Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Codex Pr Body

  by @deonmenezes

  Update the title and body of one or more pull requests.

• Remote Tests

  by @deonmenezes

  Testing against remote executors in integration tests.

• Code Review

  by @deonmenezes

  Run a final code review on a pull request

• Test Tui

  by @deonmenezes

  Guide for testing Codex TUI interactively

• Code Review Change Size

  by @deonmenezes

  Change size guidance (800 lines)

• Code Review Testing

  by @deonmenezes

  Test authoring guidance

• Code Review Context

  by @deonmenezes

  Model visible context

• Elicit

  by @juxt

  Run a structured discovery session to build an Allium specification through conversation. Use when the user wants to create a new spec from scratch, elicit or gather requirements, capture domain behaviour, specify a feature or…

• Distill

  by @juxt

  Extract an Allium specification from an existing codebase. Use when the user has existing code and wants to distil behaviour into a spec, reverse engineer a specification from implementation, generate a spec from code, turn…

• Weed

  by @juxt

  Weed the Allium garden. Find where Allium specifications and implementation code have diverged, and help resolve the divergences. Use when the user wants to check spec-code alignment, compare specs against implementation, audit…

• Dex Doctor

  by @davekilleen

  Whole-system checkup: verifies every Dex feature honestly (working/off/broken/couldn't-check), self-heals what's provably safe, guides the rest. Use when the user says 'is Dex healthy', 'something's broken', 'check my setup',…

• Tech Debt

  by @davekilleen

  Use when technical debt needs linked code or operational evidence, deduplication, first-seen provenance, or impact, effort, confidence, and cost-of-delay prioritization.

• Qe Browser

  by @proffesor-for-testing

  Browser automation for QE agents using Vibium (WebDriver BiDi) with assertions, batch execution, visual diff, prompt-injection scanning, and semantic intents. Use when any QE skill needs to drive a real browser — visual testing,…

• Api Testing Patterns

  by @proffesor-for-testing

  Comprehensive API testing patterns including contract testing, REST/GraphQL testing, and integration testing. Use when testing APIs or designing API test strategies.

• Compliance Testing

  by @proffesor-for-testing

  Regulatory compliance testing for GDPR, CCPA, HIPAA, SOC2, PCI-DSS and industry-specific regulations. Use when ensuring legal compliance, preparing for audits, or handling sensitive data.

• Pentest Validation

  by @proffesor-for-testing

  Use when validating security findings from SAST/DAST scans, proving exploitability of reported vulnerabilities, eliminating false positives, or running the 4-phase pentest pipeline (recon, analysis, validation, report).

• N8n Security Testing

  by @proffesor-for-testing

  Credential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n workflow security.

• N8n Trigger Testing Strategies

  by @proffesor-for-testing

  Webhook testing, schedule validation, event-driven triggers, and polling mechanism testing for n8n workflows. Use when testing how workflows are triggered.

• Agentic Quality Engineering

  by @proffesor-for-testing

  Use when orchestrating QE agents, understanding PACTS principles, configuring the AQE v3 fleet, or leveraging AI agents as force multipliers for quality work.

• Firebase Auth Basics

  by @firebase

  Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

• Firestore Rules Creation

  by @firebase

  Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate…

• Firebase Security Rules Auditor

  by @firebase

  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks.…

• Sap Sqlscript

  by @secondsky

  This skill should be used when the user asks to "write a SQLScript procedure", "create HANA stored procedure", "implement AMDP method", "optimize SQLScript performance", "handle SQLScript exceptions", "debug HANA procedure",…

• Sap Datasphere

  by @secondsky

  SAP Datasphere development skill with 3 specialized agents, 5 slash commands, and validation hooks. Use when building data warehouses on SAP BTP, creating analytic models, configuring data flows and replication flows, setting up…

