Security

Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.

goldziher Skill

Ruby Conventions

Ruby code conventions covering Ruby 3.2+, RuboCop, RBS type checking, RSpec/Minitest, security scanning, exception handling, composition, Bundler, and gem packaging. Load when writing or reviewing Ruby code.

Sep 17
goldziher Skill

Rust Conventions

Rust code conventions covering edition 2024, cargo fmt/clippy, Result-based error handling, unsafe discipline, async with tokio, API-guideline naming, trait implementations, benchmarking, and security scanning. Load when writing or reviewing Rust code.

Sep 17
goldziher Skill

Csharp Conventions

C# code conventions covering .NET 8+/C# 12, nullable reference types, Roslyn analyzers, xUnit, record types, async/await discipline, and dependency security. Load when writing or reviewing C# code.

Sep 17
goldziher Skill

Elixir Conventions

Elixir code conventions covering Elixir 1.14+/OTP 25+, pattern matching, mix format, Credo/Dialyzer, ExUnit, ExDoc, OTP process patterns, and dependency security. Load when writing or reviewing Elixir code.

Sep 17
goldziher Skill

Python Conventions

Python code conventions covering type hints, Ruff formatting/linting, mypy/pyright, pytest, async I/O, uv packaging, and dependency security scanning. Load when writing or reviewing Python code.

Sep 17
goldziher Skill

Dependency Awareness

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable, mix_audit). Load when adding, updating, or auditing project dependencies, wiring up CI supply-chain checks, or triaging CVEs in a lock file.

Sep 17
goldziher Skill

Owasp Quick Reference

OWASP Top 10 quick reference: the ten most critical web application security risks (access control, crypto, injection, insecure design, misconfiguration, vulnerable components, auth, integrity, logging, SSRF) each with a one-line mitigation. Load when reviewing code or designs for security vulnerabilities or threat modeling.

Sep 17
goldziher Skill

Typescript Conventions

TypeScript code conventions covering strict tsconfig, ESM imports, discriminated unions, formatting/linting, Vitest testing, lockfile-based packaging, Node.js, and security. Load when writing or reviewing TypeScript code.

Sep 17
impertio-studio Bundle

Webgpu Agents Quality Validator

Use when reviewing or validating generated WebGPU or WGSL code before trusting it, or auditing a WebGPU codebase for correctness. Prevents shipping hallucinated APIs, alignment errors, missing device-loss handling, and unlabeled descriptors. Covers a category-by-category WebGPU review checklist, the consolidated anti-pattern catalog, and routing each issue to the skill that fixes it. Keywords: WebGPU code review, validate WebGPU code, audit, quality check, review WGSL, is this WebGPU code correct, hallucinated API, alignment error, checklist, what is wrong with my WebGPU code.

Sep 17
cerico Skill

Audit

Analyze npm audit results, identify actionable fixes vs noise, and recommend specific actions

Sep 17
14bryanespinoza Skill

Package Manager

Package manager rules - pnpm by default, npm as alternative, workspaces, scripts, security, monorepos, catalogs

Sep 17
f-e-u-e-r Skill

Skill Vetting Hardening Archaeology

Load before re-attempting any skill-vetting fix or design, or when reaching for a buried idea — "just add quotes / escape the name", "normpath will clean this path up", "just reject the .. case the reviewer found", "mark it equivalent / it can't be reached", "the sidecar/record proves it", "the commit message says it's fixed", "just run all the test scripts in a loop", "fixed the doc the reviewer flagged", a repro command writing under ~/.claude, editing delta_lines/anomaly_lines ordering, a fold that adds a novel algorithm, or "let me finish the D1–D5 design". Do NOT load to learn the current invariants (skill-vetting-security-invariants) or harness rules (mutation-matrix-evidence-discipline).

