Security

Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.

ardurai Bundle

God Security Core

God-level application and infrastructure security skill. Covers threat modeling (STRIDE, PASTA, Attack Trees), OWASP Top 10 (2021), CWE Top 25, secure design principles, zero trust architecture (NIST SP 800-207), SAST/DAST/SCA tooling, secrets management, cryptography fundamentals (correct algorithms, key sizes, modes), supply chain security (SLSA, SBOM, sigstore), container security, network security, and incident response fundamentals. The researcher-warrior never trusts any input, any system, or any assumption. Every feature is an attack surface. Use for security reviews, threat modeling, secure design, vulnerability assessment, or any security-related engineering task.

Sep 17
ardurai Bundle

God Web3 Blockchain

God-level blockchain and Web3 engineer: Solidity, EVM internals, Rust (Solana), smart contract security, DeFi mechanics (AMM, Liquidity Pools, Flash Loans), Oracles, zero-knowledge proofs, and MEV. You treat code as law, understanding that a single bug in a smart contract is a permanent, irrecoverable financial disaster. You audit before you ship. You assume every caller is adversarial.

Sep 17
rahulrajaram Bundle

Readme Doctor

Correct or audit README and CLI help against actual project behavior. Use for narrow documentation/help fixes or an explicitly requested full documentation audit; preserve the requested scope.

Sep 17
rahulrajaram Bundle

Ecosystem Borrow Audit

Audit a workspace listing and all depth-1 git repos for borrowable components, missed architectural opportunities, and integration gaps; then run independent gptengage ideate sweeps across multiple sigma values. Use when the user asks for ecosystem review, cross-repo borrowing analysis, missed-opportunity checks, or multi-sigma ideation after repo analysis.

Sep 17
reagin Bundle

Golang Swagger

Add, update, or review swaggo/swag annotations and generated OpenAPI documentation: operation contracts, schemas, security declarations, framework integration, generator wiring, and drift checks. Use when a Go API uses or deliberately selects the swaggo annotation workflow.

Sep 17
reagin Skill

Golang Stay Updated

Research current Go releases, toolchain changes, security notices, proposals, learning resources, and community updates using live sources. Use when asked what is new, whether a project is current, or how to monitor relevant changes.

Audited Sep 17
reagin Skill

Golang Popular Libraries

Compare Go libraries for a concrete requirement using current API, module, maintenance, license, security, compatibility, and operational evidence. Use when choosing a new dependency, comparing alternatives, or evaluating a replacement.

Audited Sep 17
reagin Skill

Golang Dependency Management

Add, update, remove, audit, or troubleshoot Go modules, go.mod, go.sum, tool dependencies, replace directives, vendoring, and go.work. Use for dependency selection, version conflicts, vulnerability review, or module/workspace maintenance.

Audited Sep 17
acedergren Bundle

Doc Sync

Documentation Sync Audit

Sep 17
acedergren Bundle

API Audit

API Route & Type Audit Skill

Sep 17
acedergren Bundle

Zpr Security

Use when the user asks to "configure ZPR", "debug Zero Trust Packet Routing", "write ZPL policy", "apply security attributes", or "protect OCI resources with ZPR".

Sep 17
egeetas Bundle

Code Review

Review code changes for correctness, regression, security, performance, maintainability, and test defects. Report rather than fix by default.

Sep 17
egeetas Bundle

Release Checklist

Prepare and verify general software releases across versioning, artifacts, migrations, security, smoke tests, rollout, and rollback. Use mobile-release for app stores.

Sep 17
egeetas Bundle

Security Baseline

Review designs or changes for practical security risks across trust boundaries, identity, input, secrets, data, dependencies, and deployment defaults.

Sep 17
egeetas Bundle

Repo Quality Audit

Audit a repository by running checks, finding reproducible correctness or security bugs, coordinating bounded subagents, and drafting authorized issues.

Sep 17
egeetas Bundle

Dependency Management

Evaluate, add, remove, upgrade, or audit dependencies for necessity, compatibility, vulnerabilities, licensing, reproducibility, and supply-chain risk.

Sep 17
ersinkoc Bundle

Security Check

Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase.

Sep 17
ersinkoc Skill

Sc Xss

Cross-Site Scripting detection for Reflected, Stored, and DOM-based XSS across all frameworks

Audited Sep 17
ersinkoc Bundle

Sc Lang Go

Go-specific security deep scan

Sep 17
ersinkoc Bundle

Sc Lang PHP

PHP-specific security deep scan

Sep 17
ersinkoc Skill

Sc Verifier

False positive elimination and confidence scoring for all security findings

Audited Sep 17
ersinkoc Bundle

Sc Lang Java

Java/Kotlin-specific security deep scan

Sep 17
ersinkoc Bundle

Sc Lang Rust

Rust-specific security deep scan

Sep 17
ersinkoc Skill

Sc Websocket

WebSocket security flaw detection — missing origin validation, authentication bypass, and message injection

Audited Sep 17
ersinkoc Skill

Sc Diff Report

Incremental security scan for changed files only — optimized for PR and commit-level reviews

Audited Sep 17
ersinkoc Bundle

Sc Lang Csharp

C#/.NET-specific security deep scan

Sep 17
ersinkoc Bundle

Sc Lang Python

Python-specific security deep scan

Sep 17
ersinkoc Bundle

Sc API Security

REST, GraphQL, and gRPC API security audit — authentication, authorization, data exposure, and configuration

Sep 17
ersinkoc Bundle

Sc Lang Typescript

TypeScript/JavaScript-specific security deep scan

Sep 17
ersinkoc Skill

Sc Dependency Audit

Supply chain and dependency security analysis across all package ecosystems

Audited Sep 17
hebackus Skill

Acad Database Operations

Database cloning, DeepClone, WblockClone, IdMapping, side databases, Purge, Audit

Sep 17
int2t05 Bundle

Purity Audit

Use when auditing whether code or docs read as first-written — flags tracing residue, decorative structure, dead content, doc/impl gaps, and language/platform residue against the 16-point purity checklist; produces an audit report. Triggers on "purity audit", "纯净审计", "残留审计", "洁净化" — also when user says "这些文件像改了好几遍" / "清掉历史残留". Not for syncing formal docs to code behavior (use documentation-audit) or reviewing a diff for bugs (use code-review).

Sep 17
int2t05 Bundle

Security Review

Use when reviewing changes for security — secrets, auth, injection, access control, and hardening. Triggers on "security review", "check for vulnerabilities", "安全审查", "安全审计", "漏洞检查".

Sep 17
int2t05 Bundle

Auth Implementation

Use when implementing authentication — login, sessions, JWT, OAuth2/OIDC, password hashing, and RBAC/ABAC authorization. Language-agnostic patterns for building auth correctly the first time. Triggers on "implement auth", "password hashing", "OAuth integration", "实现认证", "实现登录", "OAuth 集成", "token 轮换". Not for auditing existing auth for vulnerabilities (use security-review) or designing auth architecture at system level (use architecture).

Sep 17
irinabuht12-oss Skill

Meta Ads Audit

Meta Ads Audit

Sep 17
irinabuht12-oss Skill

Google Ads Audit

Google Ads Audit

Sep 17

Frequently asked questions

What are Security agent skills?

Which Security skills are most installed?

Popular Security skills on SkillMD right now include god-security-core, god-web3-blockchain, readme-doctor. Rankings shift as installs change; sort this page by "Most installs" for the live list.

Do Security skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.