CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Security Skills
Find and fix vulnerabilities: audits, secure coding, authentication hardening and access control.
Skills in Security
Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
Skill: OpenQodex
by OpenQodex
Open source pre-push AI code review for Claude Code and Codex: scanners plus a separate reviewer that verifies every finding.
Skill: Better Auth: Two-Factor Auth
by Better Auth
Adds real 2FA to a Better Auth app — TOTP, email/SMS OTP, backup codes, trusted devices — including the sign-in interrupt and the encryption-at-rest details.
Skill: Better Auth: Email & Password
by Better Auth
Credential auth done to spec in Better Auth: verification email, reset flow, token and session handling, password policy and custom hashing.
Skill: Better Auth: Integration Guide
by Better Auth
The reference an agent needs to configure Better Auth correctly: adapters, session strategy, hooks, plugins, type safety and the gotchas that bite in production.
Skill: OpenAI security-best-practices
by OpenAI
OpenAI's skill for language- and framework-specific secure coding: detect the stack, load the matching reference guidance, then write secure-by-default code, flag critical issues passively, or produce a prioritised vulnerability report with fixes.
Skill: OpenAI security-threat-model
by OpenAI
OpenAI's skill for repository-grounded threat modelling: derive trust boundaries, assets and attacker capabilities from the actual code, rank abuse paths by likelihood and impact, and write a reviewable Markdown threat model.
Skill: Turnstile Spin
by Cloudflare
Turns “set up Turnstile” into a working end-to-end bot check — widget, frontend snippets, canonical server-side siteverify, and a real validation pass before it reports success.
Skill: SAIL — Secure AI Lifecycle
by Pillar Security
Pillar Security's SAIL V2 framework as an agent skill: a 91-risk catalogue across seven lifecycle phases, for AI security gap assessments, roadmaps, and ISO 42001 / EU AI Act compliance checklists.
Skill: Zeroize Audit
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
Skill: Supply Chain Risk Auditor
by Trail of Bits
Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.
Skill: Constant-Time Analysis
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
Skill: Cloudflare One Zero Trust
by Cloudflare
Cloudflare's official skill for designing, configuring and troubleshooting Cloudflare One — Access, Gateway, WARP, Tunnel, DLP, CASB, device posture and identity — with retrieval over recalled docs.
Skill: CodeQL Security Analysis
by Trail of Bits
Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.
Skill: Semgrep Rule Creator
by Trail of Bits
Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.
Google's official Well-Architected Framework skill for the security pillar — turns an architecture review into a structured interview, gap analysis and prioritised recommendations.
Skill: Twilio Security Hardening
by Twilio
Harden a Twilio integration against credential leaks and fraud — API keys instead of auth tokens, webhook signature validation, geo-permissions, SMS pumping prevention and zero-downtime credential rotation.
Skill: Twilio Verify OTP Delivery
by Twilio
Add phone or email verification with Twilio Verify — send and check one-time passcodes over SMS, voice, email or WhatsApp, with built-in expiry, rate limiting and Fraud Guard rather than hand-rolled OTP plumbing.
Skill: Datadog Audit Trail
by Datadog
Answer "who changed what" from Datadog Audit Trail — configuration-change forensics, API key compromise, cost-spike root cause, SOC 2/PCI evidence and AI activity audits.
Skill: Firebase Security Rules Auditor
by Firebase
Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.
Skill: Microsoft Entra Agent ID
by Microsoft
Microsoft's official skill for giving AI agents real OAuth2 identities in Entra — blueprints, agent identities, sponsors, workload identity federation and the auth sidecar.
Skill: Authenticating to Google Cloud
by Google Cloud
Google's official skill for getting Google Cloud authentication right — human identities, service accounts, Application Default Credentials, and the failure modes agents usually hit.
Skill: GitHub Actions Security Review
by Sentry
Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.
Skill: Find Bugs in Branch Changes
by Sentry
Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.
Skill: Deno Sandbox
by Deno
Run untrusted or model-generated code in an isolated environment using the @deno/sandbox SDK.
Skill: Cloudflare Sandbox SDK
by Cloudflare
Build secure code-execution features on Cloudflare — sandboxes for AI-generated code, interpreters, and CI systems.