Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle Missing Rate Limiting Anti PatternSecurity anti-pattern for missing rate limiting (CWE-770). Use when generating or reviewing API endpoints, authentication systems, or public-facing services. Detects absence of request throttling enabling brute force, credential stuffing, and DoS attacks. Use when this capability is needed.
- tomevault-io Bundle Weak Password Hashing Anti Pattern
Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing password hashing entirely. Recommends bcrypt, Argon2, or scrypt. Use when this capability is needed.
- tomevault-io Bundle Countermeasure Verification
Verify that security controls (countermeasures) linked to issue tracker tasks are correctly implemented in code. Use when reviewing PRs that claim to implement specific security controls or validating documented controls match implementation. Use when this capability is needed.
- tomevault-io Bundle Audit Security
Run a single-session security audit on the codebase Use when this capability is needed.
- tomevault-io Bundle Codex Autoresearch
Autonomous long-running iteration for Codex CLI. Use when the user wants Codex to plan or run an unattended improve-verify loop toward a measurable or verifiable outcome, especially for overnight runs; it also covers repeated debugging, fixing, security auditing, and ship-readiness workflows. Do not use for ordinary one-shot coding help or casual Q&A. Use when this capability is needed.
- tomevault-io Bundle Li Lance Android Seraphim Framework Golang Security
Golang Security Standards
- tomevault-io Bundle Oauth21 Security
OAuth 2.1 security requirements and best practices. Use when implementing TLS requirements, HTTP redirect handling, removed grant types, sender-constrained tokens, and security considerations. Covers OAuth 2.1 Section 1.5, Section 7, and Section 10 requirements. Use when this capability is needed.
- tomevault-io Bundle Backend Audit Secrets
virtual-voicebot-backend/** のみを対象に、read-only で秘密/設定漏れっぽい箇所を検出して要約（並列安全）。rg/find/test のみ使用。 Use when this capability is needed.
- tomevault-io Bundle Apply Findings
Apply fixes from audit or review findings. Use after /audit-* or /review commands to implement recommendations from the current conversation. Use when this capability is needed.
- tomevault-io Bundle Audit Settings
Audit Claude Code settings.json files for quality, compliance, and security. Use to validate configuration before deployment or check for exposed secrets. Use when this capability is needed.
Audited - tomevault-io Bundle Code Reviewing
Performs systematic code review with universal best practices and repo-specific standards. Auto-activates after significant code changes. Use when reviewing code, auditing files, checking PRs, examining staged changes, or when asked to "review", "check", "audit", or "examine" code. Enforces design principles (SOLID, DRY, KISS), security (OWASP), performance, concurrency safety, cross-platform compatibility, and codebase patterns. Use when this capability is needed.
- tomevault-io Bundle Gemini Analyze
Send a file to Gemini CLI for structured code analysis. Use when you need security audits, performance reviews, architecture analysis, or bug detection. Use when this capability is needed.
- tomevault-io Bundle Moltbot Openclaw Security
Security hardening guide for AI agents (OpenClaw/Moltbot/OpenClaw). Lock down gateway, fix permissions, set up auth. Based on real vulnerability research. Use when this capability is needed.
- tomevault-io Bundle Dianyike Claude Code Insights Claude Code Insights
Security Review Protocol
- tomevault-io Bundle Gdpr Auditor
This skill should be used when analyzing codebases, applications, databases, or systems for GDPR (General Data Protection Regulation) compliance. Use this skill when users need to audit data protection practices, identify potential compliance issues, assess data handling procedures, review privacy policies, or ensure adherence to EU data protection requirements. Use when this capability is needed.
- tomevault-io Bundle Sandbox Configurator
Configure Claude Code sandbox security with file system and network isolation boundaries Use when this capability is needed.
- tomevault-io Bundle Fabiensalles Claude Marketplace Security Overrides
Security Audit — Personal Overrides
- tomevault-io Bundle Python Dependency Safety
Analyze Python project dependencies for security vulnerabilities. Use when this capability is needed.
- tomevault-io Bundle Brand Baseline Reality Craft
Use when authoring, editing, or generating prose for any public-facing surface OR internal counterparty-side artefact in this AKOS workspace. Codifies the craft for the dual-register translation (CORPINT-internal vs translated-external) per D-IH-66-M. Triggers on brand baseline reality, dual register, CORPINT internal, translated external, counterparty brief, objections brief, deck slide body, dossier prose, recruiter copy, partner pitch, ENISA evidence, founder bio, brand jargon audit, BRAND_BASELINE_REALITY_MATRIX. Pairs with .cursor/rules/akos-brand-baseline-reality.mdc (the WHEN); this skill is the HOW.
