Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle Niloykumarbarman Everything Claude Code Django Security---
- tomevault-io Bundle A05 Security Misconfiguration
Skills for exploiting security misconfigurations including XXE, file upload, subdomain takeover, and cache issues per OWASP A05:2021. Use when this capability is needed.
- tomevault-io Bundle Dependency Evaluator
Evaluates whether a programming language dependency should be used by analyzing maintenance activity, security posture, community health, documentation quality, dependency footprint, production adoption, license compatibility, API stability, and funding sustainability. Use when users ask "should I use X or Y?", "are there better options for [feature]?", "what's a good library for [task]?", "how do we feel about [dependency]?", or when considering adding a new dependency, evaluating an existing dependency, or comparing/evaluating package alternatives. Use when this capability is needed.
- tomevault-io Bundle Systems Languages Orchestrator
Route a systems-language task to the right skill among 7 specialists — Go (patterns, testing), C++ (Core Guidelines coding standards, GoogleTest/CTest testing), and Perl (modern 5.36+ patterns, Test2 testing, taint/injection security). USE WHEN a user is writing, reviewing, testing, or hardening Go, C++, or Perl code but hasn't named the language axis or the specific concern. Use when this capability is needed.
- tomevault-io Bundle Security Headers Configuration
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.
- tomevault-io Bundle Somnio Software Somnio AI Tools Flutter Best Practices
Flutter Micro-Code Audit Plan
- tomevault-io Bundle Code Quality Review All
Review all evaluations in the repository against a single code quality standard. Checks ALL evals against ONE standard for periodic quality reviews. Use when user asks to review/audit/check all evaluations for a specific topic or standard. Do NOT use for reviewing a single eval (use eval-quality-workflow instead) or for test coverage (use ensure-test-coverage instead). Use when this capability is needed.
- tomevault-io Bundle Dev Dependency Management
Dependency management across npm, pip, cargo, and maven. Use when managing lockfiles, security scanning, versioning, or monorepo workspaces. Use when this capability is needed.
- tomevault-io Bundle Instructions Audit
Audit copilot-instructions.md against the actual codebase structure, conventions, and recent changes. Detects stale paths, outdated conventions, missing sections, and drift. Use when instructions feel wrong, after major refactors, or at session end for hygiene. Use when this capability is needed.
- tomevault-io Bundle Vscode Extension Expert
This skill provides expert-level guidance for VS Code extension development. Use when implementing new extension features, debugging extension code, designing WebView UIs, implementing Language Server Protocol features, or optimizing extension performance. Covers activation events, contribution points, VS Code API patterns, security best practices, testing strategies, and publishing workflows. Use when this capability is needed.
- tomevault-io Bundle Golang Clean Architecture
Clean Architecture audit for Go services. Use when reviewing layered architecture, dependency rules, or gRPC/usecase/repository patterns. Ensures proper separation of concerns and dependency inversion. Use when this capability is needed.
- tomevault-io Bundle Laravel Security Audit
Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices. Use when this capability is needed.
- tomevault-io Bundle V4lheru Linkedin Comments Telegram Pact Security Patterns
Security Patterns Skill
- tomevault-io Bundle Aj Geddes Useful AI Prompts Security Headers Configuration
Security Headers Configuration
- tomevault-io Bundle Dorucioclea Vibeship Knowledgebase Vibeship Security Writer
VibeShip Security Content Writer
- tomevault-io Bundle Security Fastapi
FastAPI security audit patterns. Use when reviewing FastAPI apps (fastapi imports, main.py/app.py, requirements/pyproject with fastapi, uvicorn). Covers auth dependencies, CORS configuration, TrustedHost/HTTPS middleware, and common FastAPI/Starlette security footguns. Use when this capability is needed.
- tomevault-io Bundle Cloudflare Security Checker
Automatically validates Cloudflare Workers security patterns during development, ensuring proper secret management, CORS configuration, and input validation Use when this capability is needed.
- tomevault-io Bundle 504 Frameworks Micronaut Security
Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JWT/session strategies, SecurityService checks, CORS, CSRF awareness for browser apps, rejection handlers, and sensitive-data-safe logging. This should trigger for requests such as Add Micronaut security support; Review Micronaut security configuration; Improve API authorization in Micronaut; Add JWT security in Micronaut; Harden Micronaut route authorization rules. Part of cursor-rules-java project
- tomevault-io Bundle Meituan Passport User Auth
美团 Passport 用户授权登录 Skill。通过 pt-passport CLI 获取授权链接，展示给用户完成确认后轮询拿到鉴权凭证（用户态登录 Token）。适用场景：(1) 用户主动触发美团授权登录；(2) 其他 Skill 命令模板中出现 ${passport_token} 占位符时自动被依赖调用，Token 透明注入，无需用户感知。不适用于服务端 AppKey/Secret 鉴权或非美团系统授权。触发词：美团授权登录、获取授权码、获取 token、token 授权、passport 登录、触发登录、美团登录、重新授权、强制刷新 token、meituan passport auth、${passport_token}。 Use when this capability is needed.
