing
CQRS and Event Sourcing patterns for scalable, auditable systems with separated read/write models. Use when building audit-required systems, implementing temporal queries, or designing high-scale applications with complex domain logic. Use when this capability is needed.
- tomevault-io Bundle Phxreview
Review code with parallel agents — tests, security, Ecto, LiveView, Oban. Use after implementation to catch bugs and anti-patterns before committing. Use when this capability is needed.
- tomevault-io Bundle Omer Metin Skills For Antigravity Security
---
- tomevault-io Bundle Pr Reviews
Review code changes on a given GitHub PR using gh CLI. Use when the user asks to review a pull request, analyze PR diffs, or provide feedback on open PRs with structured quality, security, and testing assessments. Use when this capability is needed.
- tomevault-io Bundle Env Secrets Manager
Manages environment variables and secrets securely with encryption, rotation, and provider integration. Use when users request "secrets management", "environment variables", "API keys", "credentials storage", or "secret rotation".
- tomevault-io Bundle Secrets Env Manager
Validates environment variables in CI, prevents secret leaks, enforces masking, and provides fail-fast validation with clear documentation. Use for "secrets management", "env var validation", "credential security", or "secret masking".
- tomevault-io Bundle Popup Studio AI Bkit Gemini Bkend Security
bkend-security: Security Policies & Encryption Expert Skill
- tomevault-io Bundle Ripgraphics Authorsinfo Exploit Dev Expert
Exploit Development Expert
- tomevault-io Bundle Linkedin Personal Branding
Comprehensive LinkedIn personal branding analysis, profile optimization, and visibility improvement skill using Claude for Chrome browser tools. Use when users request LinkedIn profile analysis, personal branding audit, profile optimization recommendations, LinkedIn visibility improvement, headline optimization, About section review, content strategy guidance, engagement analysis, or Social Selling Index improvement. Works with Claude for Chrome to analyze profile photos, banners, headlines, About sections, experience, skills, recommendations, featured content, activity/posts, and network engagement directly from the user's browser. Use when this capability is needed.
- tomevault-io Bundle API Authentication
Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors. Use when this capability is needed.
- tomevault-io Bundle Repo Security Clean
Scans repository for security issues and automatically remediates them. Use when the user asks to "clean up security issues", "fix security problems", "remove sensitive data", "sanitise the repo", or "/repo-security-clean". More aggressive than /repo-security-scan - this skill takes action. Use when this capability is needed.
- tomevault-io Bundle Promql Validator
Validate, lint, audit, or fix PromQL queries and alerting rules; detects anti-patterns. Use when this capability is needed.
- tomevault-io Bundle Secure Repo
Use when asked to add secret scanning, install git hooks, protect against committing API keys/passwords/tokens, set up security for a repo, or after running git clone on a new repository.
- tomevault-io Bundle Mixed Language Monorepos
This skill should be used when the user is auditing a "polyglot monorepo", "multi-language codebase", "microservices with different languages", "Go + Python + TypeScript", or any codebase with services written in different programming languages. Provides strategies for cross-service security analysis and unified threat modeling. Use when this capability is needed.
- tomevault-io Bundle Ssl Helper
Configures SSL/TLS certificates, implements secure protocols and ciphers, and sets up security headers. Use when setting up HTTPS, SSL certificates, TLS configuration, or web security hardening.
- tomevault-io Bundle Agentic Structure
Collaborative programming framework for production-ready development. Use when starting features, writing code, handling security/errors, adding comments, discussing requirements, or encountering knowledge gaps. Applies to all development tasks for clear, safe, maintainable code. Use when this capability is needed.
- tomevault-io Bundle Bobmatnyc Claude Mpm Skills Threat Modeling
Threat Modeling (STRIDE)
- tomevault-io Bundle Database Audit
Use when auditing database schema, migrations, data integrity, query patterns, or when asked about database architecture. Covers schema design, indexing strategy (including high-volume tables), migrations, constraints, query optimization, and data consistency. Especially critical for tables with text-heavy columns, large datasets (logs, activity, notifications), and missing indexes.
