Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
tomevault-io Bundle Audit Security 2Expert at finding security vulnerabilities in code and data. Use this to review code for secrets, check PII masking, or audit permissions. Use when this capability is needed.
- tomevault-io Bundle Wcag Audit Patterns 3
Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies. Use when this capability is needed.
- tomevault-io Bundle Gemini Delegate 3
Delegates large-context reading, bilingual or Chinese (CJK / zh-TW) drafting, cross-file synthesis, and second-opinion review to Google Antigravity CLI (`agy`) or legacy Gemini CLI. Use when input exceeds Claude's working budget, when the user writes in Chinese, when terminology must align across long documents, or when a reviewer pass is needed. Trigger phrases include "summarize this in Chinese", "second-opinion review", "long-context synthesis", "draft this in zh-TW". Avoid for bulk code generation or security-sensitive coding. Use when this capability is needed.
- tomevault-io Bundle Springboot Security 3
Spring Boot 服务的身份验证/授权、校验、CSRF、机密管理、响应头、速率限制及依赖安全的 Spring Security 最佳实践。 Use when this capability is needed.
- tomevault-io Bundle Code Reviewer 66
Reviews Java 25 and Spring Boot 4 codebases, pull requests, files, and modules for migration risks, architecture boundary violations, JSpecify null-safety issues, security flaws, performance regressions, and Spring Data pitfalls. Use when the task is a concrete Java or Spring code review with code context. Do not use for Kotlin-only code, non-Spring frameworks, or generic review advice without files or diffs. Use when this capability is needed.
- tomevault-io Bundle Senior Backend 12
Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Use when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Covers Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns. Use when this capability is needed.
- tomevault-io Bundle Code Review Assistant 6
Automated code review with PR analysis, change summaries, and quality checks. Use for reviewing pull requests, generating review comments, checking against best practices, and identifying potential issues. Includes style guide compliance, security issue detection, and review automation. Use when this capability is needed.
- tomevault-io Bundle GRAPHQL Architect 14
Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems. Use when this capability is needed.
- tomevault-io Bundle Solidity Security 4
Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns. Use when this capability is needed.
- tomevault-io Bundle Code Review 314
Review code changes for bugs, security issues, and improvements Use when this capability is needed.
- tomevault-io Bundle Documentation Audit 3
Assess documentation completeness against BetterBench/Datasheets standards Use when this capability is needed.
- tomevault-io Bundle Review Code 13
Review code changes for quality, security, and adherence to project conventions. Use after making code changes or when reviewing a pull request. Use when this capability is needed.
- tomevault-io Bundle Documentation Audit 4
This skill should be used when verifying documentation claims against codebase reality. Triggers on "audit docs", "verify documentation", "check docs", "docs accurate", "documentation drift", "before release", "after refactor", "docs don't match". Uses two-pass extraction with pattern expansion for comprehensive detection. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 14
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 15
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Dynamic Instrumentation 2
Expertise in LLVM-based dynamic binary instrumentation, runtime tracing, and program monitoring. Use this skill when implementing runtime analysis tools, code coverage systems, profilers, or dynamic security monitors. Use when this capability is needed.
- tomevault-io Bundle Nodejs Best Practices 5
Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying. Use when this capability is needed.
- tomevault-io Bundle Code Review Orchestrator 2
Triggered on pre-commit hook or when user says "code review", "review all", "quality check", "audit Use when this capability is needed.
- tomevault-io Bundle Rust Security 2
Rust security best practices and vulnerability prevention. Use when handling user input, authentication, cryptography, secrets management, network security, or conducting security reviews. Use when this capability is needed.
- tomevault-io Bundle Code Review 316
Review ServiceNow code for security vulnerabilities, performance issues, and platform best practices Use when this capability is needed.
- tomevault-io Bundle API Security Best Practices 3
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities Use when this capability is needed.
- tomevault-io Bundle Security Best Practices 20
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Use when this capability is needed.
- tomevault-io Bundle Django Perf Review 11
Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems. Use when this capability is needed.
- tomevault-io Bundle Mobile Security 2
Android security patterns for secure storage, network security, input validation, and authentication. Use when this capability is needed.
- tomevault-io Bundle Wordpress Penetration Testing 3
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies. Use when this capability is needed.
- tomevault-io Bundle Flutter Patterns 6
Comprehensive Flutter development patterns covering widgets, testing, performance, security, and animations. Use when you need quick reference for Flutter best practices, common UI patterns, performance optimization techniques, security guidelines, or animation implementations. Use when this capability is needed.
- tomevault-io Bundle GRAPHQL Security 4
Secure GraphQL APIs - authentication, authorization, rate limiting, and validation Use when this capability is needed.
- tomevault-io Bundle Security Flutter 2
Flutter Security. Use when reviewing security, implementing auth, or hardening code. Use when this capability is needed.
- tomevault-io Bundle Code Review Checklist 17
Code review checklist for quality, security, and maintainability. Use after writing or modifying code to ensure high standards. Covers code quality, security, performance, and best practices. Use when this capability is needed.
- tomevault-io Bundle Secure Code Review 4
Repeatable process for an application security code review that produces prioritized findings and fix guidance. Use when this capability is needed.
- tomevault-io Bundle Event Sourcing Architect 2
Expert in event sourcing, CQRS, and event-driven architecture patterns. Masters event store design, projection building, saga orchestration, and eventual consistency patterns. Use PROACTIVELY for event-sourced systems, audit trail requirements, or complex domain modeling with temporal queries. Use when this capability is needed.
- tomevault-io Bundle Stride Analysis Patterns 4
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. Use when this capability is needed.
- tomevault-io Bundle Dependency Auditor 2
Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, Use when this capability is needed.
- tomevault-io Bundle Architecture Review 7
Systematic evaluation of software architecture across scalability, maintainability, security, performance, reliability, and cost dimensions. Use when designing systems, reviewing technical approaches, evaluating patterns, making architectural decisions, or assessing technical debt. Use when this capability is needed.
- tomevault-io Bundle Auth Implementation Patterns 5
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues. Use when this capability is needed.
- tomevault-io Bundle Security Engineer 4
Activate when user needs security work - vulnerability assessment, security architecture, compliance audits, penetration testing. Activate when @Security-Engineer is mentioned or work requires security review. Use when this capability is needed.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include audit-security, wcag-audit-patterns, gemini-delegate. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.