• Sap Btp Connectivity

  by @secondsky

  SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up…

• Sap Btp Master Data Integration

  by @secondsky

  Configures and integrates SAP Master Data Integration (MDI) service on SAP Business Technology Platform. Use when setting up MDI tenants, connecting applications (S/4HANA, SuccessFactors, Ariba, Fieldglass, etc.), configuring…

• Sap Btp Best Practices

  by @secondsky

  SAP BTP best practices for enterprise architecture, account management, security, and operations, with verification evidence tracked in the repository ledger. Use when planning BTP implementations, setting up account…

• Sap Btp Cloud Transport Management

  by @secondsky

  Comprehensive skill for SAP Cloud Transport Management service on SAP BTP. Use when setting up transport landscapes, configuring transport nodes and routes, managing import queues, deploying MTAs across Cloud Foundry…

• Sap Btp Cloud Logging

  by @secondsky

  This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes, implementing OpenTelemetry…

• Sap Btp Cloud Identity Services

  by @secondsky

  SAP Cloud Identity Services for BTP applications: Identity Authentication (IAS), Identity Provisioning (IPS), and Authorization Management (AMS). Use when configuring authentication for BTP apps, setting up OIDC or SAML app…

• Vibe Security

  by @aiskillstore

  Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages:…

• Security Patterns

  by @aiskillstore

  Security patterns and OWASP guidelines. Triggers on: security review, OWASP, XSS, SQL injection, CSRF, authentication, authorization, secrets management, input validation, secure coding.

• Claude Code Hooks

  by @aiskillstore

  Claude Code hook system for pre/post tool execution. Triggers on: hooks, PreToolUse, PostToolUse, hook script, tool validation, audit logging.

• Convex Security Check

  by @waynesutton

  Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

• Convex Security Audit

  by @waynesutton

  Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

• Convex

  by @waynesutton

  Umbrella skill for all Convex development patterns. Routes to specific skills like convex-functions, convex-realtime, convex-agents, etc.

• Better Auth

  by @Microck

  Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord,…

• Zero Build Frontend

  by @jamditis

  Zero-build frontend development for static apps, browser extensions, maps, and lightweight data-backed interfaces. Use when deployment must not require a build step.

• Api Hardening

  by @jamditis

  API hardening for Express, FastAPI, and serverless. Use for rate limiting, CORS, input validation, API keys, or OWASP API Top 10.

• Supply Chain Hardening

  by @jamditis

  Install-time cooldowns for npm/bun plus a sandboxed pre-install scan for bypasses. Use for supply-chain attacks or npm security.

• Web Scraping

  by @jamditis

  Authorized web scraping with fallback cascades and access-failure handling. Use for social media, yt-dlp, CAPTCHA or 403 blocks.

• Accessibility Compliance

  by @jamditis

  Web accessibility patterns for news and academic sites. Use for WCAG audits, alt text, accessible data viz, and assistive tech.

• Fact Check Workflow

  by @jamditis

  Structured fact-checking workflow. Use when verifying claims for publication, rating claims, or setting pre-publication checks.

• Foia Requests

  by @jamditis

  FOIA and public records workflows. Use when drafting requests, tracking submissions, checking exemptions, or appealing denials.

• Secure Auth

  by @jamditis

  Secure authentication patterns (OWASP, NIST). Use for login, registration, password reset, sessions, JWT, OAuth, MFA, passkeys.

• Security Checklist

  by @jamditis

  Pre-deployment security audit organized by OWASP Top 10. Use when reviewing code before shipping or going to production.