- tomevault-io Bundle Sui Developer
Use when writing or modifying SUI Move smart contracts, generating Move code, or following Move development patterns. Triggers on "write a Move module", "implement contract", "add function", "Move code", or any hands-on Move development task. Also use when the user pastes Move code and asks for help. For code review/audit, use move-code-quality instead. For contract architecture design, use sui-architect.
- tomevault-io Bundle Speak Security Basics
Security best practices for Speak API keys, audio data privacy, student Use when this capability is needed.
- tomevault-io Bundle Git Repo Standards
Use when creating new repositories, reviewing existing repos for compliance, or enforcing repository naming, structure, documentation, and security standards. Applies to all fyrsmithlabs projects.
- tomevault-io Bundle Llvm Learning
Comprehensive learning resources and tutorials for LLVM, Clang, and compiler development. Use this skill when helping users learn LLVM internals, find educational resources, or understand compiler concepts. Use when this capability is needed.
- tomevault-io Bundle Llvm Security
Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation. Use this skill when implementing security-focused compiler features, analyzing vulnerabilities, or hardening applications. Use when this capability is needed.
- tomevault-io Bundle Greyhaven AI Claude Code Config Suite Audit
Plugin Suite Auditor
- tomevault-io Bundle Authentication Authorization Clerk
Implement secure authentication and authorization using Clerk. Use this skill when you need to authenticate users, protect routes, check permissions, implement subscription-based access control, or integrate Clerk with your application. Triggers include "authentication", "auth", "authorization", "Clerk", "protect route", "check user", "sign in", "session", "permissions", "subscription access". Use when this capability is needed.
- tomevault-io Bundle Limit Request Rate Pattern
Security pattern for implementing rate limiting and throttling. Use when protecting against brute-force attacks, DoS/DDoS mitigation, preventing resource exhaustion, or limiting API abuse. Addresses "Entity absorbs excessive resources" problem. Use when this capability is needed.
- tomevault-io Bundle Log Entity Actions Pattern
Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem. Use when this capability is needed.
- tomevault-io Bundle Log Injection Anti Pattern
Security anti-pattern for log injection vulnerabilities (CWE-117). Use when generating or reviewing code that writes to log files, handles logging of user input, or processes log data. Detects unsanitized data in log messages enabling log forging and CRLF injection. Use when this capability is needed.
- tomevault-io Bundle Type Contract Auditor
Audit public TypeScript types against src/planning/spec-v0.3.md, flag mismatches, and enforce acceptance criteria (build, no circular imports). Use when this capability is needed.
- tomevault-io Bundle Docs Consolidator
Audit and consolidate project documentation in the docs/ folder. Use when the user wants to clean up docs, check docs are up to date, deduplicate information across docs, ensure information lives in the right doc, or reorganize documentation. Triggers on requests like "consolidate docs", "clean up documentation", "audit docs", "organize docs", "sync docs with code". Use when this capability is needed.
- tomevault-io Bundle Memory Audit Pattern Extraction
模式提取与失效解药分析。当发现多条记忆在讲同一个教训，或发现自己在一而再再而三地犯同样的错误时使用。 Use when this capability is needed.
- tomevault-io Bundle Plan Validator
Expertise in validating that the codebase matches a specific plan. Use when the user asks to "validate the plan", "check implementation", or "audit the code". Use when this capability is needed.
- tomevault-io Bundle Mux Video
Mux Video infrastructure skill for designing, ingesting, transcoding/packaging, playback ID policy, live streaming, clipping, and observability with Mux Data. Use when architecting or operating Mux-based video pipelines, live workflows, playback security, or diagnosing playback issues. Use when this capability is needed.
- tomevault-io Bundle Supabase Secrets
Manage remote project secrets and environment variables. Triggered by phrases like "set secret", "list secrets", "unsert environment variable", or "supabase secrets". Use when this capability is needed.
- tomevault-io Bundle Mayrlabs Internal Security
Extracted Security standards from MayR Labs GEMINI.md Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include security-report, cqrs-event-sourcing, phxreview. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.