Security
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
-
paulasilvatech Skill Code Modernization 2Use this skill when the user asks to modernize legacy code with a disciplined GitHub Copilot workflow: brief, assess, map, extract business rules, reimagine architecture, transform modules, and harden with tests and security review. Trigger for COBOL, JCL, legacy Java, .NET, C++, classic ASP, monolith modernization, behavior-preserving rewrite, business-rule extraction, modernization assessment, or legacy-to-modern transformation.
- paulasilvatech Skill Centos Linux Triage 2
Diagnose and remediate CentOS Linux incidents with RHEL-compatible systemd, journal, dnf/yum, SELinux, firewalld, and rollback practices. Use when the user asks to triage CentOS service failures, package issues, boot problems, networking/firewall symptoms, or security-policy denials.
- paulasilvatech Skill Debian Linux Triage 2
Diagnose and remediate Debian Linux incidents with apt, dpkg, systemd, journal analysis, AppArmor-aware checks, firewall review, and rollback practices. Use when the user asks to triage Debian service failures, package issues, boot problems, network symptoms, or security-profile denials.
- paulasilvatech Skill Dotnet Best Practices 2
Review or improve .NET and C# code against solution/project best practices for documentation, architecture, dependency injection, resources, async, tests, configuration, Semantic Kernel, logging, performance, security, SOLID, and code quality. Use when asked for .net/c# or .NET/C# best practices or cleanup.
- paulasilvatech Skill Create Technical Spike 2
Create time-boxed technical spike documents that answer critical implementation questions before development proceeds. Use this skill when the user asks to create a technical spike, research an API or architecture decision, document a proof of concept, evaluate performance or security options, or unblock development with an evidence-based recommendation.
- paulasilvatech Skill Apple Appstore Reviewer 2
Review an iOS app codebase and metadata for likely Apple App Store rejection risks, compliance gaps, reviewer friction, and fast approval improvements. Use when asked to "review for App Store rejection", "check Apple review readiness", "audit IAP and privacy", "write reviewer notes", or "find App Store approval risks".
- paulasilvatech Skill Salesforce Apex Quality 2
Review or generate Salesforce Apex classes, triggers, handlers, batch jobs, and test classes with quality guardrails for bulk safety, explicit sharing, CRUD/FLS enforcement, SOQL injection prevention, PNB tests, trigger architecture, and modern Apex idioms. Use when asked to catch governor limit risks, security gaps, and Apex deployment quality issues.
- paulasilvatech Bundle Data Breach Blast Radius 2
Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: "assess breach impact", "what data could be exposed", "calculate blast radius", "data exposure analysis", "how bad would a breach be", "quantify data risk", "sensitive data inventory", "data flow security audit", "pre-breach assessment", "worst-case breach scenario", "breach readiness", "data risk report", "/data-breach-blast-radius". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.
- paulasilvatech Bundle Github Actions Hardening 2
Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.
- paulasilvatech Bundle Github Actions Efficiency 2
Audit GitHub Actions workflow efficiency and recommend fixes that reduce CI runtime, runner minutes, and wasted workflow runs. Use when the user asks about caching, concurrency, path filters, matrix reduction, job optimization, workflow cost, or CI baseline design.
- paulasilvatech Skill Ef Core 2
Review or design Entity Framework Core data access using DbContext, entity mapping, LINQ queries, migrations, change tracking, performance, security, and tests. Use when the user asks for EF Core best practices, Entity Framework Core code review, query optimization, migration guidance, or database access improvements in .NET.
- paulasilvatech Skill Java Helidon 2
Apply Helidon 4 SE and MP best practices for Java 21 applications, including routing, DB Client, Jakarta and MicroProfile APIs, configuration, security, observability, and tests. Use when working with Helidon SE, Helidon MP, HttpService, HttpRules, MicroProfile Config, Helidon DB Client, Helidon Security, or Helidon testing.
- paulasilvatech Bundle Audit Integrity 2
Enforce AppSec audit integrity for security analysis, code review, threat modeling, SAST, SCA, and quality scan agents. Use this skill when running a post-analysis quality gate, preventing rationalization, retrying failed evidence collection, running a second-pass self-critique, scoring output from 1-10 with a ≥8 threshold, or recording governed lessons or memories.
- paulasilvatech Skill Java Springboot 2
Apply Spring Boot best practices for project structure, dependency injection, configuration, REST controllers, DTO validation, services, transactions, Spring Data JPA, logging, testing, and security. Use when asked for Spring Boot guidance or to implement Java backend code.
- paulasilvatech Bundle Secret Scanning 2
Configure and manage GitHub secret scanning, push protection, custom patterns, exclusions, alert triage, remediation, bypass workflows, and pre-commit secret scans through the Advanced Security plugin. Use this skill when enabling secret scanning, resolving blocked pushes, writing secret_scanning.yml, creating regex patterns, triaging alerts, or scanning code before committing.
- paulasilvatech Bundle Github Actions Hardening 5
Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.
