Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
ahtishamshahzad Skill Abuse PreventionUse to review whether public and expensive endpoints are protected against automated abuse — rate limiting, CAPTCHA/bot defenses, and cost controls on signup, login, reset, OTP, contact, search, and expensive operations. Verifies abuse defenses hold; distinct from authorization.
- ahtishamshahzad Skill Dashboard Permissions
Use to plan admin-dashboard permissions — admin role granularity, a permission matrix per admin action, server-side enforcement, audit logging of admin actions, impersonation safeguards, and least-privilege defaults. Builds on web-authorization for the admin surface.
- ahtishamshahzad Skill Express Foundation
Use to plan an Express API foundation after Express is approved — layered structure (routes/controllers/services/data), middleware order, config, error handler, baseline security middleware. Plans only; scaffolds nothing without task approval.
- ahtishamshahzad Skill Database Security
Use to plan database security — least-privilege credentials, network isolation, injection prevention (parameterized-only), encryption at rest/in transit, PII classification and minimization, tenant isolation at the data layer, and access auditing.
- ahtishamshahzad Skill Dashboard Architecture
Use to decide where an admin dashboard lives — inside the customer web app, as a route group, as a separate application, or in a separate repository — weighing user roles, deployment boundaries, security boundaries, team ownership, UI system sharing, and release cadence. Placement is a decision, not a default.
- ahtishamshahzad Skill Mobile Project Audit
Use when a mobile app already exists, before changing it — inventory the runtime (Expo vs CLI), navigation, state, native modules, build config, and iOS/Android readiness. Read-only; grounds mobile planning in reality. Delegates deep security/performance to their skills.
- ahtishamshahzad Skill Test Coverage Audit
Use to assess test coverage by risk, not by percentage — find untested critical paths (auth, money, data integrity, error/denial paths) and missing required cases, and recommend targeted tests. Never chase a coverage number without risk justification.
- ahtishamshahzad Skill Dependency Security
Use to assess third-party dependency risk from a security angle — known vulnerabilities, supply-chain integrity (lockfiles, pinning, provenance), typosquats/malicious packages, and CI enforcement — driving prioritized upgrades. The security lens on dependencies; dependency-audit is the general inventory.
- ahtishamshahzad Skill Environment Management
Use to plan environment configuration across dev/staging/production — one immutable artifact configured by environment, validated typed env vars (fail fast at boot), no secrets in client bundles, and parity so behavior differs only by config. Secret storage itself is secrets-management.
- ahtishamshahzad Skill Dashboard Bulk Operations
Use to plan dashboard bulk operations — selection scope (page vs all-matching-filter), explicit confirmation with counts, server-side batch endpoints, per-item permission checks, progress and partial-failure reporting, idempotency, undo where feasible, and audit logging.
- ahtishamshahzad Skill Authorization Security
Use to review authorization for security holes — IDOR/BOLA, missing ownership/tenant checks, privilege escalation, trusting client-supplied IDs/roles, and function-level access gaps — verified with negative tests. The security-review lens; backend-authorization is the design/build skill.
- ahtishamshahzad Skill Authentication Security
Use to review authentication for security weaknesses — credential storage, session/token handling, brute-force and enumeration resistance, reset/OTP/MFA flows, and logout/revocation. The security-review lens on identity; backend-authentication is the design/build skill.
- ahtishamshahzad Skill Relational Schema Design
Use to design a relational schema — entities to tables, keys, relationship modeling (1:1/1:N/M:N), constraints as integrity enforcement, appropriate types, normalization with justified denormalization, and soft-delete/audit/money conventions.
- ahtishamshahzad Skill Security Regression Testing
Use to turn security findings and threats into automated tests that stay green — negative tests for authorization/injection/abuse, a test per fixed vulnerability, and CI enforcement so security regressions can't silently return. Security's regression discipline.
-
majesticlabs-dev Skill Code ReviewReview a concrete change set for correctness, regressions, security, data risk, unnecessary complexity, and missing tests, then give evidence-backed findings or a release verdict. Use when reviewing a diff, pull request, patch, staged changes, or deciding whether code is ready to merge or ship.
