Security

Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.

40rty-ai Skill

Shopify Admin Shipping Rate Audit

Read-only: walks every delivery profile and zone to verify each has at least one valid shipping rate, surfacing zones with no rates or only manual rates.

Audited Sep 17
40rty-ai Skill

Shopify Admin File Storage Audit

Read-only: lists every file in CDN storage, cross-references usage on products, pages, and articles, and flags orphaned/unreferenced assets.

Audited Sep 17
40rty-ai Skill

Shopify Admin Url Redirect Audit

Read-only: lists all URL redirects, flags redirect chains (A→B→C) and duplicate targets.

Audited Sep 17
40rty-ai Skill

Shopify Admin Staff Account Audit

Read-only: reviews staff accounts for stale logins, inactive status, and overpermissioned roles to surface security and access hygiene issues.

Audited Sep 17
40rty-ai Skill

Shopify Admin Cogs Completeness Audit

Read-only: identifies products and variants that are missing inventoryItem.unitCost so margin and inventory valuation reports stay accurate.

Audited Sep 17
40rty-ai Skill

Shopify Admin Email Deliverability Audit

Read-only: scans the customer database for malformed emails, role accounts, disposable domains, and bounce-suspect patterns to protect sender reputation.

Audited Sep 17
40rty-ai Skill

Shopify Admin Collection Membership Audit

Read-only: lists orphan products (in zero collections) and over-collected products for catalog hygiene.

Audited Sep 17
40rty-ai Skill

Shopify Admin Publication Channel Audit

Read-only: shows which products are published to which sales channels and flags unpublished active products.

Audited Sep 17
40rty-ai Skill

Shopify Admin Metafield Definition Audit

Read-only: enumerates every metafield definition across all owner types and flags unused, undocumented, or duplicate-key definitions.

Audited Sep 17
40rty-ai Skill

Shopify Admin Multi Location Inventory Audit

Audit inventory levels across all active locations, flagging variants where Available quantity is negative or Committed exceeds On Hand — a signal of inventory sync drift.

Sep 17
alexe-ev Bundle

Conduct AI Audit

Conduct a structured audit of an AI system or feature against responsible AI standards. Use this skill when a deployed AI feature needs to be evaluated for fairness, safety, transparency, and accountability.

Sep 17
alexe-ev Bundle

Manage Tooling Documentation

Establish or audit tooling stacks and documentation practices for product teams. Use this skill when a team's tools or documentation are creating friction or inefficiency.

Sep 17
alexe-ev Bundle

Validate Experiment Quality

Audit whether a product experiment was designed and run in a way that makes the result trustworthy. Use this skill when the user wants to check for issues such as peeking, invalid stopping logic, traffic imbalance, contamination, or other threats to validity.

Sep 17
alexe-ev Bundle

Assess Privacy Security Regulatory

Identify and assess privacy, security, and regulatory risks in product decisions and features. Use this skill when a product decision may have privacy, security, or compliance implications.

Sep 17
aradotso Skill

Design Motion Principles

Context-aware motion design skill with build and audit modes, applying three distinct philosophies from Emil Kowalski, Jakub Krehel, and Jhey Tompkins

Sep 17
coldbox Skill

Contentbox Boxlang Overview

Use this skill when understanding ContentBox architecture, core modules, service layer, multi-site behavior, security foundations, and the recommended extension points for building or maintaining ContentBox solutions.

Sep 17
coldbox Skill

Coldbox Security API Authentication

Use this skill when implementing API key authentication in ColdBox REST APIs, generating and validating API keys, caching API key lookups with CacheBox, implementing bearer token middleware, managing API key scopes and revocation, or adding an API key interceptor to protect REST endpoints.

Sep 17
coldbox Skill

Coldbox Security Passkeys

Use this skill when implementing passkeys (WebAuthn/FIDO2) passwordless authentication in ColdBox with cbsecurity-passkeys, configuring relying party settings, building passkey registration and authentication flows, managing passkey device storage, or adding biometric and hardware security key login support.

Sep 17
coldbox Skill

Coldbox Interceptor Development

Use this skill when creating ColdBox interceptors for cross-cutting concerns, listening to framework lifecycle events, implementing security checks, logging, CORS, rate limiting, request/response transformation, or firing and listening to custom interception points.

Sep 17
coldbox Skill

Contentbox Cfml Media Management

Use this skill when implementing ContentBox media workflows, including uploads, storage abstraction with cbfs, image handling/resizing, media delivery patterns, and governance/security controls for assets.

Audited Sep 17
coldbox Skill

Coldbox Security Implementation

Use this skill when setting up the full CBSecurity framework in ColdBox, configuring the security firewall, creating authentication services, implementing security event handlers, configuring security rules and validators, or building a complete security layer for a ColdBox application.

