Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle API Security HardenerHardens API security with rate limiting, input validation, authentication, and protection against common attacks. Use when users request "API security", "secure API", "rate limiting", "input validation", or "API protection". Use when this capability is needed.
- tomevault-io Bundle Manage Openapi Overlays
Use when creating, applying, or validating overlay files including x-speakeasy extensions. Covers overlay syntax, JSONPath targeting, retries, pagination, naming, grouping, open enums, global headers, custom security. Triggers on "create overlay", "apply overlay", "overlay file", "x-speakeasy", "add extension", "configure retries", "add pagination", "overlay for retries".
- tomevault-io Bundle Srajangpt1 AI Security Crew AI Security Crew
Perform a pre-coding security review for the following task:
- tomevault-io Bundle Django Project
Scaffold and evolve Django projects with uv-based tooling, structured settings, and production-ready observability, resilience, availability, and security patterns aligned with python.instructions.md. Use when this capability is needed.
- tomevault-io Bundle Roblox Code Review
Code review with security, performance, and monetization lenses for Roblox projects Use when this capability is needed.
- tomevault-io Bundle Claude Md Manager
Create, audit, and maintain CLAUDE.md documentation files that configure Claude Code for projects. Use this skill when (1) initializing a new project with Claude Code configuration, (2) reviewing or improving existing CLAUDE.md files, (3) organizing project instructions using progressive disclosure patterns, (4) converting repeated instructions into permanent documentation, or (5) setting up agent_docs/ structures for larger codebases. Handles the WHAT/WHY/HOW framework, conciseness optimization, and file import patterns. Use when this capability is needed.
- tomevault-io Bundle Enumerating Network Services
Enumerate and exploit network services including SMB, FTP, SSH, RDP, HTTP, databases (MySQL, MSSQL, PostgreSQL, MongoDB), LDAP, NFS, DNS, and SNMP. Use when testing network service security or performing port-based exploitation. Use when this capability is needed.
- tomevault-io Bundle Firestore Rules Testing
Guide for testing Firestore security rules using @firebase/rules-unit-testing. Includes setup, test patterns, and required test matrix for all collections. Use when this capability is needed.
- tomevault-io Bundle Audit Code Quality
Scan codebase for bad coding practices that violate fail-fast principles Use when this capability is needed.
- tomevault-io Bundle API Design Audit
Use when designing, reviewing, or auditing APIs — REST, GraphQL, RPC, WebSocket. Covers endpoint design, request/response contracts, versioning, error handling, pagination, rate limiting, and documentation.
- tomevault-io Bundle Rls Patterns
Row Level Security patterns for database operations. Use when writing Prisma/database code, creating API routes that access data, or implementing webhooks. Enforces withUserContext, withAdminContext, or withSystemContext helpers. NEVER use direct prisma calls. Use when this capability is needed.
- tomevault-io Bundle Defense In Depth
This skill should be used when implementing "multi-layer validation", "comprehensive error handling", "input sanitization", "security testing", "data validation layers", "fault tolerance", or when building robust systems with multiple validation checkpoints. Use when this capability is needed.
- tomevault-io Bundle Red Team Tools And Methodology
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters. Use when this capability is needed.
- tomevault-io Bundle Doodledood Codex Workflow Review Type Safety
You are an expert Type System Architect. Your mission is to audit code for type safety issues—finding holes that let bugs through and opportunities to push runtime checks into compile-time guarantees.
- tomevault-io Bundle Everydaydevopsio Ballast Owasp Security Scan
OWASP Security Scan Skill
- tomevault-io Bundle Skill Testing And Validation
use when asked to create, improve, validate, run, lint, debug, or minimally fix tests, validators, build commands, test commands, lint commands, runners, benchmark tools, packaging checks, or small polyglot technical packages, especially reusable skill packages and their scripts. supports python, javascript/typescript, shell, and detectable multi-language projects. do not use for generic feature implementation, security review, documentation-only work, governance artifacts, or edits to fixtures, expected outputs, benchmark evidence, secrets, .git, or blocked files without explicit authorization.
- tomevault-io Bundle Security Sentinel
アプリケーションの脆弱性を監視し、安全な実装をガイドするスキル Use when this capability is needed.
- tomevault-io Bundle I3ringit Antigravity Cortex Security Sentinel
You are an elite Application Security Specialist with deep expertise in identifying and mitigating security vulnerabilities. You think like an attacker, constantly asking: Where are the vulnerabilities? What could go wrong? How could this be exploited?