- majesticlabs-dev Bundle Plan Review
Review implementation plans, PRDs, brainstorm handoffs, and feature specifications as whole delivery artifacts for implementation readiness. Use when flows, sequencing, dependencies, scope, operational risk, or verification should be challenged before handoff. Not for a dedicated requirement-statement or requirements-catalogue quality audit.
- majesticlabs-dev Skill Agents Md Hierarchy
Audit and refine scoped AGENTS.md guidance across a repository. Use only when a root AGENTS.md exists and a monorepo, multi-application project, package tree, or subsystem needs different local commands or rules.
- majesticlabs-dev Bundle Onepassword Secrets
Load and inject development, infrastructure, and deployment secrets with the 1Password CLI. Use when configuring `op run`, secret references, service accounts, CI credentials, or multi-account automation.
- majesticlabs-dev Bundle Founder Priorities
Use when a founder is overloaded or reactive, has too many priorities, asks what to cut, delegate, or defer, needs a calendar audit, or needs a daily, weekly, and monthly execution cadence.
-
zakirkun Bundle Certificate Pinning BypassDetects network configurations and code patterns that disable or bypass certificate pinning, weakening TLS security.
-
kilo-org Bundle Fastapi ItechmeatFastAPI Python framework. Covers REST APIs, validation, dependencies, security. Use when building Python web APIs with FastAPI, configuring Pydantic models, implementing dependency injection, or setting up OAuth2/JWT authentication. Keywords: FastAPI, Pydantic, async, OAuth2, JWT, REST API.
- kilo-org Bundle Prometheus Addxai
Query Prometheus monitoring metrics and alert rules. Use when the user needs to check CPU/memory/disk utilization, service health, audit alert rules, analyze capacity trends, or mentions Prometheus, PromQL, metrics monitoring, or targets.
- kilo-org Bundle Fastapi Martinholovsky
REST API and WebSocket development with FastAPI emphasizing security, performance, and async patterns
- kilo-org Bundle Databricks Unity Catalog
Unity Catalog system tables and volumes. Use when querying system tables (audit, lineage, billing) or working with volume file operations (upload, download, list files in /Volumes/).
-
jshsakura Skill ReviewerUse when a task needs PR-style review focused on correctness, security, behavior regressions, and missing tests.
- jshsakura Skill Security Auditor
Use when a task needs focused security review of code, auth flows, secrets handling, input validation, or infrastructure configuration.
- jshsakura Skill GRAPHQL Architect
Use when a task needs GraphQL schema evolution, resolver architecture, federation design, or distributed graph performance/security review.
- jshsakura Skill Security Engineer
Use when a task needs infrastructure and platform security engineering across IAM, secrets, network controls, or hardening work.
- jshsakura Skill Symfony Specialist
Use when a task needs Symfony-specific work across routing, controllers, services, Doctrine, security, and application structure.
- jshsakura Skill Ad Security Reviewer
Use when a task needs Active Directory security review across identity boundaries, delegation, GPO exposure, or directory hardening.
-
aradotso Skill Guardian AI Pentest CLIGuardian is an AI-powered penetration testing automation CLI that leverages multiple AI providers (OpenAI, Claude, Gemini) and 19+ security tools to orchestrate intelligent, step-by-step penetration testing workflows with comprehensive evidence capture.
- aradotso Skill Guardian CLI AI Pentest
AI-powered penetration testing automation CLI using Google Gemini, Claude, or GPT-4 with LangChain for intelligent security assessments
- aradotso Skill Clicd Virtualization Panel
Use CLICD to manage LXC/KVM virtualization with web console, NAT/IPv6 networking, WebSSH/VNC, resource controls, and security monitoring.
- aradotso Skill Minecraft Security Analysis
```markdown
- aradotso Skill Deltarune Chapter5 Trainer Analysis
Analyze and understand game trainer/cheat utility patterns for educational and security research purposes
- aradotso Skill Meccha Chameleon Game Trainer Analysis
Analyze and understand game trainer/cheat software patterns for security research and anti-cheat development
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include reviewer, abuse-prevention, dashboard-permissions. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.