- tomevault-io Bundle Generic Test Evaluation
Document and evaluate tests using the generic test files, and explain why the match score was reached. Use when validating the app with `generic test files/` inputs or when recording test evidence. Use when this capability is needed.
- tomevault-io Bundle Hack23 Blacktrigram Security Architecture Validation
Security Architecture Validation Skill
- tomevault-io Bundle Helixdevelopment Helixagent Auditing Wallet Security
Auditing Wallet Security
- tomevault-io Bundle Helixdevelopment Helixagent Supabase Security Basics
Supabase Security Basics
- tomevault-io Bundle Helixdevelopment Helixagent Windsurf Security Basics
Windsurf Security Basics
- tomevault-io Bundle Message Authentication Code Pattern
Security pattern for implementing Message Authentication Codes (MACs) to ensure data integrity and origin authentication. Use when implementing HMAC, CMAC, or other MAC algorithms, verifying message integrity, authenticating message origin with shared secrets, or when non-repudiation is NOT required. Specialization of Cryptographic action pattern. Use when this capability is needed.
- tomevault-io Bundle Missing Authentication Anti Pattern
Security anti-pattern for missing or broken authentication (CWE-287). Use when generating or reviewing code for login systems, API endpoints, protected routes, or access control. Detects unprotected endpoints, weak password policies, and missing rate limiting on authentication. Use when this capability is needed.
- tomevault-io Bundle Second Order Injection Anti Pattern
Security anti-pattern for second-order injection vulnerabilities (CWE-89 variant). Use when generating or reviewing code that retrieves data from databases, caches, or storage and uses it in subsequent queries or commands. Detects trusted internal data used unsafely. Use when this capability is needed.
- tomevault-io Bundle Selective Encrypted Storage Pattern
Security pattern for field-level encryption at rest. Use when encrypting specific sensitive data fields before storage, implementing application-level encryption for databases, or when only certain data elements need encryption at rest. Addresses "Leak data at rest" problem. Use when this capability is needed.
- tomevault-io Bundle Verbose Error Messages Anti Pattern
Security anti-pattern for verbose error messages (CWE-209). Use when generating or reviewing code that handles errors, exceptions, or generates user-facing error responses. Detects stack trace exposure and detailed error information leakage to users. Use when this capability is needed.
- tomevault-io Bundle Cheatsheets
Quick reference cheatsheets for Kailash SDK patterns, nodes, workflows, and best practices. Use when asking about 'quick tips', 'cheat sheet', 'quick reference', 'common mistakes', 'node selection', 'workflow patterns library', 'cycle patterns', 'production patterns', 'performance optimization', 'monitoring', 'security config', 'multi-tenancy', 'distributed transactions', 'saga pattern', 'custom nodes', 'PythonCode data science', 'ollama integration', 'directoryreader patterns', or 'environment variables'. Use when this capability is needed.
- tomevault-io Bundle Security Development Advisor
Help developers assess security impact of their work and recommend threat modeling when appropriate. Use when developer is planning changes or asks about security. Respects autonomy and workflow while providing guidance. Use when this capability is needed.
- tomevault-io Bundle Optimise Cursor Repo
Audit a repository and produce prioritised recommendations for improving Cursor performance and developer experience. Use when the user wants to optimise their repo for Cursor, improve indexing, add rules, or assess their Cursor configuration. Use when this capability is needed.
- tomevault-io Bundle Sanctifiedops Solana Skills Program Security Basics
Program Security Basics
- tomevault-io Bundle Heatmap Visualization
Use this skill when asked to create heatmaps, visualize patterns over time, show activity grids, or display aggregated data in a matrix format. Triggers on keywords like "heatmap", "show heatmap", "visualize patterns", "activity grid", "time-based visualization", or when analyzing attack patterns, sign-in activity, or event distributions by time period.
- tomevault-io Bundle Cloudflare Workers Security
Cloudflare Workers security with authentication, CORS, rate limiting, input validation. Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities. Use when this capability is needed.
- tomevault-io Bundle Solana Auditor
Security audit of Solana/Rust programs while you develop. Trigger on "audit", "check this program", "review for security". Modes - default (full repo) or a specific filename. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include missing-rate-limiting-anti-pattern, weak-password-hashing-anti-pattern, countermeasure-verification. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.