Best Claude skills for security
Security skills range from Cloudflare's multi-phase security audit to hundreds of structured cybersecurity playbooks mapped to MITRE ATT&CK and NIST. Use them to audit your own code, harden infrastructure or practice CTF challenges. Always stay within systems you are authorized to test.
272 security skills · ranked live · November 2026
The top 10. Ranked by the Alyn Score.
- 1#1
affaan-m
Accessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
Pack301k1.7MScore 89 - 2#2
Agent Security Hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
Pack301k1.7MScore 89 - 3#3
Addy Osmani
Security And Hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
Pack115k1.8MScore 87 - 4#4
morluto
Rea Analysis Optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
Pack450k29kScore 85 - 5#5
Rea Ci Tests Audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
Pack450k29kScore 85 - 6#6
Reverse Engineer Anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
Pack450k29kScore 85 - 7#7
wshobson
Agents
wshobson
Screen Reader Testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
Pack42k2.6MScore 85 - 8#8
GitHub
Awesome Copilot
GitHub
Agent Owasp Compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
Pack41k2.4MScore 83 - 9#9
GitHub
Awesome Copilot
AI Prompt Engineering Safety Review
Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement…
Pack41k2.4MScore 83 - 10#10
davila7
Owasp Security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and…
Pack33k285kScore 82
What makes a great security skill.
Findings with evidence and severity, not speculative warnings.
Clear scope rules: only systems you own or are authorized to test.
Machine-readable output you can track over time.
All 272 security skills.
rshankras
Claude Code Apple Skills
rshankrasrelease-review
Senior developer-level release review for macOS/iOS apps. Identifies security, privacy, UX, and distribution issues with actionable fixes. Use when preparing an app for release, want a…
itsmostafa
Aws Agent Skills
itsmostafasecrets-manager
AWS Secrets Manager for secure secret storage and rotation. Use when storing credentials, configuring automatic rotation, managing secret versions, retrieving secrets in applications, or…
OneWave-AI
Claude Skills
OneWave-AIaccessibility-auditor
Audit websites for accessibility issues and WCAG compliance. Use when checking accessibility, fixing a11y issues, or ensuring WCAG compliance.
rrezartprebreza
Spring Boot Skills
rrezartprebrezajava-supply-chain-security
Use when reviewing Maven or Gradle dependency risk, SBOM coverage, vulnerability findings, or Java release provenance. Covers compatible remediation and CI trust boundaries; container…
aipoch
Medical Research Skills
aipochreporting-guideline-compliance-checker
Checks biomedical manuscripts against reporting guidelines such as CONSORT, STROBE, PRISMA, and TRIPOD to identify missing or weak reporting elements before submission or revision.
waynesutton
Builder Skills
waynesuttonconvex-security-audit
Retired. Points to the skill that replaced convex-security-audit in builder-skills 3.0. Use when /convex-security-audit is invoked by name or the user asks where convex-security-audit went.
waynesutton
Builder Skills
waynesuttonconvex-security-check
Retired. Points to the skill that replaced convex-security-check in builder-skills 3.0. Use when /convex-security-check is invoked by name or the user asks where convex-security-check went.
rshankras
Claude Code Apple Skills
rshankraslegal
Legal document generation and compliance guidance for indie Apple developers. Covers privacy policies, terms of service, EULAs, GDPR/CCPA/DPDP compliance, and Apple App Store legal…
LeoYeAI
Agent Master Skills
LeoYeAIaccessibility-compliance
Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns…
growthenginenowoslawski
Coldoutboundskills
growthenginenowoslawskideliverability-incident-response
Triage playbook for when cold email deliverability breaks. Decision-tree guidance for "I landed in spam", "bounce rate spiked", "domain blacklisted", "inbox blocked in warmup", "reply rate…
rshankras
Claude Code Apple Skills
rshankrassecurity
Security category index for Apple platforms. Routes to the privacy-manifests skill. General secure-storage/biometrics/ATS guidance was retired in the 2026 blind-test audit — current models…
rrezartprebreza
Spring Boot Skills
rrezartprebrezasecurity-audit-logging
Use when designing or reviewing security audit events, their redaction, durable storage, integrity, or failure policies in Spring Boot. General metrics and debugging logs belong to…
seo-skills
SEO Audit Skill
seo-skillsseo-audit
Audit websites for SEO, technical, content, security, JS rendering, and AI readiness using SEOmator CLI. Returns LLM-optimized reports with health scores across 373 rules and 20 categories…
rrezartprebreza
Spring Boot Skills
rrezartprebrezaspring-ai-security
Use when threat-modeling or hardening a Spring AI RAG, chat, or tool-calling workflow against prompt injection, unauthorized actions, data exposure, or unbounded execution. Ordinary…
tjboudreauxthinking-red-team
For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified…
datadrivenconstructionai-act-compliance
Check construction AI systems against the EU AI Act (Regulation 2024/1689): classify risk of estimation, scheduling, CV and agent tools, document transparency, keep human oversight. Use…
BagelHole
DevOps Security Agent Skills
BagelHoleaccess-review
Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.
