{ "$schema": "https://top-agent-skills.com/schemas/catalog.v1.json", "type": "vertical-category", "slug": "security", "title": "Security", "shortTitle": "Security", "description": "Audit, threat modeling, vuln scanning, compliance — defensive and offensive.", "canonical": "https://top-agent-skills.com/top-skills-for-security", "alternates": { "html": "https://top-agent-skills.com/top-skills-for-security", "markdown": "https://top-agent-skills.com/top-skills-for-security.md", "json": "https://top-agent-skills.com/top-skills-for-security.json" }, "rubricVersion": "1.0", "methodology": "https://top-agent-skills.com/about/methodology", "contentLastUpdated": "2026-08-18", "count": 12, "topPick": { "slug": "agent-email-inbox", "name": "agent-email-inbox", "score": 59, "tagline": "Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.", "url": "https://top-agent-skills.com/skill/agent-email-inbox" }, "ranking": [ { "rank": 1, "slug": "agent-email-inbox", "name": "agent-email-inbox", "score": 59, "tagline": "Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.", "bestFor": "Letting an agent receive and act on email safely — support triage, email-to-task pipelines, automated replies with content-safety guards.", "notIdealFor": "Outbound-only sending — use the resend skill; this one is about securely processing inbound mail.", "provenance": "verified-org", "publisher": "Resend", "license": "MIT", "compatibility": [ "claude-code", "cursor", "codex" ], "install": "npx skills add resend/resend-skills", "url": "https://top-agent-skills.com/skill/agent-email-inbox", "json": "https://top-agent-skills.com/skill/agent-email-inbox.json" }, { "rank": 2, "slug": "workos", "name": "workos", "score": 54, "tagline": "Full-stack WorkOS implementation with auth provider migration paths.", "bestFor": "Adding WorkOS auth to a new app, or migrating from Auth0/Clerk/Cognito/Firebase/Supabase/Stytch/Descope/Better Auth.", "notIdealFor": null, "provenance": "anthropic", "publisher": "Anthropic", "license": "MIT", "compatibility": [ "claude-code", "cursor", "codex", "antigravity" ], "install": "Built into Claude Code. Invoke with /workos.", "url": "https://top-agent-skills.com/skill/workos", "json": "https://top-agent-skills.com/skill/workos.json" }, { "rank": 3, "slug": "semgrep-scan", "name": "semgrep", "score": 52, "tagline": "Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.", "bestFor": "Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express.", "notIdealFor": "Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product.", "provenance": "verified-org", "publisher": "Semgrep", "license": "Semgrep Rules License v1.0", "compatibility": [ "claude-code" ], "install": "npx skills add semgrep/skills", "url": "https://top-agent-skills.com/skill/semgrep-scan", "json": "https://top-agent-skills.com/skill/semgrep-scan.json" }, { "rank": 4, "slug": "semgrep-code-security", "name": "code-security", "score": 52, "tagline": "A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.", "bestFor": "Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP.", "notIdealFor": "Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards.", "provenance": "verified-org", "publisher": "Semgrep", "license": "Semgrep Rules License v1.0", "compatibility": [ "claude-code" ], "install": "npx skills add semgrep/skills", "url": "https://top-agent-skills.com/skill/semgrep-code-security", "json": "https://top-agent-skills.com/skill/semgrep-code-security.json" }, { "rank": 5, "slug": "gitguardian-secret-scanning", "name": "scan-secrets", "score": 50, "tagline": "GitGuardian's own secret-detection skill — scans history, images and packages, and ships a written remediation doctrine rather than just a list of hits.", "bestFor": "Catching a credential before it reaches a remote, and knowing what to do about one already committed — the bundled doctrine covers rotation triggers and history rewriting, not just detection.", "notIdealFor": "Zero-setup use. It requires the ggshield CLI and an authenticated GitGuardian account, and the skill explicitly forbids substituting the GitGuardian MCP scan tool for the CLI.", "provenance": "verified-org", "publisher": "GitGuardian", "license": "MIT", "compatibility": [ "claude-code", "codex" ], "install": "/plugin marketplace add GitGuardian/agent-skills", "url": "https://top-agent-skills.com/skill/gitguardian-secret-scanning", "json": "https://top-agent-skills.com/skill/gitguardian-secret-scanning.json" }, { "rank": 6, "slug": "trail-of-bits", "name": "trail-of-bits", "score": 49, "tagline": "Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.", "bestFor": "Pre-release vulnerability scans, ongoing security review.", "notIdealFor": null, "provenance": "verified-org", "publisher": "Trail of Bits", "license": "Apache-2.0", "compatibility": [ "claude-code", "cursor", "codex" ], "install": "npx skills add trailofbits/skills", "url": "https://top-agent-skills.com/skill/trail-of-bits", "json": "https://top-agent-skills.com/skill/trail-of-bits.json" }, { "rank": 7, "slug": "owasp-security-skills", "name": "code-review-security", "score": 49, "tagline": "OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.", "bestFor": "Pre-merge security gates mapped to a standard a reviewer can cite, and threat modelling multi-agent systems against the OWASP Multi-Agentic guide and CSA MAESTRO layers.", "notIdealFor": "Vendoring into a product. The bundle is CC-BY-4.0 — a content licence, not a software licence — so check your obligations before redistributing the rules.", "provenance": "verified-org", "publisher": "OWASP Foundation", "license": "CC-BY-4.0", "compatibility": [ "claude-code" ], "install": "/plugin marketplace add OWASP/secure-agent-playbook", "url": "https://top-agent-skills.com/skill/owasp-security-skills", "json": "https://top-agent-skills.com/skill/owasp-security-skills.json" }, { "rank": 8, "slug": "shannon", "name": "shannon", "score": 48, "tagline": "Real exploits, no false positives. 