Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
noorqureshi Skill Code Review RustSecurity review of Rust code — where a memory-safe language still has real bugs: `unsafe`, FFI, panics, and the usual injection/logic sinks. Load when reviewing Rust source/PR, on .rs / Cargo.toml in scope, or "review this Rust". Signals: Cargo.toml, unsafe blocks, extern "C", unwrap/expect, actix/axum/rocket handlers.
- noorqureshi Skill Exploit Chaining
Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.
- noorqureshi Skill Code Review Nodejs
Security review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
- noorqureshi Skill Code Review Python
Security review of Python code — dangerous sinks and framework-specific pitfalls (Django/Flask/ FastAPI). Load when reviewing a Python codebase/PR, on .py source in scope, or "review this Python". Signals: requirements.txt/pyproject, Django/Flask/FastAPI, ORMs, pickle/yaml, subprocess.
- noorqureshi Skill Defense Threat Hunting
Hunt for intrusions no alert fired on — hypothesis-driven, ATT&CK-guided searching across EDR and logs. Load for "threat hunt", "are we compromised", "hunt for <technique>", proactive blue-team work, or turning threat intel into a hunt. Complements detection engineering: hunts find the gaps, then become detections.
- noorqureshi Skill Code Review Solidity
Security review of Solidity / EVM smart contracts — reentrancy, access control, arithmetic, and DeFi economic bugs. Load when reviewing a smart contract / web3 codebase or PR, on .sol source in scope, or "audit this contract". Signals: *.sol, foundry/hardhat, ERC-20/721, external calls, delegatecall, proxy patterns, price oracles.
- noorqureshi Skill Social Eng Methodology
Plan and run an AUTHORIZED social-engineering assessment safely — the load-first guardrails for any human-factor test. Load before any phishing, vishing, pretext, or physical work. Signals: "social engineering", "phishing assessment", "test our employees", "security awareness", a human-factor objective in a pentest SoW. Establishes authorization, safety, tracking, and the awareness-focused report.
- noorqureshi Skill Crypto Oracle Attacks
Break weak symmetric crypto in real apps — decrypt or forge encrypted tokens/cookies without the key via padding oracles (CBC), ECB block shuffling, and hash-length-extension of homemade MACs. Load when the app hands you ciphertext you can tamper with and resend: an encrypted cookie/token, a "state"/"data" blob, an IV+ciphertext, a `H(secret‖msg)` signature, base64 that changes on edit.
- noorqureshi Skill Code Review Methodology
Systematic manual source-code security review — how to find bugs by reading code. Load on "review this code/repo", a source-available target, whitebox testing, or auditing a PR/app for vulnerabilities. Signals: a codebase in scope, "SAST", "secure code review", a language repo.
- noorqureshi Skill Exploit Poc Development
Turn a known/1-day vulnerability or a raw bug into a working, reliable PoC for an authorized target. Load when a CVE/advisory needs weaponizing, a public PoC needs adapting, or "write an exploit/PoC". Signals: a versioned service with a known CVE, a crash/primitive to develop, searchsploit hits.
- noorqureshi Skill Exploit Memory Corruption
Turn a memory-corruption bug in a native binary into code execution — stack overflows, format strings, and ROP against modern mitigations. Load when you control input to a compiled program and it crashes or misbehaves: a network daemon, a thick client, a setuid/SUID helper, or extracted firmware. Signals: segfault on long/`%n` input, a crash with control of a register, no source, checksec output, "exploit this binary/service".
-
openharmonyinsight Skill Openharmony Security ReviewUse when reviewing OpenHarmony C++ system service code for security vulnerabilities, particularly IPC handlers, multithreaded components, or code handling sensitive user data
- openharmonyinsight Skill AI Generated Business Code Review
Use when reviewing or scoring AI-generated business/application code quality in any language, especially when a numeric score, risk level, or must-fix checklist is requested, or when C++ code must comply with OpenHarmony C++ and security standards
- openharmonyinsight Skill Oh Arkruntime Thread Safety Audit
Use this skill when auditing, reviewing, or fixing thread-safety issues in ArkCompiler Runtime Core, especially ArkTS-Sta ETS stdlib and plugin code under static_core/plugins/ets. It covers static mutable state, singleton initialization, shared maps/caches/counters/timers, taskpool/EAWorker concurrency, TSAN follow-up, and concurrent test design.
- openharmonyinsight Bundle Oh Distributed Security Design Review
OpenHarmony分布式系统安全代码检视专用技能。当用户要求"检视代码安全实现"、"代码安全审查"、"安全代码review"或类似的分布式系统代码安全检视请求时触发。此技能提供18条OpenHarmony分布式业务安全设计规则的详细检视指导，涵盖授权控制、状态机、数据传输、权限管理、可信关系等安全领域。使用此技能可在通用网络安全规则基础上，针对OpenHarmony分布式系统进行专项安全检视。
- openharmonyinsight Bundle Arkweb Security Patch Risk
Assess residual risk after ArkWeb security patch merge, review, and build verification.
