--- title: Top Skills for Security slug: security type: vertical-category canonical: https://top-agent-skills.com/top-skills-for-security skills: 12 rubric: 1.0 updated: 2026-08-18 --- # Top Skills for Security **agent-email-inbox** is the top-ranked security Skill at 59/100: Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email. Audit, threat modeling, vuln scanning, compliance — defensive and offensive. This page lists the Skills useful in this domain, including general-purpose tooling commonly used here — not only Skills built for it. Where a general-purpose Skill outranks the domain-native ones, the introduction below says so. 12 Skills indexed, ranked by a published composite score (https://top-agent-skills.com/about/methodology). Content last changed 2026-08-18. ## The ranking ### 1. agent-email-inbox — score 59/100 (verified-org) Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email. - Best for: Letting an agent receive and act on email safely — support triage, email-to-task pipelines, automated replies with content-safety guards. - Not ideal for: Outbound-only sending — use the resend skill; this one is about securely processing inbound mail. - Publisher: Resend · MIT - Verified on: claude-code, cursor, codex ```bash npx skills add resend/resend-skills ``` Full entry: https://top-agent-skills.com/skill/agent-email-inbox (https://top-agent-skills.com/skill/agent-email-inbox.md) ### 2. workos — score 54/100 (official-anthropic) Full-stack WorkOS implementation with auth provider migration paths. - Best for: Adding WorkOS auth to a new app, or migrating from Auth0/Clerk/Cognito/Firebase/Supabase/Stytch/Descope/Better Auth. - Publisher: Anthropic · MIT - Verified on: claude-code, cursor, codex, antigravity Install: Built into Claude Code. Invoke with /workos. Full entry: https://top-agent-skills.com/skill/workos (https://top-agent-skills.com/skill/workos.md) ### 3. semgrep — score 52/100 (verified-org) Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns. - Best for: Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express. - Not ideal for: Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product. - Publisher: Semgrep · Semgrep Rules License v1.0 - Verified on: claude-code ```bash npx skills add semgrep/skills ``` Full entry: https://top-agent-skills.com/skill/semgrep-scan (https://top-agent-skills.com/skill/semgrep-scan.md) ### 4. code-security — score 52/100 (verified-org) A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration. - Best for: Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP. - Not ideal for: Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards. - Publisher: Semgrep · Semgrep Rules License v1.0 - Verified on: claude-code ```bash npx skills add semgrep/skills ``` Full entry: https://top-agent-skills.com/skill/semgrep-code-security (https://top-agent-skills.com/skill/semgrep-code-security.md) ### 5. scan-secrets — score 50/100 (verified-org) GitGuardian's own secret-detection skill — scans history, images and packages, and ships a written remediation doctrine rather than just a list of hits. - Best for: Catching a credential before it reaches a remote, and knowing what to do about one already committed — the bundled doctrine covers rotation triggers and history rewriting, not just detection. - Not ideal for: Zero-setup use. It requires the ggshield CLI and an authenticated GitGuardian account, and the skill explicitly forbids substituting the GitGuardian MCP scan tool for the CLI. - Publisher: GitGuardian · MIT - Verified on: claude-code, codex ```bash /plugin marketplace add GitGuardian/agent-skills ``` Full entry: https://top-agent-skills.com/skill/gitguardian-secret-scanning (https://top-agent-skills.com/skill/gitguardian-secret-scanning.md) ### 6. trail-of-bits — score 49/100 (verified-org) Security audits run by a real security firm. CodeQL + Semgrep + audit workflows. Full entry: https://top-agent-skills.com/skill/trail-of-bits (https://top-agent-skills.com/skill/trail-of-bits.md) ### 7. code-review-security — score 49/100 (verified-org) OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary. Full entry: https://top-agent-skills.com/skill/owasp-security-skills (https://top-agent-skills.com/skill/owasp-security-skills.md) ### 8. shannon — score 48/100 (verified-org) Real exploits, no false positives. 