Best Security agent skills
Protecting systems and data — vulnerability review, secrets, access control and hardening. The 15 highest-ranked of the 36 agent skills tagged Security in the Onei AI catalogue.
Everything tagged Security: apps, skills and MCP servers
-
by Trail of Bits
CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Also: Static Analysis · Editor's pick · Copied 1 time
-
by Google Cloud
Google's official skill for driving the gcloud CLI safely from an agent: validate every command against its own help text, cap the output, and refuse the operations that should never run unattended.
Editor's pick · Copied 1 time
-
by Auth0
Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.
Also: Authentication · Editor's pick
-
by Trail of Bits
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
-
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
Also: AppSec, Audit, Static Analysis · Copied 1 time
-
by Sentry
Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.
Also: Audit · Copied 1 time
-
by Deno
Run untrusted or model-generated code in an isolated environment using the @deno/sandbox SDK.
-
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
Also: AppSec, Audit, Static Analysis
-
by Google Cloud
Google's official skill for getting Google Cloud authentication right — human identities, service accounts, Application Default Credentials, and the failure modes agents usually hit.
Also: Authentication
-
by Better Auth
Adds real 2FA to a Better Auth app — TOTP, email/SMS OTP, backup codes, trusted devices — including the sign-in interrupt and the encryption-at-rest details.
Also: Authentication
-
by Cloudflare
Turns “set up Turnstile” into a working end-to-end bot check — widget, frontend snippets, canonical server-side siteverify, and a real validation pass before it reports success.
-
by PlanetScale
PlanetScale's approval contract for agents: five operation classes that decide what a database agent may do freely, what needs a named approval, and what it must never do alone.
Also: Compliance
-
by Snowflake
Snowflake's official skill that routes Snowflake work from Claude Code to the Cortex Code CLI, with semantic routing, approval modes and audit logging.
Also: Compliance
-
by Datadog
Answer "who changed what" from Datadog Audit Trail — configuration-change forensics, API key compromise, cost-spike root cause, SOC 2/PCI evidence and AI activity audits.
Also: Compliance
-
by Firebase
Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.
Also: Audit
How this list is ranked
Ranked by 20 points for an editor's pick, plus 4 points per copy of the install command or SKILL.md up to 10, plus a point per 5 page views up to 100; ties go to the most recently updated. Discontinued skills are never ranked.