/securityskills

The offensive & defensive skills registry

Security Skills

Security work is procedural.
So ship the procedures.

Recon, exploitation, hardening, response and audit — written as reviewable SKILL.md procedures your agent loads on demand.

Browse 21 skillsRead the CLI docs
skills
21
skills
domains
13
domains
phases
5
phases
agents
77
agents

Install any skill

no repo to clone
npx skills add securityskills/skills

— the whole catalog, or one skill by URL from its page

Verified with

  • claude code
  • codex
  • cursor
  • opencode
  • windsurf
  • gemini cli
  • amp
  • cline
  • zed

Every procedure documents authorized testing only. Know your scope.

Engagement chain

tagged by where a skill lands, not just its domain

  1. 0Recon01map the surface
  2. 3Exploit02prove the impact
  3. 0Harden03close the gap
  4. 0Respond04contain the event
  5. 0Attest05prove it to auditors
Exploit3prove the impact
01
jwt-security-review

Audit JSON Web Token implementations for algorithm confusion, weak secrets, missing validation, and token lifecycle flaws.

Web App Security4 installs

02
owasp-top10-analysis

Systematically review a web application against the OWASP Top 10 vulnerability classes with concrete test cases per category.

Web App Security3 installs

03
ssrf-hunting

Find and exploit Server-Side Request Forgery across URL-fetching features, including cloud metadata bypasses and blind SSRF techniques.

Web App Security3 installs

Coverage map

14 of 65 cells mapped — claim a gap →

Where the registry is deep and where it is open. Hollow cells are the roadmap, not padding.

DomainReconExploitHardenRespondAttest
Penetration Testing·2···
Bug Bounty·2···
Web Application Security·3···
Cloud Security··1··
Container & Kubernetes Security··2··
Network Security··1··
Recon & OSINT1····
Digital Forensics···1·
Malware Analysis···1·
Compliance····3
Secure Code Review··1··
Threat Modeling··1··
Agentic & AI Security··1·1

How it works

01

Pick a skill

Every entry is a plain SKILL.md — frontmatter plus a markdown procedure. Read it before you install it.

02

Install it

The skills CLI writes it into your agent's skills directory. One command, no repo to clone.

03

Use it

Your agent loads the skill when a task matches its description, and follows the procedure step by step.