Home / Categories / security
security agent skills
Security skills focus on threat modeling, dependency review, secret hygiene, and safe patterns for agent-executed tooling.
PR security reviews, hardening checklists, and scanning install scripts before they run in CI.
Use alongside SkillForge’s own safety scan labels. Never treat a green badge as a full audit.
31 indexed20 publisherstop 1900★ on GitHub
Catalog
Safety-scanned public SKILL.md packages. Install commands live on each skill page.
- supabase-postgres-best-practicessupabase/agent-skills · 1900★Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and schedule
- guardian-clizakirkun/guardian-cli · 1854★An enterprise-grade, AI-powered penetration testing automation CLI tool. Orchestrates multiple specialized AI agents (Planner, ToolAgent, Analyst, Reporter) backed by 4 AI providers (OpenAI, Claude, Gemini, OpenRouter) and 19 integrated security tools through YAML-defined workflows. Produces professional Markdown, HTML, or JSON security reports with full evidence capture and traceability.
- review-prNeoLabHQ/context-engineering-kit · 1780★Review an existing GitHub pull request and post inline review comments on its diff. Use when the changes are on an opened PR rather than your local working tree.
- Web search via Gemini CLI for latest informationwasabeef/claude-code-cookbook · 1133★Web search via Gemini CLI for latest information. Trigger with "search the web", "look up latest info", "search with Gemini".
- azure-kubernetesmicrosoft/azure-skills · 605★Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, ch
- azure-preparemicrosoft/azure-skills · 605★Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cros
- entra-app-registrationmicrosoft/azure-skills · 605★Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure re
- azure-validatemicrosoft/azure-skills · 605★Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot
- azure-compliancemicrosoft/azure-skills · 605★Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance ass
- azure-enterprise-infra-plannermicrosoft/azure-skills · 605★Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topo
- best-practices-researchermajiayu000/claude-skill-registry · 577★Use this agent when researching external best practices, documentation, and examples for any technology, framework, or development practice. Specializes in gathering information from official documentation, community standards, and well-regarded open source projects. Triggers on requests like "research best practices", "find examples of", "how should I implement".
- githubmajiayu000/claude-skill-registry · 575★Comprehensive GitHub operations via gh CLI. Manage repositories, issues, pull requests, Actions workflows, code security, discussions, projects, gists, notifications, and more. Use for any GitHub-related task including creating PRs, reviewing code, managing issues, monitoring CI/CD, and analyzing security alerts.
- commands-managermajiayu000/claude-skill-registry · 575★Branch skill for building and improving commands. Use when creating new slash commands, adapting marketplace commands, validating command structure, working with $ARGUMENTS, or improving existing commands. Triggers: 'create command', 'improve command', 'validate command', 'fix command', 'slash command', '$ARGUMENTS', 'adapt command', 'multi-phase command', 'command frontmatter'.
- best-practices-researchermajiayu000/claude-skill-registry · 575★Use this agent when researching external best practices, documentation, and examples for any technology, framework, or development practice. Specializes in gathering information from official documentation, community standards, and well-regarded open source projects. Triggers on requests like "research best practices", "find examples of", "how should I implement".
- octocodemajiayu000/claude-skill-registry · 574★Semantic code research across GitHub repositories for finding implementations, patterns, and conducting PR/security reviews.
- gh-searchmajiayu000/claude-skill-registry · 574★Use when searching GitHub via CLI for issues, PRs, repos, code, or commits - provides correct syntax for exclusions, qualifiers, quoting, and platform-specific handling to avoid command failures
- search-operationsmajiayu000/claude-skill-registry · 574★Search GitHub - find code, issues, users, and repositories across GitHub using gh CLI
- solidity-securityDokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI · 511★Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
- ensure-invariantsPlamenTSV/plamen · 311★Trigger Pattern Always required for DAML audits - Inject Into Breadth agents, depth-edge-case
- tianming-novel-systemzy-zmc/tianming-skill · 155★「天命」长篇小说协同创作系统。当用户使用「天命：大纲」「天命：规划」「天命：目录」 「天命：草案」「天命：正文」「天命：体检」「天命：存档」等指令进行多卷长篇小说写作， 或需要保证跨章节的世界观一致性、伏笔回收、节奏控制、文风稳定时使用本 Skill。 本系统依赖外部知识库：《世界基石.md》《世界观规则.md》《角色档案.md》《档案事件.md》《文风样本.md》。
- crZhangShenao/harness9 · 142★Use when the user invokes /cr, requests a code review, or before committing to verify correctness, security, and quality of new or modified code in the working tree.
- migration-and-contract-reviewmakifbaysal/tasktrooper · 117★Use when a diff or design adds or changes a DB migration, an endpoint or DTO, an event payload, or a shared type with consumers
- jjtheowenyoung/home · 115★Save the currently active browser page to the link collection at saved.owenyoung.com. Use when explicitly invoked as $jj, or when the user asks to bookmark or collect the current page there. Read the page without navigating, generate a concise Chinese title, SEO slug, and distinctive Chinese Markdown description, attach the complete article or main-page text as Chinese-only Markdown, match collect
- security-checklistc0x12c/ai-toolkit · 109★Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention. Use when implementing auth, validating inputs, or reviewing security.
- b0risingwavelabs/box0 · 80★Delegate tasks to AI agents via Box0. Use when the user asks to review code, check security, run tests, compare tools, get multiple perspectives, research a topic, analyze data, write docs, or any task that could benefit from specialized or parallel execution. Also use when the user mentions agent names or says "ask", "delegate", "get opinions from", or "have someone".
- godot-solana-sdkVirus-Axel/godot-solana-sdk · 78★Use this skill when building Solana-enabled games or apps in Godot 4 with the Godot Solana SDK. Triggers include: Solana transactions in GDScript, SPL tokens or NFTs in a Godot project, connecting browser or mobile wallets (Phantom, Solflare, Backpack) in a Godot game, calling Anchor smart contracts from GDScript, working with Candy Machine in Godot, or any mention of SolanaClient, Transaction, Pu
- security-audit-rlmmitkox/megacode · 77★Run and troubleshoot privacy-preserving, local DSPy RLM security audits for large legacy .NET codebases. Use when asked to scan repositories for vulnerabilities, tune RLM/tool limits, fix truncation/stall issues, or produce actionable markdown/json audit outputs without loading entire codebases into model context.
- ship-safekinncj/Heimdall · 70★Run ship-safe security and quality audit on the current project. Executes npx ship-safe audit . and reports findings by severity. Use before shipping any feature or PR.
- skill-vetterapp-incubator-xyz/skill-vetter · 61★Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns.
- goSumonMSelim/agentguard · 54★Idiomatic Go 1.25 practices: errors, interfaces, concurrency, generics, testing, security, tooling. Use when writing or reviewing Go code.
- pmbex-co/bex-security · 51★`/pm` is the **only** skill that writes to `.pm/`. It arranges milestones and tasks under the conventions below. `/pm-brainstorm` proposes; `/pm` materializes. This file is the **canonical** definition of the board conventions — hierarchy, sizing rule, quality gate, standing closing tasks, templates. `/pm-brainstorm` r
Related categories
FAQ
What are security agent skills?
Security skills focus on threat modeling, dependency review, secret hygiene, and safe patterns for agent-executed tooling.
How do I install one?
Open any skill page and run the install command (usually npx skillforge add owner/repo/skill). Review upstream source before production use.
How many are indexed?
This hub lists 31 security-tagged skills from 20 publishers. Counts change as the crawler discovers new public SKILL.md files.