Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle Configuring NginxConfigure nginx for static sites, reverse proxying, load balancing, SSL/TLS termination, caching, and performance tuning. When setting up web servers, application proxies, or load balancers, this skill provides production-ready patterns with modern security best practices for TLS 1.3, rate limiting, and security headers. Use when this capability is needed.
- tomevault-io Bundle Aegis Security
Blockchain security API for AI agents. Scan tokens, simulate transactions, check addresses for threats. Use when this capability is needed.
- tomevault-io Bundle Demerzels Lab Elsamultiskillagent Secops By Joes
Security Joes AI Analyst
- tomevault-io Bundle GRAPHQL Test Strategy
Analyzes a GraphQL API codebase and generates a production-grade TEST_STRATEGY.md covering testing levels, performance, security, automation, and tooling. Use when starting a new GraphQL project, preparing for a QA audit, or formalizing testing practices for engineering leadership review.
- tomevault-io Bundle Ralph Security
Comprehensive security audit with 100 iterations (~30-60 min). Use when user says 'security audit', 'ralph security', 'weekly security check', 'audit this project', 'new project security review', or 'check for vulnerabilities'. Covers OWASP Top 10, auth, secrets, infrastructure, and code quality. Use when this capability is needed.
- tomevault-io Bundle Forge Milestone Backcompat Audit
Use when checking whether a Forge milestone broke any public-facing interface — diffs IPC message shapes (docs/architecture/ipc-contracts.md + the Rust/TS types that back it), config schema, CLI flags, and any exposed plugin/extension API from the milestone-start baseline to current, classifies each change as safe/breaking, and flags unannounced breaks. Produces one GitHub issue per breaking change plus a consolidated report. Trigger on phrases like "did we break compatibility in Phase N", "backcompat audit for the milestone", "check for breaking changes", "IPC contract diff for the milestone", or any pre-release compatibility pass.
- tomevault-io Bundle Code Analyze
Run static analysis, security scans, and dependency checks on .NET code. Use when task involves code quality, security audits, or vulnerability detection. Use when this capability is needed.
- tomevault-io Bundle Vendor Cleanup Audit
Audit a Laravel app for vendor-published file cruft - orphaned files from uninstalled packages, drift between local copies and vendor originals, and unchanged published files that can be deleted. Use when the user asks to "audit vendor files", "find vendor cruft", "check for orphaned configs/migrations/views/lang files", "detect vendor drift", "find leftover package files", "clean up published files", or mentions the `leek/laravel-vendor-cleanup` package. Use when this capability is needed.
- tomevault-io Bundle Deployment Provenance
Use when deploying software to production or staging environments to ensure complete traceability of what was deployed, when, by whom, and from which source. Essential for audit compliance, incident investigation, and rollback decisions.
- tomevault-io Bundle Audit Plugins
Audit Claude Code plugins for quality, compliance, and distribution readiness. Use before releases or for periodic quality checks. Use when this capability is needed.
- tomevault-io Bundle Context Audit
Audit current context composition and identify optimization opportunities. Use when context window is overloaded, agents are underperforming, or applying the R&D framework to optimize token usage. Use when this capability is needed.
- tomevault-io Bundle Multiversx Project Culture
Assess codebase quality and maturity based on documentation, testing practices, and code hygiene indicators. Use when evaluating project reliability, estimating audit effort, or onboarding to new codebases. Use when this capability is needed.
- tomevault-io Bundle Omer Metin Skills For Antigravity AI Code Security
---
- tomevault-io Bundle Multi Tenant Safety Checker
Ensures tenant isolation at query and policy level using Row Level Security, automated testing, and security audits. Prevents data leakage between tenants. Use for "multi-tenancy", "tenant isolation", "RLS", or "data security". Use when this capability is needed.
- tomevault-io Bundle Security Pr Checklist Skill
Creates repeatable security review checklist for PRs with required checks, common pitfalls, and automated gating. Use for "security review", "PR checklist", "code review", or "security gates".
- tomevault-io Bundle Multiversx Security Audit
Complete security audit methodology for MultiversX smart contracts. Covers context building, entry point analysis, static analysis patterns, and automated Semgrep scanning. Use when performing security audits, code reviews, or setting up automated vulnerability detection. Use when this capability is needed.
- tomevault-io Bundle Murphytrueman Design System Ops Design System Ops
Theme audit
- tomevault-io Bundle Threat Modeling Techniques
Threat modeling methodologies using STRIDE, attack trees, and risk assessment for proactive security analysis. Use when designing secure systems, conducting security reviews, or identifying potential attack vectors in applications. Use when this capability is needed.
- tomevault-io Bundle OAUTH Flow Architect
Implements OAuth 2.0 and OpenID Connect authentication flows with proper security, token management, and common provider integrations. Use when this capability is needed.
- tomevault-io Bundle Secure Headers Csp Builder
Implements security headers and Content Security Policy with safe rollout strategy (report-only → enforce), testing, and compatibility checks. Use for "security headers", "CSP", "HTTP headers", or "XSS protection". Use when this capability is needed.