Sep 17
coldbox Skill

Contentbox Boxlang Media Management

Use this skill when implementing ContentBox media workflows, including uploads, storage abstraction with cbfs, image handling/resizing, media delivery patterns, and governance/security controls for assets.

Audited Sep 17
coldbox Skill

Contentbox Cfml Security Permissions

Use this skill when implementing ContentBox security and permissions, including roles, permission modeling, cbSecurity integration, authorization checks, CSRF/rate-limiting protections, and hardening patterns.

Sep 17
coldbox Skill

Contentbox Boxlang Security Permissions

Use this skill when implementing ContentBox security and permissions, including roles, permission modeling, cbSecurity integration, authorization checks, CSRF/rate-limiting protections, and hardening patterns.

Sep 17
mrciphersmith Skill

Code Review

Comprehensive code review with 4 parallel agents: correctness/logic, security, performance, style/maintainability. Produces unified severity report (CRITICAL/HIGH/MEDIUM/LOW). Use for thorough PR reviews and pre-merge checks.

Audited Sep 17
mrciphersmith Skill

Review Style

Use when: reviewing code for style, naming conventions, readability, and DRY violations — without touching logic, architecture, security, or performance. Covers "review style", "style review", "check naming", "check readability", or dispatched by review-orchestrator with --style flag. NOT for: logic bugs, architectural violations, security vulnerabilities, performance anti-patterns, or any finding that could cause a functional regression.

Audited Sep 17
mrciphersmith Skill

Review Clean Code

Use when: reviewing code against Clean Code principles (Uncle Bob) and SOLID at the function/class level — meaningful names, small functions, single level of abstraction, argument count, error handling, DRY, comment quality, and SOLID (SRP, OCP, LSP, ISP, DIP) as applied to individual classes and functions. Triggered by: "review clean code", "check clean code", "Uncle Bob review", "SOLID review", "review --clean-code", or dispatched by review-orchestrator. NOT for: architectural layer violations (review-architecture), naming convention formatting (review-style), logic correctness bugs (review-logic), or security (review-security-code).

Audited Sep 17
mrciphersmith Skill

Review Performance

Use when a performance review is requested, checking for N+1 queries, unnecessary re-renders, memory leaks, missing indexes, large bundle imports, and synchronous blocking in changed code. NOT for security, logic correctness, style, or architecture.

Audited Sep 17
mphaxise Skill

Frontmatter Guard

Audit and repair local brain page frontmatter before malformed pages break search, ingest, or future sync.

Sep 17
mphaxise Skill

IOS Design Review

Run a visual design audit for an iOS app using available simulator or device evidence.

Sep 17
wenerme Bundle

Powerdns Docs

Use when working with PowerDNS Authoritative Server: pdns.conf settings, backends, DNSSEC, primary/secondary operation, catalog zones, DNS UPDATE, TSIG, Lua records, HTTP API, pdnsutil, pdns_control, zone2sql, performance, upgrades, security advisories, and authoritative-server troubleshooting.

Sep 17
wenerme Bundle

Cloudflare Docs

Use when a Cloudflare question is broad or you need to choose the right Cloudflare skill. Routes to Cloudflare Workers, Data, AI, Zero Trust, Security, Networking, or Observability/Admin docs.

Sep 17
wenerme Bundle

Gitlab User Docs

Use when working with GitLab user-facing product docs: projects, groups, repositories, issues, merge requests, wikis, snippets, packages, releases, environments, application security, compliance, GitLab Duo, imports, search, permissions, profile, SSH, storage, and end-user workflows.

Sep 17
wenerme Bundle

Gitlab Admin Docs

Use when administering GitLab Self-Managed or Dedicated: installation, configuration, Admin area settings, users, auth, Geo, Gitaly, PostgreSQL, Redis, Sidekiq, object storage, backups, monitoring, logs, upgrades, instance limits, feature flags, security, and troubleshooting.

Sep 17
wenerme Bundle

Cloudflare Security

Use when working with Cloudflare security products: WAF, DDoS protection, Bot Management, API Shield, Turnstile, Rules, Ruleset Engine, firewall rules, network firewall, client-side security, challenges, DMARC, or security troubleshooting.

Sep 17
kok-o Skill

Application Security

ContextOS skill for Application Security

Audited Sep 17

Frequently asked questions

What are Security agent skills?

Which Security skills are most installed?

Popular Security skills on SkillMD right now include ios-design-review, shopify-admin-shipping-rate-audit, shopify-admin-file-storage-audit. Rankings shift as installs change; sort this page by "Most installs" for the live list.

Do Security skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.