- openharmonyinsight Bundle Arkweb Security Patch Build
This skill should be used when the user asks to "编译 ArkWeb", "build ArkWeb", "执行 ArkWeb 编译", "验证 ArkWeb 构建", "排查 ArkWeb build.log", "分析 ArkWeb 编译失败", or mentions build_arkweb.sh, src/out/product/build.log, ArkWeb native or browser build targets, or incremental ArkWeb build verification. Handles command selection, incremental build execution, success verification, and build.log-first failure diagnosis for ArkWeb projects.
Audited - openharmonyinsight Bundle Arkweb Security Patch Fetch
Fetch and normalize the exact upstream Chromium security patch for ArkWeb integration.
- openharmonyinsight Bundle Arkweb Security Patch Judge
Judge ArkWeb state-machine step outputs and produce strict verdict JSON for state transitions.
- openharmonyinsight Bundle Arkweb Security Patch Merge
Apply upstream Chromium patches into ArkWeb with deterministic patch normalization, batch planning, issue-scoped diff checks, and controlled manual merge fallback.
- openharmonyinsight Bundle Arkweb Security Patch Impact
Determine whether ArkWeb M144 or configured baseline is affected by an upstream Chromium vulnerability.
- openharmonyinsight Bundle Arkweb Security Patch Intake
Parse ArkWeb security issue inputs such as CVE, Chromium bug, Gerrit CL, PR, and advisory links into an auditable vulnerability intelligence report.
- openharmonyinsight Bundle Arkweb Security Patch Report
Produce final ArkWeb archive or auto merge report from workflow outputs.
- openharmonyinsight Bundle Arkweb Security Patch Review
Review merged ArkWeb security patches for correctness, vulnerability coverage, and regression risk.
- openharmonyinsight Bundle Arkweb Security Patch Conflict
Resolve ArkWeb patch merge conflicts while preserving upstream security fix intent.
- openharmonyinsight Bundle Arkweb Security Patch Gitcode Pr
Submit ArkWeb Chromium security patches to GitCode with oh-gc: commit only intended patch files, push to a personal fork branch, create or confirm a GitCode Issue, create a PR to the configured upstream repo, and verify the PR is linked to the GitCode Issue. Use for ArkWeb security patch upstream submission after merge/apply analysis.
- openharmonyinsight Skill Arkweb Expert Interaction Security
Web 领域交互安全专家。关注 XSS/CSRF 防护、CSP 策略、CORS、权限模型、内容安全等。作为专家团成员参与 ArkWeb 需求头脑风暴讨论。
-
zhaoxuya520 Bundle Security Report安全报告输出时使用。适用于安全评审报告 / 漏洞汇总 / 风险等级 / 修复跟踪。融合 CVSS 评分 + 修复建议 + 验证确认。
12.8k - zhaoxuya520 Bundle Threat Modeling
威胁建模时使用。适用于新功能 / 新系统的安全设计评审。融合 STRIDE + Attack Tree + Microsoft SDL。
12.8k -
vivy-yi Skill Audit Evidence Collection审计资料收集 — 按审计要求收集 [ERP]/[DOC] 资料，完成资料清单编制与核对。 适用情形：审计进场准备时执行，从 [ERP]/[DOC] 获取资料， 按审计资料清单整理，核查完整性，输出资料收集报告。 核心：清单核对 + 缺失识别 + 替代方案 + 按时交付。
- vivy-yi Skill Audit Committee Support
审计委员会支持 — 为审计委员会提供专业支持，包括审计计划审阅、 审计发现跟踪、审计报告审阅和委员会议程管理。 适用情形：审计委员会会议前 [X] 天，或用户要求"准备 AC 材料"时执行。 核心：审计发现汇总 + 整改追踪 + 委员会议程设计。
- vivy-yi Skill Process Compliance Audit
流程合规性审计 — 对具体业务循环（采购/销售/资金/税务等） 执行穿行测试和控制测试，识别控制缺陷和合规问题。 适用情形：审计人员执行现场审计、编写审计工作底稿时执行。
-
coco-research Bundle Pmstudio NfrDetailed completeness audit of all project documents. Use when someone asks "are we ready for production", "audit our docs", "readiness check", "nfr tracker", or "what's missing". Do NOT use for a quick command listing — use /pmstudio instead. Scans every document for section-level completeness, reports staleness, and gives prioritized gap-closure recommendations.
- coco-research Skill Gsd Code Review
Review source files changed during a phase for bugs, security issues, and code quality problems
-
peterbamuhigire Bundle 30 Game Delivery Evidence And Greenlight PackUse when assembling or reviewing game greenlight, milestone, release, rights, security, player-research, build, test, live-operations, and independent-replication evidence without inflating capability claims.
-
eugenelim Bundle Security Checklists ReferenceRoute into the compiled OKF bundle `security-checklists` using generated indexes.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include pmstudio-nfr, code-review-rust, exploit-chaining. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.