- tomevault-io Bundle Django Backend Best Practices
Best practices for Django backend service development. Covers project architecture, models, querysets, serializers, views, error handling, security, performance, and production readiness. Use when this capability is needed.
- tomevault-io Bundle Agentic Jumpstart Dependency Management
Dependency management guidelines for Jarvy - crate selection criteria, feature flag best practices, version management, security auditing with cargo-audit and cargo-deny. Use when this capability is needed.
- tomevault-io Bundle Codex Execution Quality Gate
Run verification checks before completion using lint/test, security scanning, and optional bundle plus tech debt analysis. Use at final gate steps and block completion when mandatory failures are detected. Use when this capability is needed.
- tomevault-io Bundle Criteria Audit
Validate EXECUTION_PLAN.md for verification metadata, manual reasons, and testability. Use when preparing Phase 1 or after editing EXECUTION_PLAN.md. Use when this capability is needed.
- tomevault-io Bundle Security Vulnerability Report
Scan GitHub repositories for security vulnerabilities including Dependabot alerts, code scanning results, and secret scanning findings. Use when auditing repository security, preparing compliance reports, or triaging vulnerability alerts. Use when this capability is needed.
- tomevault-io Bundle Project Stage Detect
Automatically analyze project state, detect stage, identify gaps, and recommend next steps based on existing artifacts. Use when user asks 'where are we in development', 'what stage are we in', 'full project audit'. Use when this capability is needed.
- tomevault-io Bundle Wp Performance Review
WordPress performance code review and optimization analysis. Use when reviewing WordPress PHP code for performance issues, auditing themes/plugins for scalability, optimizing WP_Query, analyzing caching strategies, checking code before launch, or detecting anti-patterns, or when user mentions "performance review", "optimization audit", "slow WordPress", "slow queries", "high-traffic", "scale WordPress", "code review", "timeout", "500 error", "out of memory", or "site won't load". Detects anti-patterns in database queries, hooks, object caching, AJAX, and template loading. Use when this capability is needed.
- tomevault-io Bundle Krammesiwimplementation Audit
Exhaustively audit codebase implementation against specification. Detects spec divergences, undocumented implementation extensions, contract violations, and spec drift. Supports inline report output with --inline. Use when this capability is needed.
- tomevault-io Bundle Flutter Store Review Checker
Pre-submission audit for Flutter apps targeting Apple App Store and Google Play Store. Trigger this skill when the user mentions "submit to App Store", "ready to publish", "TestFlight", "App Store review", "app rejected", "Guideline 5.1.1", "Guideline 4.8", "privacy manifest", "PrivacyInfo.xcprivacy", "Data Safety", "Privacy Policy", or before any production release. Runs a checklist covering App Privacy labels, privacy manifests, third-party SDK signatures, login requirements (5.1.1 e-commerce browse-before-login), Apple Sign-In requirement when offering social auth (4.8), subscription terms transparency, screenshot requirements, age rating, and Play Store Data Safety form. Identifies blockers BEFORE the rejection email arrives. Use when this capability is needed.
- tomevault-io Bundle Ralph Run Reconcile Claude Code
Audit and reconcile the latest Ralph run in Claude Code. Use when Ralph finishes with failures, tentative outcomes, or suspected missing merges; inspect story branches, state/spec drift, and merge conflicts, then produce or execute a prioritized remediation plan. Use when this capability is needed.
- tomevault-io Bundle Optimizing Claude Code
Audits repositories for Claude Code readiness and suggests improvements. Use when asked to check CLAUDE.md quality, review settings, audit project organization, or optimize for agentic work. Use when this capability is needed.
- tomevault-io Bundle Mpc Accept Crypto Payments
Accept crypto payments on Solana via MoonPay Commerce (formerly Helio). Create Pay Links, generate checkout URLs, check transactions, and list supported currencies. Use when the user wants to accept crypto payments, create payment links, charge for products/services with crypto, or query payment transactions. Requires a MoonPay Commerce account with API key and secret. Use when this capability is needed.
- tomevault-io Bundle Documentation Quality Assurance
Systematic documentation audit, drift detection, preflight validation, and multi-pass quality pipelines Use when this capability is needed.
- tomevault-io Bundle Spring Boot Security JWT
Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
- tomevault-io Bundle Validation Patterns
Validation patterns and compliance checking for Kailash SDK including parameter validation, DataFlow pattern validation, connection validation, absolute import validation, workflow structure validation, and security validation. Use when asking about 'validation', 'validate', 'check compliance', 'verify', 'lint', 'code review', 'parameter validation', 'connection validation', 'import validation', 'security validation', or 'workflow validation'. Use when this capability is needed.
- tomevault-io Bundle Bigbulgogiburger Claude Jira Harness Codebase AI Readiness
Codebase AI-Readiness Audit
- tomevault-io Bundle Alicloud Security Center Sas Test
Minimal smoke test for Security Center SAS skill. Validate read-only query flow. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include niloykumarbarman--everything-claude-code--django-security, a05-security-misconfiguration, dependency-evaluator. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.