{
  "$schema": "https://top-agent-skills.com/schemas/catalog.v1.json",
  "type": "primary-category",
  "slug": "security-auditing",
  "title": "Security & Auditing",
  "shortTitle": "Security",
  "description": "Static analysis, vulnerability scanning, k8s hardening, audit workflows, pentest tooling.",
  "canonical": "https://top-agent-skills.com/top-skills-for-security-auditing",
  "alternates": {
    "html": "https://top-agent-skills.com/top-skills-for-security-auditing",
    "markdown": "https://top-agent-skills.com/top-skills-for-security-auditing.md",
    "json": "https://top-agent-skills.com/top-skills-for-security-auditing.json"
  },
  "rubricVersion": "1.0",
  "methodology": "https://top-agent-skills.com/about/methodology",
  "contentLastUpdated": "2026-08-18",
  "count": 12,
  "topPick": {
    "slug": "agent-email-inbox",
    "name": "agent-email-inbox",
    "score": 59,
    "tagline": "Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.",
    "url": "https://top-agent-skills.com/skill/agent-email-inbox"
  },
  "ranking": [
    {
      "rank": 1,
      "slug": "agent-email-inbox",
      "name": "agent-email-inbox",
      "score": 59,
      "tagline": "Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.",
      "bestFor": "Letting an agent receive and act on email safely — support triage, email-to-task pipelines, automated replies with content-safety guards.",
      "notIdealFor": "Outbound-only sending — use the resend skill; this one is about securely processing inbound mail.",
      "provenance": "verified-org",
      "publisher": "Resend",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add resend/resend-skills",
      "url": "https://top-agent-skills.com/skill/agent-email-inbox",
      "json": "https://top-agent-skills.com/skill/agent-email-inbox.json"
    },
    {
      "rank": 2,
      "slug": "semgrep-scan",
      "name": "semgrep",
      "score": 52,
      "tagline": "Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.",
      "bestFor": "Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express.",
      "notIdealFor": "Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product.",
      "provenance": "verified-org",
      "publisher": "Semgrep",
      "license": "Semgrep Rules License v1.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx skills add semgrep/skills",
      "url": "https://top-agent-skills.com/skill/semgrep-scan",
      "json": "https://top-agent-skills.com/skill/semgrep-scan.json"
    },
    {
      "rank": 3,
      "slug": "semgrep-code-security",
      "name": "code-security",
      "score": 52,
      "tagline": "A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.",
      "bestFor": "Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP.",
      "notIdealFor": "Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards.",
      "provenance": "verified-org",
      "publisher": "Semgrep",
      "license": "Semgrep Rules License v1.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx skills add semgrep/skills",
      "url": "https://top-agent-skills.com/skill/semgrep-code-security",
      "json": "https://top-agent-skills.com/skill/semgrep-code-security.json"
    },
    {
      "rank": 4,
      "slug": "gitguardian-secret-scanning",
      "name": "scan-secrets",
      "score": 50,
      "tagline": "GitGuardian's own secret-detection skill — scans history, images and packages, and ships a written remediation doctrine rather than just a list of hits.",
      "bestFor": "Catching a credential before it reaches a remote, and knowing what to do about one already committed — the bundled doctrine covers rotation triggers and history rewriting, not just detection.",
      "notIdealFor": "Zero-setup use. It requires the ggshield CLI and an authenticated GitGuardian account, and the skill explicitly forbids substituting the GitGuardian MCP scan tool for the CLI.",
      "provenance": "verified-org",
      "publisher": "GitGuardian",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "codex"
      ],
      "install": "/plugin marketplace add GitGuardian/agent-skills",
      "url": "https://top-agent-skills.com/skill/gitguardian-secret-scanning",
      "json": "https://top-agent-skills.com/skill/gitguardian-secret-scanning.json"
    },
    {
      "rank": 5,
      "slug": "trail-of-bits",
      "name": "trail-of-bits",
      "score": 49,
      "tagline": "Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.",
      "bestFor": "Pre-release vulnerability scans, ongoing security review.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Trail of Bits",
      "license": "Apache-2.0",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add trailofbits/skills",
      "url": "https://top-agent-skills.com/skill/trail-of-bits",
      "json": "https://top-agent-skills.com/skill/trail-of-bits.json"
    },
    {
      "rank": 6,
      "slug": "owasp-security-skills",
      "name": "code-review-security",
      "score": 49,
      "tagline": "OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.",
      "bestFor": "Pre-merge security gates mapped to a standard a reviewer can cite, and threat modelling multi-agent systems against the OWASP Multi-Agentic guide and CSA MAESTRO layers.",
      "notIdealFor": "Vendoring into a product. The bundle is CC-BY-4.0 — a content licence, not a software licence — so check your obligations before redistributing the rules.",
      "provenance": "verified-org",
      "publisher": "OWASP Foundation",
      "license": "CC-BY-4.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "/plugin marketplace add OWASP/secure-agent-playbook",
      "url": "https://top-agent-skills.com/skill/owasp-security-skills",
      "json": "https://top-agent-skills.com/skill/owasp-security-skills.json"
    },
    {
      "rank": 7,
