AI agent skills for security review
Security skills teach an agent to read code the way an attacker does: follow untrusted input to where it is executed, rendered, or concatenated into a query. The ones worth having name a threat model rather than grepping for banned functions, and they rank findings by exploitability instead of listing everything. Treat the output as a lead list for a human, not a clearance — an agent that found nothing has told you very little.
People land here searching for “claude code security review skill”, “agent skill to find vulnerabilities”, “owasp skill for ai agents”.
177 security review skills Refine in search →
-
thejdubb02 Skill Owasp AuditAudit application source code against the OWASP Top 10 vulnerability categories. Use when the user mentions 'OWASP,' 'security audit,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'secure code review,' 'security review,' or wants to check their codebase for common security weaknesses.
-
coreyhaines31 Skill Owasp AuditAudit application source code against the OWASP Top 10 vulnerability categories. Use when the user mentions 'OWASP,' 'security audit,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'secure code review,' 'security review,' or wants to check their codebase for common security weaknesses.
36.3k - coreyhaines31 Skill Owasp Audit 2
Audit application source code against the OWASP Top 10 vulnerability categories. Use when the user mentions 'OWASP,' 'security audit,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'secure code review,' 'security review,' or wants to check their codebase for common security weaknesses.
36.3k -
iblai Skill Iblai Vibe Security Owasp AuditAudit application source code against the OWASP Top 10 vulnerability categories. Use when the user mentions 'OWASP,' 'security audit,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'secure code review,' 'security review,' or wants to check their codebase for common security weaknesses.
-
iuliandita Bundle Security Audit· Audit code security: OWASP, credentials, auth, access control, supply chain, hardening. Triggers: 'security audit', 'vulnerability scan', 'secret scan', 'OWASP', 'auth review'. Not for offensive work (use lockpick).
-
demerzels-lab Bundle Code Security AuditComprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis.
10 - demerzels-lab Bundle Code Security Audit 2
Comprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis.
10 -
tools-only Bundle Security Auditor ExpertOWASP Top 10 vulnerability detection and security code review specialist
7 -
vibeeval Skill SecuritySecurity audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan
-
curiositech Bundle Security AuditorSecurity vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).
10 -
a5c-ai Bundle Security ReviewSecurity vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.
1.7k -
tinh2 Skill OwaspSystematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.
13 -
zhaono1 Bundle Security AuditorSecurity vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.
-
aibot88 Bundle Security Audit 2Auditoria de segurança, análise de vulnerabilidades OWASP, proteção de dados e hardening
3 - aibot88 Bundle QA Security
Perform a security audit based on OWASP. Use when the user wants to verify security, look for vulnerabilities, or before a production deployment.
3 - aibot88 Bundle Memstack Security Owasp Top10
Use this skill when the user says 'OWASP audit', 'OWASP top 10', 'security audit', 'vulnerability assessment', 'full security check', or needs a comprehensive web application security review against OWASP Top 10 categories. Do NOT use for dependency audits or secret scanning alone.
3 -
majiayu000 Bundle Security 6Security audit, vulnerability scanning, and secure coding practices. Use when reviewing code for OWASP vulnerabilities, implementing auth, securing APIs, or handling sensitive data.
567 -
proffesor-for-testing Skill Qe Security TestingTest for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.
-
hardness1020 Bundle Security AuditSecurity vulnerability audit — check for OWASP top risks, hardcoded secrets, injection points, and dependency CVEs. Use when auditing code for security vulnerabilities, reviewing authentication/authorization logic, or checking for secrets leakage before merge.
-
christopherlouet Bundle QA SecurityPerform a security audit based on OWASP. Use when the user wants to verify security, look for vulnerabilities, or before a production deployment.
-
hongmaple0820 Skill Security AuditOWASP Top 10 security checklist
-
tomevault-io Bundle Security Audit 11Perform comprehensive security audits against OWASP standards. Use when auditing security, checking for vulnerabilities, or reviewing code for security issues. Use when this capability is needed.
-
navanithans Bundle Ask Owasp Security ReviewStatic security analysis auditing for OWASP Top 10 risks.
-
avinashp Bundle Security AuditAudits code for security vulnerabilities. Use when asked to check security, find vulnerabilities, or audit for OWASP issues.
How to install a security review skill
- Compare the skills. Read the security review skills below — each page shows the full SKILL.md, its safety verdict, and the capabilities it declares.
- Install it. Run npx skillmds@latest add <owner>/<name>. The CLI writes the skill into every agent directory it detects, or use --agent to pin one.
- Use it. Restart your agent. It loads the skill on demand the next time you ask for something that matches — you do not have to name the skill.
What makes a good security review skill?
Security skills teach an agent to read code the way an attacker does: follow untrusted input to where it is executed, rendered, or concatenated into a query. The ones worth having name a threat model rather than grepping for banned functions, and they rank findings by exploitability instead of listing everything. Treat the output as a lead list for a human, not a clearance — an agent that found nothing has told you very little.
Every skill listed here is a plain SKILL.md file in the format Anthropic documents for Agent Skills, read unchanged by Cursor, OpenAI Codex and 60+ agents. Each passes a safety review before it is publicly listed; the verdict and declared capabilities are on every skill's page.
Frequently asked questions
What is an agent skill for security review?
Security skills teach an agent to read code the way an attacker does: follow untrusted input to where it is executed, rendered, or concatenated into a query. The ones worth having name a threat model rather than grepping for banned functions, and they rank findings by exploitability instead of listing everything. Treat the output as a lead list for a human, not a clearance — an agent that found nothing has told you very little.
Can a security skill replace a real audit?
No. It is good at the classes of bug that are visible in the code — injection, unsafe deserialization, hardcoded secrets, missing authorization checks — and blind to everything that depends on deployment, configuration, or the behaviour of services it cannot see. Use it to find the obvious things before a human looks for the subtle ones.
Which agents can use these security review skills?
Any agent that reads SKILL.md files: Claude Code, Claude.ai, Cursor, OpenAI Codex, Windsurf, OpenCode and 60+ others. The format is not vendor-specific, so the same file works everywhere — each agent just keeps its skills in a different directory, listed at /agents.
Are these security review skills free?
Yes. Searching, reading and installing skills on SkillMD is free and needs no account. Individual skills carry their own licence, shown on each skill's page.