Security Agent Skills
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Security
1,976 skills
trailofbits cargo-fuzz
Fuzz Rust projects with libFuzzer using cargo-fuzz, including harness writing, sanitizer integration, and coverage analysis.
6k · bundle
trailofbits wycheproof
Validate cryptographic implementations against known attacks and edge cases using Wycheproof test vectors.
6k · bundle
trailofbits yara-rule-authoring
Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.
6k · bundle
trailofbits seatbelt-sandboxer
Generates minimal macOS Seatbelt sandbox configurations to isolate and restrict applications with allowlist-based profiles.
6k · bundle
trailofbits differential-review
Performs security-focused differential review of code changes (PRs, commits, diffs), adapting analysis depth to codebase size and generating comprehensive markdown reports.
6k · bundle
trailofbits harness-writing
Write effective fuzzing harnesses across languages to improve code coverage and find bugs in your system under test.
6k · bundle
trailofbits dimensional-analysis
Orchestrates a dimensional-analysis pipeline to annotate codebases with unit/dimension comments, discover dimensional vocabulary, and detect arithmetic bugs from unit mismatches or precision loss.
6k · bundle
trailofbits entry-point-analyzer
Identifies state-changing entry points in smart contract codebases for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.
6k · bundle
trailofbits firebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.
6k · bundle
trailofbits semgrep-rule-creator
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.
6k · bundle
trailofbits coverage-analysis
Measures code coverage during fuzzing to assess harness effectiveness and identify fuzzing blockers.
6k · bundle
trailofbits fuzzing-obstacles
Patch code to bypass checksums, global state, and validation checks that block fuzzer progress, using conditional compilation for C/C++ and Rust.
6k · bundle
trailofbits fuzzing-dictionary
Guides fuzzers with domain-specific tokens to reach deeper code paths in parsers, protocol handlers, and file format processors.
6k · bundle
trailofbits guidelines-advisor
Analyzes smart contract codebases against Trail of Bits' secure development guidelines, generating documentation, reviewing architecture and upgradeability patterns, assessing implementation quality, identifying pitfalls, and providing prioritized recommendations.
6k · bundle
trailofbits constant-time-analysis
Analyzes cryptographic code to detect operations that leak secret data through execution timing variations, supporting multiple languages.
6k · bundle
trailofbits constant-time-testing
Detect timing side channels in cryptographic code using formal, symbolic, dynamic, and statistical testing tools.
6k · bundle
trailofbits audit-prep-assistant
Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.
6k · bundle
trailofbits secure-workflow-guide
Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.
6k · bundle
trailofbits spec-to-code-compliance
Verifies that blockchain code implements exactly what documentation specifies, identifying gaps between specs and implementation for audit engagements.
6k · bundle
trailofbits code-maturity-assessor
Assesses codebase maturity using Trail of Bits' 9-category framework, producing a professional scorecard with evidence-based ratings and actionable recommendations.
6k · bundle
trailofbits testing-handbook-generator
Generates Claude Code skills from the Trail of Bits Testing Handbook for security testing tools and techniques.
6k · bundle
trailofbits ton-vulnerability-scanner
Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.
6k · bundle
trailofbits supply-chain-risk-auditor
Audits project dependencies for supply chain risks including single maintainers, unmaintained packages, low popularity, high-risk features, past CVEs, and missing security contacts.
6k · bundle
trailofbits token-integration-analyzer
Analyzes token implementations and integrations for ERC20/ERC721 conformity, weird token patterns, contract composition, owner privileges, and on-chain scarcity.
6k · bundle
trailofbits cosmos-vulnerability-scanner
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities such as chain halts, fund loss, and state divergence.
6k · bundle
trailofbits solana-vulnerability-scanner
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
6k · bundle
trailofbits algorand-vulnerability-scanner
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues.
6k · bundle
trailofbits substrate-vulnerability-scanner
Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.
6k · bundle
bankrbot veil
Deposit, withdraw, and transfer ETH or USDC privately on Base using Veil Cash's ZK privacy pools, with key management and Bankr integration for signing.
1.2k · bundle
bankrbot 1claw
Store and retrieve API keys, passwords, and credentials in an HSM-backed encrypted vault via MCP or REST API, with policy-based access control, secret rotation, multi-chain signing, and prompt injection scanning.
1.2k · bundle
bankrbot base-node
Run a production Base node with Reth client — hardware sizing, port configuration, snapshot bootstrapping, security hardening, and sync monitoring.
1.2k · bundle
bankrbot blueagent-x402
Access 31 pay-per-use tools for quantum security, agent safety, research, data, and earn on Base, paid via x402 protocol.
1.2k · bundle
bankrbot polygraph
Assigns behavioral trust grades (A–F) to MCP servers by running probes for prompt injection, permission overreach, data leaks, and adversarial-input handling, and publishes reproducible onchain attestations.
1.2k · bundle
bankrbot sleuth-ai
Investigate tokens, wallets, and on-chain entities with natural-language answers backed by on-chain data. Detect insiders, whales, pump-and-dump, wash trading, and wallet networks on Base.
1.2k · bundle
bankrbot b20-console
Inspect B20 token contract addresses on Base to verify factory recognition, initialization, policies, pause state, and risk flags via the public B20 Console API.
1.2k · bundle
bankrbot qa-checklist
Pre-ship audit checklist for Ethereum dApps covering wallet connection, button flows, contract verification, branding, RPC config, and mobile deep linking.
1.2k · bundle
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include veil, cargo-fuzz, yara-rule-authoring. Rankings shift as installs change; sort this page by "Most downloaded" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds add <owner>/<name>, or copy the file into your agent's skills directory.