Sep 17
0xshe Skill

PHP Cmd Audit

PHP Web 源码命令注入审计工具。识别命令执行 Sink（exec/system/shell_exec 等），追踪用户输入进入命令拼接，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Tpl Audit

PHP Web 源码模板注入/SSTI 审计工具。识别模板引擎渲染点与模板名/表达式可控性，追踪到 eval/执行链，输出可利用性分级、PoC 与修复建议（禁止省略）。

Sep 17
0xshe Skill

PHP Xxe Audit

PHP Web 源码 XXE 审计工具。识别 XML 解析点与实体处理配置，追踪 XML 输入来源与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Yii Audit

Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。

Sep 17
0xshe Skill

PHP Auth Audit

PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。

Sep 17
0xshe Skill

PHP Crlf Audit

PHP Web 源码 CRLF/响应分割审计工具。识别用户输入进入 HTTP 响应头，分析换行/控制字符过滤与编码，输出分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Csrf Audit

PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。

Sep 17
0xshe Skill

PHP Expr Audit

PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Ldap Audit

PHP Web 源码 LDAP 注入审计工具。识别用户可控数据进入 LDAP filter/DN 构造并被 ldap_search/ldap_read 执行，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Ssrf Audit

PHP Web 源码 SSRF 审计工具。识别用户可控 URL/地址进入网络请求 Sink，追踪内网/协议/端口限制与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Deser Audit

PHP Web 源码反序列化/对象注入审计工具。识别 unserialize 注入点与可控数据来源，追踪魔术方法链，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Logic Audit

PHP Web 业务逻辑漏洞审计工具。识别认证/授权以外的逻辑缺陷：Mass Assignment、流程绕过、竞态条件、状态机缺陷、支付/权限时序漏洞等，输出证据链、分级、PoC 与修复建议（禁止省略）。

Sep 17
0xshe Skill

PHP Nosql Audit

PHP Web 源码 NoSQL 注入审计工具。识别用户输入进入 MongoDB/DocumentDB 查询构造，分析是否存在 operator 注入（$gt/$ne/$where 等），输出分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Config Audit

PHP Web 配置安全审计工具。识别 CORS/错误暴露/调试开关/安全头/危险运行时开关等，输出分级、可利用性分析、PoC 与修复建议（禁止省略）。

Sep 17
0xshe Skill

PHP Crypto Audit

PHP Web 源码加密与密钥安全审计工具。识别弱哈希/弱加密/硬编码密钥/签名校验缺陷，输出分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Laravel Audit

Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。

Sep 17
0xshe Skill

PHP Logging Audit

PHP Web 安全日志与监控审计工具。识别安全事件缺失、敏感信息写入日志、日志注入/伪造风险，以及日志与告警链路缺陷，并输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。

Sep 17
0xshe Skill

PHP Symfony Audit

Symfony 框架特效安全审计工具。针对 Symfony 常见 security.yaml、CSRF、Twig/Twig raw、表达式与访问控制等框架机制做白盒静态审计，并将风险映射到通用漏洞类型体系（AUTH/CSRF/CFG/XSS/TPL/LOGIC 等）。

Sep 17
0xshe Skill

PHP File Read Audit

PHP Web 源码任意文件读取/路径穿越审计工具。识别文件读取 Sink，追踪路径来源与校验逻辑，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP File Write Audit

PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Filesystem Audit

PHP 文件系统操作审计工具。聚焦 mkdir/chmod/chown/unlink/rmdir/link/symlink/readlink/touch/权限与 TOCTOU 等操作的安全风险，为路径校验绕过与写入链利用提供“可利用性增强证据”（不替代 FILE/UPLOAD/WRITE 等 sink 子审计）。

Audited Sep 17
0xshe Skill

PHP File Upload Audit

PHP Web 源码文件上传审计工具。识别上传入口与保存路径、文件名处理与校验逻辑，检测任意文件上传/路径穿越/可执行上传风险，输出可利用性分级、PoC 与修复建议（禁止省略）。

Audited Sep 17
0xshe Skill

PHP Exploit Chain Audit

PHP 利用链/POP(回弹)链聚合器。把已产出的各类漏洞报告按“前置条件满足”串成可利用链路叙事（不新增证据点字典）。

Audited Sep 17
0xshe Skill

PHP Open Redirect Audit

PHP Web 源码开放重定向审计工具。识别用户可控重定向目的地进入 header Location/跳转函数，分析校验与 allowlist，输出分级、PoC 与修复建议（禁止省略）。

Audited Sep 17

Frequently asked questions

What are Security agent skills?

Which Security skills are most installed?

Popular Security skills on SkillMD right now include ruby-conventions, rust-conventions, csharp-conventions. Rankings shift as installs change; sort this page by "Most installs" for the live list.

Do Security skills work with Claude Code and Cursor?

Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.