🔒Security Operations Skills
Browse the best Security Operations skills for Claude Code, Codex, Cursor and other AI agents.
1,204 skills · Page 2 of 51
secret-scanner
★ 69Detects API keys, passwords, and secrets in code before they reach git. Use before commits, when working with credentials, or when user mentions "security check" or "secrets".
oauth-implementation
★ 25Implement secure OAuth 2.0, OpenID Connect (OIDC), JWT authentication, and SSO integration. Use when building secure authentication systems for web and mobile applications.
compliance-auditor
★ 21Expert compliance auditor specializing in regulatory frameworks, data privacy laws, and security standards. Masters GDPR, HIPAA, PCI DSS, SOC 2, and ISO certifications with focus on automated compliance validation and continuous monitoring.
security-engineer
★ 21Expert infrastructure security engineer specializing in DevSecOps, cloud security, and compliance frameworks. Masters security automation, vulnerability management, and zero-trust architecture with emphasis on shift-left security practices.
equilateral-agents
★ 1722 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).
rails-aisecurity
★ 15CRITICAL - Use when securing Rails applications - XSS, SQL injection, CSRF, file uploads, command injection prevention
vulnerability-assessor
★ 10Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
security-dependency-scanning
★ 9Guide for conducting comprehensive web dependency security scans to identify outdated libraries, CVEs, and security misconfigurations. Use when analyzing deployed websites for dependency vulnerabilities.
cve-search
★ 5Searches the NIST NVD database for CVE vulnerabilities using API 2.0. Returns CVE details, CVSS scores, affected software, and references. Use when user asks about "CVE", "vulnerability database", "NIST", "NVD", "security advisory", "CVE-2024", "CVE-2023", "脆弱性", "セキュリティアドバイザリ", or wants to find known vulnerabilities for specific software.
quality-critic
★ 5Adversarial validation for all stages. Detects fabrications, identifies analytical flaws, challenges assumptions, makes approval decisions. Seeks problems rather than confirming quality. Does NOT complete deliverables or fix issues.
detection-sigma
★ 4Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.
k8s-security
★ 4Kubernetes and OpenShift security assessment, hardening, and compliance. Use this skill when:(1) Auditing cluster or workload security posture(2) Implementing Pod Security Standards/Admission(3) Configuring RBAC roles and permissions(4) Setting up NetworkPolicies for zero-trust(5) Managing Secrets securely (encryption, external secrets)(6) Scanning images for vulnerabilities(7) Implementing OCP SecurityContextConstraints(8) Compliance checking (CIS benchmarks, SOC2, PCI-DSS)(9) Security incident investigation(10) Hardening cluster components
cryptographic-practices
★ 3暗号化・ハッシュ・CSPRNG・鍵管理の実装を安全に進めるためのスキル。要件整理から設計、実装、監査までの一連フローを提供する。Anchors:• Applied Cryptography / 適用: アルゴリズム選定と強度判断 / 目的: 標準準拠の基礎固め• Web Application Security / 適用: 脅威モデリング / 目的: 実装リスクの明確化• NIST SP 800-57 / 適用: 鍵管理 / 目的: ライフサイクル設計Trigger:Use when implementing cryptographic functions, selecting algorithms, generating secure random values, managing encryption keys, or auditing crypto implementations.cryptographic practices, crypto implementation, key management, csprng, algorithm selection
zero-day-hunting-methodology
★ 3Systematic approach to discovering novel vulnerabilities through code analysis, fuzzing, and attack surface research
sinatra-security
★ 3Security best practices for Sinatra applications including input validation, CSRF protection, and authentication patterns. Use when hardening applications or conducting security reviews.
crypto
★ 2Client-side cryptography with libsodium. Use when working on files in src/lib/crypto/.
ipsw
★ 2Apple firmware and binary reverse engineering with the ipsw CLI tool. Use when analyzing iOS/macOS binaries, disassembling functions in dyld_shared_cache, dumping Objective-C headers from private frameworks, downloading IPSWs or kernelcaches, extracting entitlements, analyzing Mach-O files, or researching Apple security. Triggers on requests involving Apple RE, iOS internals, kernel analysis, KEXT extraction, or vulnerability research on Apple platforms.
security-analyzer
★ 2Comprehensive security vulnerability analysis for codebases and infrastructure. Scans dependencies (npm, pip, gem, go, cargo), containers (Docker, Kubernetes), cloud IaC (Terraform, CloudFormation), and detects secrets exposure. Fetches live CVE data from OSV.dev, calculates risk scores, and generates phased remediation plans with TDD validation tests. Use when users mention security scan, vulnerability, CVE, exploit, security audit, penetration test, OWASP, hardening, dependency audit, container security, or want to improve security posture.
security-engineer
★ 2Implement security best practices across the application stack. Use when securing APIs, implementing authentication, preventing vulnerabilities, or conducting security reviews. Covers OWASP Top 10, auth patterns, input validation, encryption, and security monitoring.
security-architect
★ 2Comprehensive security architecture combining threat modeling, security-first design, secure coding review, and compliance validation. Consolidated from threat-modeling, security-first-design, secure-coding-review, and compliance-validator.
isms-specialist
★ 2Expert for Information Security Management Systems (ISMS) according to ISO 27001:2022, with deep knowledge of BaFin requirements, EU-DORA, NIS2, and German regulatory landscape. Specializes in data reuse patterns, workflow optimization, and compliance automation. Automatically activated for ISO 27001, BaFin, DORA, NIS2, compliance frameworks, and ISMS topics.
dpo-specialist
★ 2Expert Data Protection Officer (Datenschutzbeauftragter) with deep knowledge of EU GDPR (DSGVO), German BDSG, and ISO 27701:2025/2019 (PIMS). Specializes in smart integration with existing ISMS infrastructure using Data Reuse principles. Automatically activated when user asks about data protection, privacy, GDPR/DSGVO, BDSG, personal data, DPIA/DSFA, consent, data subject rights, ISO 27701, PIMS, or data breaches.
security-review
★ 1MANDATORY for security-sensitive code changes - OWASP-based security review with dedicated checklist, required before PR for auth, input handling, API, database, or credential code
semgrep-security
★ 1Semgrep code security scanning and SAST analysis