96.15% exploit success across 50+ vuln types. Full entry: https://top-agent-skills.com/skill/shannon (https://top-agent-skills.com/skill/shannon.md) ### 9. snyk-fix — score 48/100 (verified-org) The remediation half of security work: scan, fix, validate the fix, open the PR. Batch mode handles a whole backlog of CVEs in one pass. Full entry: https://top-agent-skills.com/skill/snyk-fix (https://top-agent-skills.com/skill/snyk-fix.md) ### 10. security-review — score 48/100 (official-anthropic) Pre-merge security sweep on the current branch's diff. Full entry: https://top-agent-skills.com/skill/security-review (https://top-agent-skills.com/skill/security-review.md) ### 11. k8s-security-policies — score 40/100 (community) Kubernetes hardening by the book. NetworkPolicies, RBAC, OPA, service mesh. Full entry: https://top-agent-skills.com/skill/k8s-security-policies (https://top-agent-skills.com/skill/k8s-security-policies.md) ### 12. ffuf-web-fuzzing — score 36/100 (community) ffuf web fuzzing for authorized pentests. Common modes, payloads, and gotchas. Full entry: https://top-agent-skills.com/skill/ffuf-web-fuzzing (https://top-agent-skills.com/skill/ffuf-web-fuzzing.md) ## About this category The best agent Skills for security in 2026 are Trail of Bits' trail-of-bits for an audit run by an actual security firm, Semgrep's official semgrep-code-security for static analysis in the pre-merge loop, and shannon when the question is whether a finding is genuinely exploitable rather than theoretically present. Add GitGuardian for secrets and Snyk for dependency fixes; the combination is what closes the gap between a scanner's output and a fixed branch. Security vertical Skills are the toolkit for security engineers, AppSec leads, and platform teams whose job is to keep the surface defensible — threat modeling, audit, vulnerability scanning, compliance documentation, incident response, secure-code review. The category overlaps the primary security-auditing group but is organized by role and includes governance and compliance work. The common workflows include running a structured pre-merge security review, building a STRIDE threat model from an architecture diagram, auditing a Kubernetes cluster for hardening gaps, generating a SOC 2 or ISO 27001 evidence trail, responding to a security incident with proper triage and communication, and writing customer-facing security documentation. Several pair with Snyk, GitHub Advanced Security, AWS, and PagerDuty MCPs for live scanner and alert data. Security engineers, AppSec leads, CTOs, compliance leads, and DevSecOps teams use these Skills. Composite scoring weights provenance (Trail of Bits, GitHub Security Lab, well-known security orgs), install count, and how clearly the Skill documents the threat model — vague Skills rank below those that name the specific attack surface they cover. ## Common questions **Are offensive-security Skills listed?** We rank Skills for defensive security, authorized pentesting, CTF, and security research. Destructive techniques, mass-targeting, supply-chain compromise and detection evasion are out of scope. **Do these Skills cover compliance evidence?** Yes — several Skills generate the evidence artifacts that SOC 2 / ISO 27001 / HIPAA audits require, mapping controls to existing system behaviors. **Can a Skill replace a real security audit?** No — they catch mechanical issues. Real audits cover architecture, key management, business logic and threat-model accuracy that no Skill can model. **Are incident-response Skills useful?** Yes — they walk through triage, severity assessment, status communication, and the blameless postmortem template. They work best paired with PagerDuty MCP for alert context. **How do threat-modeling Skills work?** They take an architecture diagram or system description and produce a STRIDE or LINDDUN model. The output is a starting point; real threat models need iteration with the engineering team. --- _Top Agent Skills. Machine-readable twin of https://top-agent-skills.com/top-skills-for-security._ _JSON: https://top-agent-skills.com/top-skills-for-security.json · whole catalog: https://top-agent-skills.com/skills.json (CC BY 4.0)_