- tomevault-io Bundle Cryptographic Action Pattern
Base security pattern for integrating cryptographic primitives into software systems. Use when implementing encryption, digital signatures, MACs, or any cryptographic operations. Provides guidance on library selection, key usage, configuration protection, and designing for cryptographic agility. Foundation pattern for Encryption, Digital signature, and MAC patterns. Use when this capability is needed.
- tomevault-io Bundle Encoding Bypass Anti Pattern
Security anti-pattern for encoding bypass vulnerabilities (CWE-838). Use when generating or reviewing code that handles URL encoding, Unicode normalization, or character set conversions before security validation. Detects validation before normalization and double-encoding issues. Use when this capability is needed.
- tomevault-io Bundle Mass Assignment Anti Pattern
Security anti-pattern for mass assignment vulnerabilities (CWE-915). Use when generating or reviewing code that creates or updates objects from user input, form handling, or API request processing. Detects uncontrolled property binding enabling privilege escalation. Use when this capability is needed.
- tomevault-io Bundle Weak Encryption Anti Pattern
Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, and custom crypto implementations. Use when this capability is needed.
- tomevault-io Bundle Jantoniofc Skillsbank Security Best Practices
Security Best Practices
- tomevault-io Bundle Flask Auth Security
Implementing professional session-based and token-based authentication. Use when this capability is needed.
- tomevault-io Bundle Supabase Admin
Supabase administration, RLS policies, migrations, and schema design. Use for database architecture, Row Level Security, performance tuning, auth integration. Activate on "Supabase", "RLS", Use when this capability is needed.
- tomevault-io Bundle Clawcredit
Credit line service for AI agents to access x402 services without upfront payment. Use when (1) you need to call x402-enabled APIs or services but lack cryptocurrency, (2) you want to use credit instead of paying directly, (3) you need to register for an initial credit line with code audit, (4) you need to check credit balance or repayment status, or (5) you want to build credit history through service usage. ClawCredit acts as a payment proxy, handling blockchain settlements on Base/Solana/XRPL while you spend USD credit. Use when this capability is needed.
- tomevault-io Bundle Web Security Hardening
Security audit checklist for web applications. Use when reviewing, auditing, or hardening a web app's security posture. Covers rate limiting, auth headers, IP blocking, CORS, security middleware, input validation, file upload limits, ORM usage, and password hashing. Triggers on requests like "review security", "harden this app", "security audit", "check for vulnerabilities", or when building/reviewing API endpoints. Use when this capability is needed.
- tomevault-io Bundle Firebase Data Connect
Integrates Firebase Data Connect into Flutter apps. Use when setting up Data Connect, designing queries, handling errors, or applying security and performance best practices.
- tomevault-io Bundle Liveview Code Review
Reviews Phoenix LiveView code for lifecycle patterns, assigns/streams usage, components, and security. Use when reviewing LiveView modules, .heex templates, or LiveComponents. Use when this capability is needed.
- tomevault-io Bundle Wish Ssh Code Review
Reviews Wish SSH server code for proper middleware, session handling, and security patterns. Use when reviewing SSH server code using charmbracelet/wish. Use when this capability is needed.
- tomevault-io Bundle Paper Self Review
This skill should be used when the user asks to "review paper quality", "check paper completeness", "validate paper structure", "self-review before submission", "audit claims", "check overclaiming", "verify whether results support claims", or mentions systematic paper quality checking. Provides comprehensive quality assurance checklist for academic papers. Use when this capability is needed.
- tomevault-io Bundle Windows Kernel Security
Guide for Windows kernel internals and security mechanisms used in game protection and low-level research. Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, or kernel memory inspection. Use when this capability is needed.
- tomevault-io Bundle Binary Lifting
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations. Use when this capability is needed.
- tomevault-io Bundle Skills Optimizer
Audit and optimize skills for token efficiency and progressive disclosure compliance. Use when user wants to "analyze skill tokens", "audit skills", "optimize skill size", "check token efficiency", or "validate progressive disclosure". Use when this capability is needed.
- tomevault-io Bundle Greyhaven AI Claude Code Config Plugin Audit
Plugin Audit Skill
- tomevault-io Bundle Guia Matthieu Clawfu Skills Lighthouse Audit
Lighthouse Audit
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include api-security-hardener, manage-openapi-overlays, srajangpt1--ai-security-crew--ai-security-crew. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.