/securityskills

The offensive & defensive skills registry

Security Skills

Security work is procedural.
So ship the procedures.

Recon, exploitation, hardening, response and audit — written as reviewable SKILL.md procedures your agent loads on demand.

Browse 21 skillsRead the CLI docs
skills
21
skills
domains
13
domains
phases
5
phases
agents
77
agents

Install any skill

no repo to clone
npx skills add securityskills/skills

— the whole catalog, or one skill by URL from its page

Verified with

  • claude code
  • codex
  • cursor
  • opencode
  • windsurf
  • gemini cli
  • amp
  • cline
  • zed

Every procedure documents authorized testing only. Know your scope.

Engagement chain

tagged by where a skill lands, not just its domain

  1. 0Recon01map the surface
  2. 0Exploit02prove the impact
  3. 0Harden03close the gap
  4. 0Respond04contain the event
  5. 1Attest05prove it to auditors

no skill matches "compliance · gdpr · respond"

Coverage map

14 of 65 cells mapped — claim a gap →

Where the registry is deep and where it is open. Hollow cells are the roadmap, not padding.

DomainReconExploitHardenRespondAttest
Penetration Testing·2···
Bug Bounty·2···
Web Application Security·3···
Cloud Security··1··
Container & Kubernetes Security··2··
Network Security··1··
Recon & OSINT1····
Digital Forensics···1·
Malware Analysis···1·
Compliance····3
Secure Code Review··1··
Threat Modeling··1··
Agentic & AI Security··1·1

How it works

01

Pick a skill

Every entry is a plain SKILL.md — frontmatter plus a markdown procedure. Read it before you install it.

02

Install it

The skills CLI writes it into your agent's skills directory. One command, no repo to clone.

03

Use it

Your agent loads the skill when a task matches its description, and follows the procedure step by step.