Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
h3y6e Skill Writing GuidelinesReview docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
- h3y6e Bundle Adopt Better Result
Adopt better-result in an existing TypeScript codebase. Use for a repository-wide error-handling audit and proposal, or for implementing a named vertical slice with TaggedError and Result.
- h3y6e Skill Security And Hardening
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
- h3y6e Skill Doubt Driven Development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
-
ricneves-ai Skill Security Pen TestingUse quando o usuário pedir para realizar auditorias de segurança, testes de penetração, varredura de vulnerabilidades, verificações OWASP Top 10 ou avaliações de segurança ofensiva. Cobre análise estática, varredura de dependências, detecção de segredos, testes de segurança de API e geração de relatórios de pen test.
- ricneves-ai Skill Information Security Manager Iso27001
Implementação de ISMS ISO 27001 e governança de cibersegurança para empresas HealthTech e MedTech. Use para design de ISMS, avaliação de riscos de segurança, implementação de controles, certificação ISO 27001, auditorias de segurança, resposta a incidentes e verificação de conformidade. Cobre ISO 27001, ISO 27002, segurança em saúde e cibersegurança de dispositivos médicos — com foco no mercado brasileiro.
- h3y6e Bundle Gke Basics
Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, configuring Workload Identity, or deciding between Autopilot and Standard modes. Don't use for specialized GKE networking (use gke-networking), advanced security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).
-
mattakushi432 Skill Rust SecurityWhen to activate: Rust security, unsafe code, input validation, secret handling, cryptography, supply chain, audit, injection prevention
- mattakushi432 Skill Content Engine
When to activate: content calendar, content strategy, editorial planning, content repurposing, content briefs, distribution strategy, content audit
- mattakushi432 Skill Linux Patterns
When to activate: Linux, systemd, cron, shell, process management, networking, performance tuning, security hardening, ufw, fail2ban
- mattakushi432 Skill Swift Security
When to activate: Keychain, certificate pinning, encryption, biometrics, secure storage, App Transport Security in Swift
- mattakushi432 Skill Appsec Patterns
When to activate: AppSec, application security, secure SDLC, security champions, threat modeling sprint, security requirements, secure code review
- mattakushi432 Skill Database Design
When to activate: schema design, normalization, ERD, soft delete, temporal tables, audit log, database modeling
- mattakushi432 Skill Owasp Checklist
When to activate: OWASP, security checklist, injection, XSS, IDOR, SSRF, security misconfiguration, vulnerability
- mattakushi432 Skill Security Review
When to activate: security review, SAST, static analysis, Semgrep, Bandit, CodeQL, dependency audit, secrets detection, vulnerability triage, AppSec
- mattakushi432 Skill Spring Security
When to activate: Spring Security, authentication, authorization, OAuth2 resource server, custom filters, UserDetailsService, security context
- mattakushi432 Skill Threat Modeling
When to activate: threat modeling, STRIDE, PASTA, attack tree, DFD, security design review, threat analysis
- mattakushi432 Skill Bundler Patterns
When to activate: Bundler, Gemfile, Gemfile.lock, pessimistic version operator, bundle groups, bundle audit, gemspec, private gem sources, Ruby dependency management
- mattakushi432 Skill Customer Journey
When to activate: customer journey mapping, touchpoint audit, moments of truth, experience map, persona journey, friction analysis, CSAT by stage, NPS by stage
- mattakushi432 Skill Network Security
When to activate: network security, firewall rules, VPC security groups, NACLs, WAF, DDoS protection, VPN, network segmentation, zero trust network
- mattakushi432 Skill Pentest Patterns
When to activate: penetration testing, pentest, OWASP testing, Burp Suite, web vulnerabilities, SQLi, XSS, IDOR, security assessment, ethical hacking
- mattakushi432 Skill Audit Preparation
When to activate: audit preparation, audit readiness, evidence collection, control documentation, auditor management, compliance audit, SOC audit, ISO audit, external audit
- mattakushi432 Skill Composer Patterns
When to activate: Composer, composer.json, composer.lock, PSR-4 autoloading, semantic versioning constraints, dev dependencies, composer audit, private package repositories, PHP dependency management
-
poly-gents Bundle DatadogQueries Datadog monitors, metrics, logs, and dashboards via connected integration. Use when investigating alerts, APM traces, log patterns, or security signals in Datadog.
- poly-gents Bundle Track Risks
Maintain and prioritize the security risk register
- poly-gents Bundle Audit Content
Review content performance and suggest improvements
- poly-gents Bundle Audit Controls
Review security controls against compliance frameworks
- poly-gents Bundle Gather Evidence
Collect audit evidence for SOC2, ISO, and other standards
- poly-gents Bundle Threat Modeling
Performs STRIDE-style threat modeling on features and systems with ranked mitigations and residual risk. Use before shipping new surfaces, auth flows, or third-party integrations.
- h3y6e Skill Maintain Verification Skill
Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".
-
aeondave Skill 1337Mode: /1337 - structured operator behaviour for coding and security; forces explicit reasoning, fast decisions, todos/lists, exact terms, evidence, verification, safety override.
Audited - aeondave Skill Cve Search
Enumerate CVEs for a vulnerability class, find credible public PoC references with GitHub preferred, verify collected URLs, and write structured Markdown evidence for downstream use. Use when asked to build or refresh a CVE list, PoC tracker, exploit reference sheet, or vulnerability-type digest from public sources.
Audited - aeondave Bundle Web Ctf
Lab/CTF: web challenges; HTTP apps, APIs, browser clients, auth, uploads, SSRF, XSS, SQLi, SSTI, XXE, deserialization, smuggling.
- aeondave Bundle Zap
Auth/lab ref: OWASP ZAP: free open-source web application scanner and intercepting proxy.
- aeondave Bundle Systematic Debugging
Root-cause-first debugging workflow for software, exploit tooling, fuzzing harnesses, reverse-engineering helpers, C2/client code, flaky tests, crashes, races, and environment-specific failures. Use when a failure is not immediately obvious or when repeated quick fixes risk hiding the real defect.
- aeondave Bundle Hypothesis Driven
Investigation discipline for extremely complex problems where the root cause, exploit path, or solution is unknown: hard bugs, flaky systems, CTF challenges, reverse engineering puzzles, incident triage, multi-system failures, and research questions backed by data. Forces explicit hypothesis generation, falsifiable predictions, prioritized experiments, and evidence-based iteration instead of trial-and-error patching or confirmation-biased reasoning. Use when symptoms are far from causes, when guesses keep failing, or when a problem spans tools, layers, or unknowns that defeat linear debugging.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include writing-guidelines, adopt-better-result, security-and-hardening. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.