96.15% exploit success across 50+ vuln types.", "bestFor": "Bug bounty triage, real-world exploitability validation.", "notIdealFor": "Anything that should not be touched without explicit authorization — this skill takes action.", "provenance": "verified-org", "publisher": "KeygraphHQ", "license": "AGPL-3.0", "compatibility": [ "claude-code" ], "install": "npx @keygraph/shannon setup", "url": "https://top-agent-skills.com/skill/shannon", "json": "https://top-agent-skills.com/skill/shannon.json" }, { "rank": 9, "slug": "snyk-fix", "name": "snyk-fix", "score": 48, "tagline": "The remediation half of security work: scan, fix, validate the fix, open the PR. Batch mode handles a whole backlog of CVEs in one pass.", "bestFor": "Closing the loop from finding to validated fix to pull request, rather than producing another list of vulnerabilities nobody has time to triage.", "notIdealFor": "Environments without Snyk. It requires the Snyk MCP server and an authenticated account, plus the GitHub CLI for PR creation — and it edits files, so review its diffs like any other agent-authored change.", "provenance": "verified-org", "publisher": "Snyk", "license": "Apache-2.0", "compatibility": [ "claude-code" ], "install": "curl -fsSL 'https://raw.githubusercontent.com/snyk/studio-recipes/main/installer/dist/snyk-studio-install.sh' -o snyk-studio-install.sh", "url": "https://top-agent-skills.com/skill/snyk-fix", "json": "https://top-agent-skills.com/skill/snyk-fix.json" }, { "rank": 10, "slug": "security-review", "name": "security-review", "score": 48, "tagline": "Pre-merge security sweep on the current branch's diff.", "bestFor": "Every PR before merge — catches the mechanical security issues a hurried human review misses.", "notIdealFor": null, "provenance": "anthropic", "publisher": "Anthropic", "license": "MIT", "compatibility": [ "claude-code" ], "install": "Built into Claude Code. Invoke with /security-review.", "url": "https://top-agent-skills.com/skill/security-review", "json": "https://top-agent-skills.com/skill/security-review.json" }, { "rank": 11, "slug": "k8s-security-policies", "name": "k8s-security-policies", "score": 40, "tagline": "Kubernetes hardening by the book. NetworkPolicies, RBAC, OPA, service mesh.", "bestFor": "Hardening k8s clusters before they ship.", "notIdealFor": null, "provenance": "community", "publisher": "jeffallan", "license": "MIT", "compatibility": [ "claude-code", "cursor" ], "install": "npx skills add jeffallan/claude-skills --skill k8s-security-policies", "url": "https://top-agent-skills.com/skill/k8s-security-policies", "json": "https://top-agent-skills.com/skill/k8s-security-policies.json" }, { "rank": 12, "slug": "ffuf-web-fuzzing", "name": "ffuf-web-fuzzing", "score": 36, "tagline": "ffuf web fuzzing for authorized pentests. Common modes, payloads, and gotchas.", "bestFor": "Authorized pentest engagements where ffuf is part of the stack.", "notIdealFor": "Anything not explicitly authorized — fuzzing third-party hosts is hostile.", "provenance": "community", "publisher": "jthack", "license": "MIT", "compatibility": [ "claude-code" ], "install": "npx skills add jthack/ffuf_claude_skill", "url": "https://top-agent-skills.com/skill/ffuf-web-fuzzing", "json": "https://top-agent-skills.com/skill/ffuf-web-fuzzing.json" } ], "faqs": [ { "question": "Are offensive-security Skills listed?", "answer": "We rank Skills for defensive security, authorized pentesting, CTF, and security research. Destructive techniques, mass-targeting, supply-chain compromise and detection evasion are out of scope." }, { "question": "Do these Skills cover compliance evidence?", "answer": "Yes — several Skills generate the evidence artifacts that SOC 2 / ISO 27001 / HIPAA audits require, mapping controls to existing system behaviors." }, { "question": "Can a Skill replace a real security audit?", "answer": "No — they catch mechanical issues. Real audits cover architecture, key management, business logic and threat-model accuracy that no Skill can model." }, { "question": "Are incident-response Skills useful?", "answer": "Yes — they walk through triage, severity assessment, status communication, and the blameless postmortem template. They work best paired with PagerDuty MCP for alert context." }, { "question": "How do threat-modeling Skills work?", "answer": "They take an architecture diagram or system description and produce a STRIDE or LINDDUN model. The output is a starting point; real threat models need iteration with the engineering team." } ], "license": "https://creativecommons.org/licenses/by/4.0/", "attribution": "Top Agent Skills (https://top-agent-skills.com)" }