BagelHole
DevOps Security Agent Skills
BagelHoleagent-evals
Build automated evaluation suites for AI agents using golden datasets, rubrics, and regression gates. Use when shipping agent features, validating prompt changes, or gating deployments on…
BagelHole
DevOps Security Agent Skills
BagelHoleagent-observability
Instrument AI agents with tracing, token metrics, latency, and cost visibility. Use for reliability and debugging.
staruhub
ClaudeSkills
staruhubsecurity-audit
全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描…
laolaoshiren
Claude Code Skills Zh
laolaoshirensecurity-audit
代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践
questflowaieinhorn-forensic-short
Use when evaluating David Einhorn-style forensic shorts and longs: accounting red flags, governance problems, capital allocation failures, and evidence-based short theses.
arpitg1304
Robotics Agent Skills
arpitg1304robotics-security
Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection…
BehiSecc
VibeSec Skill
BehiSeccVibeSec-Skill
This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.
zubair-trabzadalegal-compliance
You are the compliance auditor for /legal compliance <url. You scan a website for compliance gaps across multiple regulatory frameworks and produce a scored compliance audit report with…
zubair-trabzadalegal-privacy
You are the privacy policy generator for /legal privacy <url. You scan a website to detect what data it collects, then generate a comprehensive GDPR and CCPA compliant privacy policy…
zubair-trabzadaterms-of-service-generator
Generates complete, GDPR/CCPA-compliant Terms of Service for a website or SaaS product, with plain English summaries for each section
rohitg00structured-code-review
Performs a structured five-stage code review covering requirements compliance, correctness, code quality, testing, and security/performance. Each stage uses targeted checklists and…
T8marsapparent-vulnerability-readiness-reversal-resumption
Create original short videos using the 伪弱势反转｜困境诱近—准备微证据—能力破局—继续上路 Creative DNA for MiniMax H3 or Seedance 2.0. Use when the user wants this causal, camera, motion, rhythm, or payoff…
morlutorea-changelog-update
Prepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.
morlutorea-tool-design
Audit, investigate, design, or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.
trailofbits
Skills
trailofbitsdimensional-analysis
Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit confusion…
trailofbits
Skills
trailofbitsfirebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for…
trailofbits
Skills
trailofbitsinterpreting-culture-index
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout…
mukul975
Anthropic Cybersecurity Skills
mukul975acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition…
trailofbits
Skills
trailofbitsagentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors…
Security skills, explained.
Also searched as: security audit skill, cybersecurity agent skills, pentest skill, ctf skills.
What are the best Claude skills for security?
Right now the top-ranked security skills on Alyn are Accessibility (affaan-m), Agent Security Hardening (affaan-m), Security And Hardening (Addy Osmani). Rankings combine GitHub stars, installs, freshness and depth, and update live.
What is the Cloudflare security audit skill?
A coding-agent skill from Cloudflare that runs multi-phase security audits and produces independently verified, machine-readable findings.
Can skills themselves be a security risk?
Yes. Skills can include scripts. Read SKILL.md and any bundled scripts before installing, and prefer well-known authors. Alyn shows file counts and links every file.
How do I install a security skill?
Run npx skills add owner/repo in your project, or copy the folder with SKILL.md into ~/.claude/skills. Every skill on this page has a ready-to-copy command.
More in Build
Security skills for your agent