How do I install the Moai Domain Security skill?

Run npx skillmds add majiayu000/moai-domain-security-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Moai Domain Security skill do?

OWASP Top 10, SAST/DAST, dependency security, and secrets management. It is listed under Security on SkillMD.

Is Moai Domain Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Moai Domain Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Moai Domain Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Moai Domain Security?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Moai Domain Security by majiayu000 — Agent Skill

Name: Moai Domain Security
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

Domain Security Skill

Skill Metadata

Field	Value
Skill Name	moai-domain-security
Version	2.0.0 (2025-10-22)
Allowed tools	Read (read_file), Bash (terminal)
Auto-load	On demand when keywords detected
Tier	Domain

What It Does

OWASP Top 10, SAST/DAST, dependency security, and secrets management.

Key capabilities:

✅ Best practices enforcement for domain domain
✅ TRUST 5 principles integration
✅ Latest tool versions (2025-10-22)
✅ TDD workflow support

When to Use

Automatic triggers:

Related code discussions and file patterns
SPEC implementation (/alfred:2-run)
Code review requests

Manual invocation:

Review code for TRUST 5 compliance
Design new features
Troubleshoot issues

Tool Version Matrix (2025-10-22)

Tool	Version	Purpose	Status
OWASP ZAP	2.16.0	Primary	✅ Current
Trivy	0.58.0	Primary	✅ Current
Bandit	1.8.0	Primary	✅ Current

Inputs

Language-specific source directories
Configuration files
Test suites and sample data

Outputs

Test/lint execution plan
TRUST 5 review checkpoints
Migration guidance

Failure Modes

When required tools are not installed
When dependencies are missing
When test coverage falls below 85%

Dependencies

Access to project files via Read/Bash tools
Integration with moai-foundation-langs for language detection
Integration with moai-foundation-trust for quality gates

References (Latest Documentation)

Documentation links updated 2025-10-22

Changelog

v2.0.0 (2025-10-22): Major update with latest tool versions, comprehensive best practices, TRUST 5 integration
v1.0.0 (2025-03-29): Initial Skill release

Works Well With

moai-foundation-trust (quality gates)
moai-alfred-code-reviewer (code review)
moai-essentials-debug (debugging support)

Best Practices

✅ DO:

Follow domain best practices
Use latest stable tool versions
Maintain test coverage ≥85%
Document all public APIs

❌ DON'T:

Skip quality gates
Use deprecated tools
Ignore security warnings
Mix testing frameworks

---name: moai-domain-security-2description: OWASP Top 10, SAST/DAST, dependency security, and secrets management.--- # Domain Security Skill ## Skill Metadata | Field | Value | | ----- | ----- | | **Skill Name** | moai-domain-security | | **Version** | 2.0.0 (2025-10-22) | | **Allowed tools** | Read (read_file), Bash (terminal) | | **Auto-load** | On demand when keywords detected | | **Tier** | Domain | --- ## What It Does OWASP Top 10, SAST/DAST, dependency security, and secrets management. **Key capabilities**: - ✅ Best practices enforcement for domain domain - ✅ TRUST 5 principles integration - ✅ Latest tool versions (2025-10-22) - ✅ TDD workflow support --- ## When to Use **Automatic triggers**: - Related code discussions and file patterns - SPEC implementation (`/alfred:2-run`) - Code review requests **Manual invocation**: - Review code for TRUST 5 compliance - Design new features - Troubleshoot issues --- ## Tool Version Matrix (2025-10-22) | Tool | Version | Purpose | Status | |------|---------|---------|--------| | **OWASP ZAP** | 2.16.0 | Primary | ✅ Current | | **Trivy** | 0.58.0 | Primary | ✅ Current | | **Bandit** | 1.8.0 | Primary | ✅ Current | --- ## Inputs - Language-specific source directories - Configuration files - Test suites and sample data ## Outputs - Test/lint execution plan - TRUST 5 review checkpoints - Migration guidance ## Failure Modes - When required tools are not installed - When dependencies are missing - When test coverage falls below 85% ## Dependencies - Access to project files via Read/Bash tools - Integration with `moai-foundation-langs` for language detection - Integration with `moai-foundation-trust` for quality gates --- ## References (Latest Documentation) _Documentation links updated 2025-10-22_ --- ## Changelog - **v2.0.0** (2025-10-22): Major update with latest tool versions, comprehensive best practices, TRUST 5 integration - **v1.0.0** (2025-03-29): Initial Skill release --- ## Works Well With - `moai-foundation-trust` (quality gates) - `moai-alfred-code-reviewer` (code review) - `moai-essentials-debug` (debugging support) --- ## Best Practices ✅ **DO**: - Follow domain best practices - Use latest stable tool versions - Maintain test coverage ≥85% - Document all public APIs ❌ **DON'T**: - Skip quality gates - Use deprecated tools - Ignore security warnings - Mix testing frameworks

Frequently asked questions