Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle GRAPHQL Architect 8Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 6
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Websocket 2
Real-time bidirectional communication with security focus on CSWSH prevention, authentication, and message validation Use when this capability is needed.
- tomevault-io Bundle GRAPHQL Architect 9
Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 7
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
- tomevault-io Bundle Code Review And Quality 4
Review code, tests, documentation, and configuration across correctness, readability, architecture, security, performance, maintainability, and verification before merging or handing off a change. Use when this capability is needed.
- tomevault-io Bundle Ruff 2
This skill should be used when users need to lint, format, or validate Python code using the Ruff command-line tool. Use this skill for tasks involving Python code quality checks, automatic code formatting, enforcing style rules (PEP 8), identifying bugs and security issues, or modernizing Python code. This skill should be invoked PROACTIVELY whenever Python code is written or modified to ensure code quality. Use when this capability is needed.
- tomevault-io Bundle API Security 4
Use when implementing API authentication, authorization, or security patterns. Covers OAuth 2.0, OIDC, JWT, API keys, rate limiting, and common API security vulnerabilities.
- tomevault-io Bundle Code Review 309
Provides a structured code review checklist. Use when reviewing code, scripts, or IaC files. Covers correctness, security, error handling, performance, and infrastructure as code.
- tomevault-io Bundle Security Audit 16
Audit code and dependencies for security vulnerabilities. Use when reviewing PRs, checking dependencies, preparing for deployment, or when user mentions security, vulnerabilities, or audit. Use when this capability is needed.
- tomevault-io Bundle Senior Backend 9
This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Use for Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns. Use when this capability is needed.
- tomevault-io Bundle Documentation Audit 2
Audit project documentation against an opinionated baseline spanning onboarding, architectural/decision docs, code-level docs, and operational documentation with drift detection. Static-first with optional --with-link-check. Optionally generates an implementation plan for the gaps. Use when this capability is needed.
- tomevault-io Bundle Code Review Checklist 9
Comprehensive checklist for conducting thorough code reviews covering functionality, security, performance, and maintainability Use when this capability is needed.
- tomevault-io Bundle Nodejs Best Practices 4
Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying. Use when this capability is needed.
- tomevault-io Bundle Parallel Code Review 2
This skill should be used when performing comprehensive code reviews using multiple specialized review agents in parallel. It provides patterns for concurrent execution, decision tracking to prevent redundancy, and consolidated reporting. Use when needing thorough review coverage from multiple perspectives (security, architecture, performance) or when reviewing large changesets. Use when this capability is needed.
- tomevault-io Bundle Django Perf Review 7
Django Performance Review workflow skill. Use this skill when the user needs Django performance code review. Use when asked to \"review Django performance\", \"find N+1 queries\", \"optimize Django\", \"check queryset performance\", \"database performance\", \"Django ORM issues\", or audit Django code for performance problems and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off. Use when this capability is needed.
- tomevault-io Bundle Reverse Engineering Tools 2
Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks, protected binaries, or debugging security-sensitive game components. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 11
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Reviewer 7
Activate when reviewing code, before committing, after committing, or before merging a PR. Activate when user asks to review, audit, check for security issues, or find regressions. Analyzes code for logic errors, regressions, edge cases, security issues, and test gaps. Fixes findings AUTOMATICALLY. Required at process skill quality gates. Use when this capability is needed.
- tomevault-io Bundle Security Sentinel 2
Specialized knowledge in web security, vulnerability assessment, and safe coding. Use when this capability is needed.
- tomevault-io Bundle GRAPHQL Architect 13
Use when a task needs GraphQL schema evolution, resolver architecture, federation design, or distributed graph performance/security review.
- tomevault-io Bundle Security Best Practices 12
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Security Review 26
Perform structured smart-contract security reviews of implemented Solidity code with actionable findings and remediation guidance. Use for security-sensitive changes, audit prep, or final review. Use when this capability is needed.
- tomevault-io Bundle Code Auditor 2
Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check. Use when this capability is needed.
- tomevault-io Bundle Update Adr Inventory 2
Update the ADR inventory table in docs/adrs/README.md by scanning all adr-*.md files, extracting their title, status, and date. Use when a new ADR is added or an existing ADR's status or title has changed. Use when this capability is needed.
- tomevault-io Bundle Code Review Security 2
Run security-focused code review when changes cross trust boundaries or may affect authentication, authorization, input validation, secrets handling, or sensitive-data exposure. Use for merge decisions requiring explicit security findings; do not use for non-security-only review scope. Use when this capability is needed.
- tomevault-io Bundle Reviewing Code 9
Provides concise, focused code reviews matching exact task complexity requirements. Use when reviewing code quality, security, or when the user asks for code review.
- tomevault-io Bundle Springboot Security 2
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when this capability is needed.
- tomevault-io Bundle Tech Debt Analyzer 2
This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation. Use when this capability is needed.
- tomevault-io Bundle Python Standards 3
Audits Python code for language standards — PEP 8 style, type hints (PEP 484/604), naming, idiomatic patterns, project structure, dependencies, error handling, logging, testing, security. Use when this capability is needed.
- tomevault-io Bundle Security And Hardening 2
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. OWASP-aware, language-agnostic principles with TypeScript examples — applies to any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 13
Security best practices, OWASP guidelines, secure coding patterns, and vulnerability prevention. Use when implementing authentication, handling user input, securing APIs, managing secrets, or reviewing code for security vulnerabilities. Use when this capability is needed.
- tomevault-io Bundle Security Review 28
Perform a security architecture review with Zero Trust assessment - identifies authentication/authorization gaps, data protection issues, and provides remediation guidance Use when this capability is needed.
- tomevault-io Bundle Threat Modeling 2
Threat modeling methodologies (STRIDE, DREAD), attack trees, threat modeling as code, and integration with SDLC for proactive security design Use when this capability is needed.
- tomevault-io Bundle Fastapi Expert 12
Expert FastAPI developer specializing in production-ready async REST APIs with Pydantic v2, SQLAlchemy 2.0, OAuth2/JWT authentication, and comprehensive security. Deep expertise in dependency injection, background tasks, async database operations, input validation, and OWASP security best practices. Use when building high-performance Python web APIs, implementing authentication systems, or securing API endpoints. Use when this capability is needed.
- tomevault-io Bundle Django Perf Review 8
Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include graphql-architect, security-best-practices, websocket. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.