• Inngest Middleware

  by @Asymmetric-al

  Use when adding cross-cutting concerns to durable functions — structured logging or tracing across all functions, error tracking with Sentry, payload encryption for sensitive data, dependency injection of clients (DB, Stripe,…

• App Release

  by @glebis

  End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild,…

• Vault

  by @glebis

  Set up and verify the CONFIDE THREE LOCKS for storing RED (real, identifiable) session data at rest — device FileVault, a dedicated encrypted store, and per-file sops/age encryption. Use when the user says "set up confide…

• Eval Integration

  by @Ibrahim-3d

  Specialized integration evaluator for the Evaluate-Loop. Use this for evaluating tracks that integrate external services — Supabase auth/DB, Stripe payments, Gemini API, third-party APIs. Checks API contracts, auth flows, data…

• Agent Browser

  by @brianlovin

  Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any…

• React Doctor

  by @brianlovin

  Diagnose and fix React codebase health issues. Use when reviewing React code, fixing performance problems, auditing security, or improving code quality.

• Spring Boot Actuator

  by @giuseppe-trisciuoglio

  Provides patterns to configure Spring Boot Actuator for production-grade monitoring, health probes, secured management endpoints, and Micrometer metrics across JVM services. Use when setting up monitoring, health checks, or…

• Aws Cloudformation Rds

  by @giuseppe-trisciuoglio

  Provides AWS CloudFormation patterns for Amazon RDS databases. Use when creating RDS instances (MySQL, PostgreSQL, Aurora), DB clusters, multi-AZ deployments, parameter groups, subnet groups, and implementing template structure…

• Aws Cli Beast

  by @giuseppe-trisciuoglio

  Provides advanced AWS CLI patterns for managing EC2, Lambda, S3, DynamoDB, RDS, VPC, IAM, and CloudWatch. Generates bulk operation scripts, automates cross-service workflows, validates security configurations, and executes…

• Aws Cloudformation Security

  by @giuseppe-trisciuoglio

  Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when…

• Langchain4j Mcp Server Patterns

  by @giuseppe-trisciuoglio

  Provides LangChain4j patterns for implementing MCP (Model Context Protocol) servers, creating Java AI tools, exposing tool calling capabilities, and integrating MCP clients with AI services. Use when building a Java MCP server,…

• Aws Sdk Java V2 Rds

  by @giuseppe-trisciuoglio

  Provides AWS RDS (Relational Database Service) management patterns using AWS SDK for Java 2.x. Use when creating, modifying, monitoring, or managing Amazon RDS database instances, snapshots, parameter groups, and configurations.

• Aws Rds Spring Boot Integration

  by @giuseppe-trisciuoglio

  Provides patterns to configure AWS RDS (Aurora, MySQL, PostgreSQL) with Spring Boot applications. Configures HikariCP connection pools, implements read/write splitting, sets up IAM database authentication, enables SSL…

• Aws Cloudformation Elasticache

  by @giuseppe-trisciuoglio

  Provides AWS CloudFormation patterns for ElastiCache Redis or Memcached infrastructure, including subnet groups, parameter groups, security controls, and cross-stack outputs. Use when designing cache tiers, high-availability…

• Aws Cloudformation Iam

  by @giuseppe-trisciuoglio

  Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use when modeling least-privilege access, cross-account assumptions, service roles, or reusable IAM…

• Hotfix

  by @WellApp-ai

  Expedited workflow for urgent production issues

• Api Gateway Configuration

  by @aj-geddes

  Configure API gateways for routing, authentication, rate limiting, and request/response transformation. Use when deploying microservices, setting up reverse proxies, or managing API traffic.

• Api Changelog Versioning

  by @aj-geddes

  Document API changes, breaking changes, migration guides, and version history for APIs. Use when documenting API versioning, breaking changes, or creating API migration guides.

• Cloud Security Configuration

  by @aj-geddes

  Implement comprehensive cloud security across AWS, Azure, and GCP with IAM, encryption, network security, compliance, and threat detection.

• Backup Disaster Recovery

  by @aj-geddes

  Implement backup strategies, disaster recovery plans, and data restoration procedures for protecting critical infrastructure and data.

• Api Authentication

  by @aj-geddes

  Implement secure API authentication with JWT, OAuth 2.0, API keys, and session management. Use when securing APIs, managing tokens, or implementing user authentication flows.