- paulasilvatech Skill Code Modernization 6
Use this skill when the user asks to modernize legacy code with a disciplined GitHub Copilot workflow: brief, assess, map, extract business rules, reimagine architecture, transform modules, and harden with tests and security review. Trigger for COBOL, JCL, legacy Java, .NET, C++, classic ASP, monolith modernization, behavior-preserving rewrite, business-rule extraction, modernization assessment, or legacy-to-modern transformation.
- paulasilvatech Bundle Github Actions Efficiency 3
Audit GitHub Actions workflow efficiency and recommend fixes that reduce CI runtime, runner minutes, and wasted workflow runs. Use when the user asks about caching, concurrency, path filters, matrix reduction, job optimization, workflow cost, or CI baseline design.
- paulasilvatech Bundle Github Actions Hardening 6
Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.
- paulasilvatech Skill Cobol Classic Context 2
Supply COBOL, DB2, VSAM, and JCL modernization context: corpus layout, member conventions, target stack boundaries, evidence precedence, stage flow, and security rules. Use when starting any COBOL/DB2 modernization task, before analysis, design, implementation, verification, or delivery.
- paulasilvatech Skill Dataverse Python Production Code 3
Generate production-ready Python 3.10+ code for the PowerPlatform-Dataverse-Client SDK with DataverseError handling, singleton client management, retry with exponential backoff for 429/timeout failures, OData optimization, audit logging, type hints, docstrings, configuration handling, and usage examples. Use when asked for Dataverse Python code, SDK examples, or system instructions.
- paulasilvatech Bundle Github Actions Hardening 7
Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.
- paulasilvatech Skill Competitor Ad Intelligence 2
Analyze public competitor paid ads from Meta Ad Library and Google Ads Transparency Center, cluster creative hooks, inspect landing pages, infer funnel strategy, identify vulnerabilities, and recommend counter-plays. Use this skill when asked what ads a competitor is running, to tear down ad strategy, reverse-engineer a paid funnel, find paid ad angles, or audit the ad landscape.
- paulasilvatech Bundle Github Codespaces Efficiency 2
Audit and improve GitHub Codespaces efficiency. Use this skill when a user wants faster Codespaces startup, lower Codespaces spend, slim devcontainers, right-size machines, tune idle timeout, scope prebuilds, or create an efficient .devcontainer baseline.
- paulasilvatech Bundle Codeql 3
Configure and run CodeQL code scanning with GitHub Actions workflows, default or advanced setup, CodeQL CLI databases, SARIF uploads, custom query packs, monorepo categories, build modes, and alert triage. Use this skill when the user asks to create or customize codeql.yml, choose CodeQL setup, configure a language matrix, run codeql database create or database analyze, upload SARIF, troubleshoot CodeQL builds, or interpret code scanning alerts.
- paulasilvatech Skill Dataverse Python Production Code 2
Generate production-ready Python 3.10+ code for the PowerPlatform-Dataverse-Client SDK with DataverseError handling, singleton client management, retry with exponential backoff for 429/timeout failures, OData optimization, audit logging, type hints, docstrings, configuration handling, and usage examples. Use when asked for Dataverse Python code, SDK examples, or system instructions.
- paulasilvatech Skill Java Springboot 3
Apply Spring Boot best practices for project structure, dependency injection, configuration, REST controllers, DTO validation, services, transactions, Spring Data JPA, logging, testing, and security. Use when asked for Spring Boot guidance or to implement Java backend code.
-
plurigrid Skill Harness Writing 2Writing effective fuzzing harnesses for security testing.
- plurigrid Skill Variant Analysis 2
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
- plurigrid Skill Differential Review 2
Security-focused code review of diffs and pull requests using Trail of Bits expertise.
- plurigrid Skill Entry Point Analyzer 2
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
- plurigrid Skill Semgrep Rule Creator 2
Create custom Semgrep rules for detecting bug patterns and security vulnerabilities. This skill should be used when the user explicitly asks to "create a Semgrep rule", "write a Semgrep rule", "make a Semgrep rule", "build a Semgrep rule", or requests detection of a specific bug pattern, vulnerability, or insecure code pattern using Semgrep.
- plurigrid Skill Secure Workflow Guide 2
Guide you through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. (project, gitignored)
- plurigrid Skill Audit Context Building 2
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
- plurigrid Skill Constant Time Analysis 2
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
- plurigrid Skill Tizen Security Compliance 2
Maps security requirements to implementation. Coordinates compliance against FIPS 140-3, OCF, CommonCriteria, and Tizen specification.
Frequently asked questions
What are Security agent skills?
Security agent skills give AI agents disciplined security workflows: code review for vulnerabilities, secret handling, dependency audits, and hardening checklists. Every skill on SkillMD also passes its own safety review before listing, with capability flags shown on each page.
Which Security skills are most installed?
Popular Security skills on SkillMD right now include code-modernization, centos-linux-triage, debian-linux-triage. Rankings shift as installs change; sort this page by "Most installs" for the live list.
Do Security skills work with Claude Code and Cursor?
Yes. Every skill here ships as a SKILL.md file, an open format that works in Claude Code, Claude.ai, Cursor, Codex, Windsurf, and 60+ other agents. Install one with npx skillmds@latest add <owner>/<name>, or copy the file into your agent's skills directory.