      "slug": "shannon",
      "name": "shannon",
      "score": 48,
      "tagline": "Real exploits, no false positives. 96.15% exploit success across 50+ vuln types.",
      "bestFor": "Bug bounty triage, real-world exploitability validation.",
      "notIdealFor": "Anything that should not be touched without explicit authorization — this skill takes action.",
      "provenance": "verified-org",
      "publisher": "KeygraphHQ",
      "license": "AGPL-3.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx @keygraph/shannon setup",
      "url": "https://top-agent-skills.com/skill/shannon",
      "json": "https://top-agent-skills.com/skill/shannon.json"
    },
    {
      "rank": 8,
      "slug": "snyk-fix",
      "name": "snyk-fix",
      "score": 48,
      "tagline": "The remediation half of security work: scan, fix, validate the fix, open the PR. Batch mode handles a whole backlog of CVEs in one pass.",
      "bestFor": "Closing the loop from finding to validated fix to pull request, rather than producing another list of vulnerabilities nobody has time to triage.",
      "notIdealFor": "Environments without Snyk. It requires the Snyk MCP server and an authenticated account, plus the GitHub CLI for PR creation — and it edits files, so review its diffs like any other agent-authored change.",
      "provenance": "verified-org",
      "publisher": "Snyk",
      "license": "Apache-2.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "curl -fsSL 'https://raw.githubusercontent.com/snyk/studio-recipes/main/installer/dist/snyk-studio-install.sh' -o snyk-studio-install.sh",
      "url": "https://top-agent-skills.com/skill/snyk-fix",
      "json": "https://top-agent-skills.com/skill/snyk-fix.json"
    },
    {
      "rank": 9,
      "slug": "security-review",
      "name": "security-review",
      "score": 48,
      "tagline": "Pre-merge security sweep on the current branch's diff.",
      "bestFor": "Every PR before merge — catches the mechanical security issues a hurried human review misses.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Built into Claude Code. Invoke with /security-review.",
      "url": "https://top-agent-skills.com/skill/security-review",
      "json": "https://top-agent-skills.com/skill/security-review.json"
    },
    {
      "rank": 10,
      "slug": "code-review-plugin",
      "name": "code-review-plugin",
      "score": 45,
      "tagline": "Structured PR reviews with severity-tagged findings — bugs, security, perf, style.",
      "bestFor": "Pre-merge review with consistent format that PR comments can quote directly.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Bundled with Claude Code — invoke with /review.",
      "url": "https://top-agent-skills.com/skill/code-review-plugin",
      "json": "https://top-agent-skills.com/skill/code-review-plugin.json"
    },
    {
      "rank": 11,
      "slug": "k8s-security-policies",
      "name": "k8s-security-policies",
      "score": 40,
      "tagline": "Kubernetes hardening by the book. NetworkPolicies, RBAC, OPA, service mesh.",
      "bestFor": "Hardening k8s clusters before they ship.",
      "notIdealFor": null,
      "provenance": "community",
      "publisher": "jeffallan",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor"
      ],
      "install": "npx skills add jeffallan/claude-skills --skill k8s-security-policies",
      "url": "https://top-agent-skills.com/skill/k8s-security-policies",
      "json": "https://top-agent-skills.com/skill/k8s-security-policies.json"
    },
    {
      "rank": 12,
      "slug": "ffuf-web-fuzzing",
      "name": "ffuf-web-fuzzing",
      "score": 36,
      "tagline": "ffuf web fuzzing for authorized pentests. Common modes, payloads, and gotchas.",
      "bestFor": "Authorized pentest engagements where ffuf is part of the stack.",
      "notIdealFor": "Anything not explicitly authorized — fuzzing third-party hosts is hostile.",
      "provenance": "community",
      "publisher": "jthack",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx skills add jthack/ffuf_claude_skill",
      "url": "https://top-agent-skills.com/skill/ffuf-web-fuzzing",
      "json": "https://top-agent-skills.com/skill/ffuf-web-fuzzing.json"
    }
  ],
  "faqs": [
    {
      "question": "What does the security-review Skill check for?",
      "answer": "Injection (SQL, command, XSS), auth bypass, race conditions, missing input validation, hardcoded secrets, insecure deserialization, SSRF, and the OWASP Top 10. It runs on the current branch's diff."
    },
    {
      "question": "Are these Skills safe for offensive security work?",
      "answer": "We rank Skills for defensive security, authorized pentesting, CTF, and security research. Skills focused on destructive techniques, DoS, mass targeting or detection evasion are not listed."
    },
    {
      "question": "Do I need an MCP server for security Skills?",
      "answer": "Some pair with Snyk, GitHub Advanced Security, AWS, or PagerDuty MCP servers for live data. Pure rule-based scanners run standalone inside the agent."
    },
    {
      "question": "How do these Skills handle false positives?",
      "answer": "The best Skills require a justification before flagging — they explain why a pattern matched and what the exploit would look like. This keeps the noise floor low enough to act on findings."
    },
    {
      "question": "Can a Skill replace a real security audit?",
      "answer": "No. It is a first pass that catches mechanical issues — the same things a senior engineer would catch with hours of careful reading. Real audits cover architecture, key management, and business logic that no Skill can model."
    }
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Top Agent Skills (https://top-agent-skills.com)"
}