• Aws Rds Database

  by @aj-geddes

  Deploy and manage relational databases using RDS with Multi-AZ, read replicas, backups, and encryption. Use for PostgreSQL, MySQL, MariaDB, and Oracle.

• Artifact Management

  by @aj-geddes

  Manage build artifacts, Docker images, and package registries. Configure artifact repositories, versioning, and distribution strategies.

• Access Control Rbac

  by @aj-geddes

  Implement Role-Based Access Control (RBAC), permissions management, and authorization policies. Use when building secure access control systems with fine-grained permissions.

• Api Security Hardening

  by @aj-geddes

  Secure REST APIs with authentication, rate limiting, CORS, input validation, and security middleware. Use when building or hardening API endpoints against common attacks.

• Changelog Maintenance

  by @aj-geddes

  Maintain comprehensive changelogs and release notes following Keep a Changelog format. Use when documenting version history, release notes, or tracking changes across versions.

• Formal Methods Reconciler

  by @mizchi

  Use when reconciling software specs, docs, tests, configs, code, logs, or incidents with formal methods. Helps Codex extract claims, decide whether docs or implementation are the source of truth, choose an appropriate tool such…

• Dotenvx

  by @mizchi

  Use when working with the `dotenvx` env-var management tool — encrypting .env files, juggling multiple environments (.env.production / .env.staging / .env.ci), committing encrypted secrets to git with `.env.vault` / `.env.keys`…

• Apm Usage

  by @mizchi

  Reference for APM (Agent Package Manager) — apm.yml syntax, install / uninstall / update commands, target detection, lockfile workflow. Read when you need exact field names, but do NOT auto-invoke on every apm-related task; user…

• Conventional Changelog

  by @mizchi

  Reference for Conventional Commits and automatic CHANGELOG generation. Compares release-please / changesets / git-cliff / towncrier and covers commit format, Keep a Changelog, and semver tag practices. Use when setting up or…

• Frontend Review Security

  by @mizchi

  Use when conducting a frontend security review — static analysis (risky HTML patterns, env var exposure), authentication/authorization audit (token storage, route guards, logout), and AI self-penetration testing. Runs…

• Frontend Review Triage

  by @mizchi

  Use when starting a frontend review engagement or when the user asks for an initial assessment ("triage", "day 0", "what's the state of this repo"). Reads package.json, README, gh issues, and produces a scorecard covering…

• Aws Vault Mfa Iam

  by @mizchi

  Use when AWS account の IAM API が MFA 必須 policy で弾かれて、 `sts:GetCallerIdentity` は通るのに `iam:*` が `InvalidClientTokenId` で拒否されるとき、 または FIDO2 passkey で MFA が CLI から使えないとき。 aws-vault / aws-cli / MFA / passkey 関連で「アクセス拒否」 「token…

• Frontend Review Deps

  by @mizchi

  Use when auditing dependency health — outdated packages, CVE triage with attack-vector weighting, deprecated/declining library detection (trend-watch). Runs `audit-deps.sh` and `audit-trend-watch.sh`. Pairs with…

• Frontend Review Hygiene

  by @mizchi

  Use when assessing code quality hygiene — TypeScript strictness, lint violations, dead code, and duplication. Runs `audit-typescript.sh`, `audit-lint.sh`, `audit-similarity.sh`. Does NOT cover dependency freshness or CVE audit —…

• Dep Lib Review

  by @mizchi

  Periodic dependency review for Node.js/pnpm projects — outdated package triage, security audit, update batching strategy (patch/minor/major), validation checklist. Run monthly or before major releases. Use when asked to review…

• Security Expert

  by @mizchi

  Security specialist perspective for the weekly review. Focuses on XSS/CSRF, authorization boundaries, input validation, secrets handling, and dependency CVEs.