Audited - tomevault-io Bundle Code Review General
Run full-scope code review for correctness, maintainability, and regression risk when no single specialty dominates. Use for broad merge-readiness reviews with explicit findings and evidence; if security or performance risk is primary, prioritize `code-review-security` or `code-review-performance` first. Use when this capability is needed.
- tomevault-io Bundle Semantic Guard Analysis
Detects logic vulnerabilities in smart contracts by analyzing guard-state consistency patterns. Identifies functions that bypass security checks (require, modifiers) that other functions consistently apply. Uses the Consistency Principle — a contract is its own specification. Use when auditing smart contracts for missing access controls, inconsistent pause checks, logic bugs, forgotten modifiers, or when traditional tools report no issues but logic errors may exist. Use when this capability is needed.
Audited - tomevault-io Bundle Claude Docs Diagnose
Audit, write, and maintain CLAUDE.md files following the battle-tested practices from Anthropic (Boris Cherny, Thariq Shihipar), Addy Osmani, termdock, and the ETH Zurich / Lulla et al. ICSE JAWs 2026 empirical studies. Use when the user asks to write, review, audit, prune, optimize, or fix a CLAUDE.md / AGENTS.md / GEMINI.md, complains that Claude is ignoring rules, mentions context bloat or token budgets for instruction files, asks about MEMORY.md being truncated, wants to split a monolithic CLAUDE.md into .claude/rules/ modules, or refers to the 16 common CLAUDE.md mistakes. Also trigger when the user invokes /claude-docs-diagnose or asks "is my CLAUDE.md too long". Use when this capability is needed.
- tomevault-io Bundle Release Review
Senior developer-level release review for macOS/iOS apps. Identifies security, privacy, UX, and distribution issues with actionable fixes. Use when preparing an app for release, want a critical review, or before App Store submission. Use when this capability is needed.
- tomevault-io Bundle Claude Code Bash Patterns
Claude Code Bash tool patterns with hooks, automation, git workflows. Use for PreToolUse hooks, command chaining, CLI orchestration, custom commands, or encountering bash permissions, command failures, security guards, hook configurations. Use when this capability is needed.
- tomevault-io Bundle Devssecurity Core
Comprehensive application security expertise covering authentication, authorization, OWASP Top 10, and security best practices. Use when (1) Implementing authentication (JWT, OAuth2, sessions, OAuth for CLI/TUI/desktop apps), (2) Adding authorization (RBAC, ABAC, RLS with Supabase/PostgreSQL), (3) Security auditing code or infrastructure, (4) Setting up security infrastructure (headers, CORS, CSP, rate limiting), (5) Managing secrets and credentials, (6) Preventing OWASP Top 10 vulnerabilities (injection, XSS, CSRF, etc.), (7) Reviewing code for security issues, (8) Configuring secure web applications in TypeScript, Python, or Rust. Automatically triggered when working with authentication/authorization systems, security reviews, or addressing security vulnerabilities. Use when this capability is needed.
- tomevault-io Bundle Github Actions Validator
Validate, lint, audit, fix GitHub Actions workflows (.github/workflows). Use when this capability is needed.
- tomevault-io Bundle Amnadtaowsoam Cerebraskills Audit Trails For Agents
Audit Trails For Agents
- tomevault-io Bundle Security Questionnaires
Enterprise security questionnaires are comprehensive surveys (100-500 Use when this capability is needed.
- tomevault-io Bundle Template Validator
Validates CloudFormation templates for syntax, security, and best practices. Use when validating CloudFormation templates, checking for security issues, or ensuring compliance with best practices.
- tomevault-io Bundle Maintenance Automation
This skill should be used when the user asks to "automate maintenance", "update dependencies", "security scanning", "automated backups", "system health monitoring", or needs comprehensive automated maintenance to reduce operational overhead and prevent technical debt. Use when this capability is needed.
- tomevault-io Bundle Alicloud Security Kms Test
Minimal smoke test for KMS skill. Validate auth and read-only key listing path. Use when this capability is needed.
- tomevault-io Bundle Performing Code Reviews
Use when reviewing code for quality, security, and maintainability. Enforces verification tooling as table stakes, loads skill-based review lenses, and produces structured actionable output.
- tomevault-io Bundle Human Centric Engineering Sunrise Security Hardener
Security Hardener Skill - Overview
- tomevault-io Bundle Debug Mode Production Anti Pattern
Security anti-pattern for debug mode in production (CWE-215). Use when generating or reviewing code that configures application settings, deployment configurations, or error handling. Detects hardcoded debug flags and development-only features in production. Use when this capability is needed.
- tomevault-io Bundle Hallucinated Packages Anti Pattern
Security anti-pattern for hallucinated (non-existent) packages (CWE-1357). Use when generating or reviewing AI-assisted code that imports packages, dependencies, or libraries. CRITICAL AI-specific vulnerability with 5-21% hallucination rate. Detects dependency confusion and slopsquatting risks. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include configuring-nginx, aegis-security, demerzels-lab--elsamultiskillagent--secops-by-joes. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.