ai-security
From the author
Six-phase security audit of a codebase — web apps, APIs, services, CLI tools, libraries, and daemons — with adversarial validation: the agent that verifies a finding is never the one that found it. Recon, parallel hunting across 8 attack classes, validation, reporting, schema-validated findings.json, and independent verification. Only exploitable issues with real impact are reported — never theoretical concerns or industry-standard behavior. Use when a milestone declares a security audit, when findings must be validated adversarially, or for trigger phrases "security review", "audit for vulnerabilities", "find security bugs", and "pen-test the code". Not for diagnosing a runtime failure — use /ai-debug. Not for judging a diff for correctness — use /ai-verify.
Install
npx skills add arcasilesgroup/ai-engineering --skill ai-security -a claude-code
Installs to .claude/skills/ai-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 76
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- ai-verifyarcasilesgroup/ai-engineeringUse when work has to be verified — "verify the feature", "did we build what was asked", "review this diff", "is it ready to commit" — by choosing the right verification tier (standalone, embedded, or chain) and producing verdicts with evidence, not impressions. Not for milestone-declared security audits — use /ai-security. Not for diagnosing a failure — use /ai-debug.Security★ 61
- security-reviewgithub/awesome-copilotAI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.Security★ 40.4K
- security-auditcloudflare/security-audit-skillSecurity guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.OfficialSecurity★ 47.9K
- ai-debugarcasilesgroup/ai-engineeringFinds the root cause of broken behaviour and names it at file:line, then writes the check that fails for that reason before changing anything. Also resolves merge and rebase conflicts by intent rather than by taking a side. Trigger for "it's not working", "this used to work", "I'm getting an error", "CI is failing", "why is X happening", "I have conflicts", "the rebase failed". Not for adding test coverage to working code — use /ai-verify. Not for exploring an unfamiliar area — use /ai-explore. Not for designing the fix — once the cause is named, use /ai-orchestrator. Not for reporting the fault to outsiders — use /ai-issue-report.Engineering★ 61
- skill-security-auditoreigent-ai/eigentSecurity auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.Security★ 15.7K
- security-reviewerJeffallan/claude-skillsIdentifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.Security★ 12.1K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in