• Architecture Reviewer

  by @Mathews-Tom

  Architecture reviews across 7 dimensions (structural, scalability, enterprise readiness, performance, security, ops, data) with scored reports. Triggers on: "review architecture", "critique design", "audit system", "assess…

• Decision Map

  by @Mathews-Tom

  Maps the unresolved architecture, policy, and scope decisions that must be answered before planning can start: one durable decision ticket per question on the issue tracker, typed and blocker-linked under a parent map, with…

• Agent Builder

  by @Mathews-Tom

  Build AI agents and automate Claude Code programmatically via the Claude Agent SDK and headless CLI mode. Covers Python SDK, claude -p, SDK MCP servers, hooks, sessions. Triggers on: "build an agent", "agent SDK", "headless…

• Dependency Audit

  by @Mathews-Tom

  Audits direct and transitive dependencies for license compliance, maintenance health, CVEs, abandoned packages, and bloat. Triggers on: "audit dependencies", "license check", "dependency health", "abandoned packages", "unused…

• Adr Writer

  by @Mathews-Tom

  Generates Architecture Decision Records capturing context, rationale, alternatives, and consequences in numbered status-tracked format. Triggers on: "write an ADR", "document this decision", "architecture decision record",…

• Api Docs Generator

  by @Mathews-Tom

  Audits and enhances FastAPI and REST API documentation: missing descriptions, response codes, examples, docstrings, Pydantic models, OpenAPI spec. Triggers on: "generate API docs", "document this API", "OpenAPI for", "FastAPI…

• Codebase Advisor

  by @Mathews-Tom

  Senior codebase advisor that audits a repository, vets findings, and writes self-contained implementation plans for other agents to execute. Triggers on: "write improvement plans", "create an implementation backlog", "audit and…

• Devils Advocate

  by @Mathews-Tom

  Challenges AI-generated plans, code, and designs via pre-mortem, inversion, and Socratic questioning to surface blind spots and failure modes. Triggers on: "challenge this", "devils advocate", "stress test this plan", "poke…

• Pre Landing Review

  by @Mathews-Tom

  Gate-oriented safety audit for code changes before landing, using a checklist with two-pass severity triage. Triggers on: "is this safe to land", "pre-landing review", "safety check before merge", "gate check",…

• C To Ast

  by @Narwhal-Lab

  Parse C source code into an Abstract Syntax Tree (AST). Use when analyzing C programs, understanding code structure, performing static analysis, or preparing code for further program analysis (e.g., CFG, DFG, vulnerability…

• Code Review

  by @smallnest

  Frontend-focused code review skill for React/TypeScript/Tailwind projects. Analyzes code quality, security vulnerabilities (XSS, CSRF), performance issues, accessibility (WCAG), React best practices, hooks usage, component…

• Agent To Agent

  by @OneWave-AI

  Agent-to-Agent (A2A) communication protocol. Connect two or more Claude agents that pass messages, share context, delegate tasks, and collaborate. Implements structured handoffs, shared memory, and multi-agent conversations.

• Compliance Checker

  by @OneWave-AI

  Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data…

• Agent Army

  by @OneWave-AI

  Deploy a 2-layer parallel agent hierarchy for large, parallelizable work — big refactors, multi-file migrations, codebase-wide audits, bulk generation. A top-tier commander (Fable or Opus) orchestrates the swarms; the user picks…

• Customer Panel Of Experts

  by @OneWave-AI

  Build a panel of your real buyer personas (from a deep scan of any tools you allow it to connect to) and have them debate any decision you bring — a marketing launch, a price increase, a new product, a positioning change, a…

• Code Review Pro

  by @OneWave-AI

  Comprehensive code review covering security vulnerabilities, performance bottlenecks, best practices, and refactoring opportunities. Use when user requests code review, security audit, or performance analysis.

• Next Forge

  by @vercel

  next-forge expert guidance — production-grade Turborepo monorepo SaaS starter by Vercel. Use when working in a next-forge project, scaffolding with `npx next-forge init`, or editing @repo/* workspace packages.