Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle AI Review 2Review code changes with focus on AI best practices and security Use when this capability is needed.
- tomevault-io Bundle Sync 2
Audit and align AI documentation with the actual state of the codebase. Use when documentation feels stale, after significant refactoring, periodically at sprint boundaries, or when AI assistance seems to follow outdated patterns. Use when this capability is needed.
- tomevault-io Bundle Healthcheck 12
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS). Use when this capability is needed.
- tomevault-io Bundle Security 20
Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities. Use when this capability is needed.
- tomevault-io Bundle Convex Performance Audit 3
Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI updates are costly, functions hit execution or transaction limits, or the user mentions performance, latency, read amplification, or invalidation problems in a Convex app. Use when this capability is needed.
- tomevault-io Bundle Convex Performance Audit 4
Audits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification. Use when this capability is needed.
- tomevault-io Bundle API Security 3
1. Broken Object Level Authorization (BOLA) - API fails to validate user Use when this capability is needed.
- tomevault-io Bundle Github Actions 10
GitHub Actions workflow security, performance optimization, and best practices Use when this capability is needed.
- tomevault-io Bundle Code Review 251
Security-focused code review before committing Use when this capability is needed.
- tomevault-io Bundle Code Review 252
Systematic code review guidance covering correctness, maintainability, security, and performance. Activates for PR reviews and code quality checks. Use when this capability is needed.
- tomevault-io Bundle Owasp Top 10 2
Use when working with the OWASP (Open Web Application Security Project) Top 10 is a standard
- tomevault-io Bundle Code Reviewer 43
Language-agnostic code review. Checks correctness, security, and consistency with project conventions. Triggers on "review this", "review [file]", "check this code", "code review". Use when this capability is needed.
- tomevault-io Bundle Go Standards 2
Go coding standards with MUST/SHOULD/CAN severity. Enforces idiomatic Go, error handling, concurrency safety, testing, and security. Reference for all Go code in Raven. Use when this capability is needed.
- tomevault-io Bundle Github Operations 2
Repository management through Git CLI and GitHub API with branch protection, commit conventions, and security controls Use when this capability is needed.
- tomevault-io Bundle Django Verification 2
Verifies Django projects with migrations, linting, coverage-backed tests, security scans, and deployment-readiness checks. Use when this capability is needed.
- tomevault-io Bundle Secure Coding 2
Incorporating security at every step of software development – writing code that defends against vulnerabilities and protects user data. Use when this capability is needed.
- tomevault-io Bundle Security Review 17
Run an OWASP-focused security analysis on code changes. Use when this capability is needed.
- tomevault-io Bundle Spring Boot 2
Spring Boot 3.x - Java framework for production-ready applications with dependency injection, REST APIs, data access, security, and actuator monitoring Use when this capability is needed.
- tomevault-io Bundle V4 Security Foundations 2
Security-first Uniswap V4 hook development. Use when user mentions "v4 hooks", "hook security", "PoolManager", "beforeSwap", "afterSwap", or asks about V4 hook best practices, vulnerabilities, or audit requirements. Use when this capability is needed.
- tomevault-io Bundle Find Bugs 4
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch. Use when this capability is needed.
- tomevault-io Bundle Caching Strategy 2
Use when designing or auditing a caching architecture. Covers multi-layer cache hierarchy, key schema, TTL policies, invalidation flows, and warming strategies. Do not use for runtime performance profiling (use performance-audit) or capacity planning (use load-modeling).
- tomevault-io Bundle Code Review 245
Reviews C# code for bugs, security issues, and best practices. Use when this capability is needed.
- tomevault-io Bundle Authentication 2
Load PROACTIVELY when task involves user identity, login, or access control. Use when user says \"add authentication\", \"set up login\", \"add OAuth\", \"protect these routes\", \"implement RBAC\", or \"add sign-up\". Covers session management, JWT tokens, OAuth2 flows, password reset, email verification, protected route middleware, role-based access control, and security hardening (CSRF, rate limiting, token rotation). Use when this capability is needed.
- tomevault-io Bundle Code Reviewer 46
6-aspect structured code review (security, architecture, error handling, test gaps, type safety, simplification) with calibrated scoring and per-aspect breakdown. Use when the user asks to review code, check a PR, review a pull request, audit changes before merge, or give code feedback. Use when this capability is needed.
- tomevault-io Bundle Skill Check 2
Validate Claude Code skills against Anthropic guidelines. Use when user says "check skill", "skillcheck", "validate SKILL.md", or asks to find issues in skill definitions. Covers structural and semantic validation. Do NOT use for anti-slop detection, security scanning, token analysis, or enterprise checks; use skill-check-pro for those. Use when this capability is needed.
- tomevault-io Bundle Docs Check 4
Rigorous quality gate for documentation before merge or publish. Verifies code examples run, links resolve, APIs match implementation, and all sections are complete. Use when auditing docs, reviewing documentation PRs, or when "verify", "quality gate", "docs audit", or "check examples" is mentioned. Use when this capability is needed.
- tomevault-io Bundle Dependency Doctor 2
Audits project dependencies for outdated packages, duplicates, heavy/problematic libraries, security vulnerabilities, and risky version combinations. Generates prioritized reports with security, performance, and maintainability insights, upgrade paths, and safe pinning recommendations. Use when users request dependency audits, package updates, security checks, or dependency optimization. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 2
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Audit Context Building 2
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
- tomevault-io Bundle Security Review 19
Run a comprehensive security review on code Use when this capability is needed.
- tomevault-io Bundle Code Review 260
Code review mode - comprehensive review with security, performance, and maintainability focus Use when this capability is needed.
- tomevault-io Bundle Security 21
Apply when code handles untrusted input, authentication, authorization, cryptography, secrets, or crosses a trust boundary. Trigger on mentions of security review, threat modeling, vulnerabilities, injection, XSS, CSRF, SSRF, auth, secrets management, or hardening. Extends the defensive-programming skill's boundary validation with adversary-aware techniques. Language-specific vulnerability patterns are in references/. Use when this capability is needed.
- tomevault-io Bundle Stride Analysis Patterns 2
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. Use when this capability is needed.
- tomevault-io Bundle Code Review 261
Use immediately after writing code, before committing. Check quality, security, performance, and maintainability. Catch bugs and anti-patterns. | 写完代码后立即使用，检查质量/安全/性能/可维护性。 Use when this capability is needed.
- tomevault-io Bundle Hook Authoring 2
Guide for creating Claude Code hooks with security-first design. Use for validation, logging, and policy enforcement. Use when this capability is needed.
- tomevault-io Bundle Review Code 12
Multi-dimensional code review with structured reports. Analyzes correctness, readability, performance, security, testing, and architecture. Triggers on "review code", "code review", "审查代码", "代码审查". Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include ai-review, sync, healthcheck. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.