Security & AppSec agent skills, benchmarked

Starter skills

The skills selected when you create this agent. You can change the selection first.

IAM Least-Privilege Reviewiam-least-privilege-reviewCautionReviews an existing IAM / RBAC policy for grants that are broader than the workload needs — wildcard actions (`*`, `s3:*`), `Resource: "*"`, unscoped `iam:PassRole`…91Graded differently91%

Secret Finding Triagesecret-finding-triageUse after a secret scanner has already flagged a match — decides whether the hit is a real leaked credential or a false positive (test fixture, documented example, placeholder)…100Graded differently100%

STRIDE Threat Modelingthreat-model-strideThreat-models a described system by enumerating trust boundaries, running STRIDE at each, and mapping every threat to its control family.NewGraded differently—

IaC Misconfig Reviewiac-misconfig-reviewReviews infrastructure-as-code and container config — Terraform, a Kubernetes manifest, a Dockerfile, a docker-compose file — for insecure defaults and misconfigurations…94Graded differently94%

Agent Owasp Complianceagent-owasp-complianceEvaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.82+55 pts vs. no skill100%

Auth Flow Reviewauth-flow-reviewReviews an authentication or session flow against the standard auth-weakness set — session fixation, missing rotation, weak reset tokens, JWT algorithm confusion, and unthrottled…100Graded differently100%

Dependency CVE Triagedependency-cve-triageTriages a known CVE in a dependency by reachability and exposure — is the vulnerable code actually reached, is it fed untrusted input, does a fix exist — to decide fix-now vs…100Graded differently100%

Thedaviddias/Stack Trace Exposurethedaviddias/stack-trace-exposureUse when reviewing error handling middleware, API route handlers, or server responses for security-sensitive information disclosure.100—100%

SkillScore (0–100) is how the registry ranks a skill. It blends the evidence below.+N pts is the pass-rate gain when the same tests run with and without the skill. “Graded differently” means the two runs can’t be compared.N% passed is the share of graded real runs that passed, over the skill’s lifetime.

Want a different mix? You can add, swap or remove skills before you create the agent.

Starter system prompt

18 lines. Short on purpose: the skills carry the policies. Edit it to fit your product before your agent runs.

You are the application-security reviewer for <your product or codebase>. Your job is to
find real, reachable weaknesses in code, config, and design, and rate them honestly.

You may: review code, dependencies, IaC and IAM policy, and auth flows; threat-model a
design; triage scanner hits and CVEs by reachability and exposure; and write findings with
severity, evidence, and a fix.
You may NOT: run exploits or scans against anything outside <the scope you were authorized
to test>; change production, or rotate, revoke, or use a credential you find; reproduce a
discovered secret in plain text; or declare a system secure, compliant, or audit-ready —
you produce findings and evidence, a human signs off.

Tools: <only what your code attaches — if none are attached, answer without calling any>.

Lean on your installed skills — they carry the review checklists, the threat-model method,
triage and severity rules, and the evidence format. Use the skill the router surfaces for
the artifact in front of you rather than free-forming.

Baseline tone: specific and non-alarmist — a finding names the path and the impact.

Add more when you need them

Security & AppSec skills you can add to the agent before or after you create it.

Dokhacgiakhoa/Security Scanning ToolsThis skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application…100+5 pts22/22 Waynesutton/Convex Security CheckQuick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment…100+27 pts22/22 Cyberstrikeus/T0820 Exploitation For EvasionAdversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating…100+57 pts23/23 Thedaviddias/Referrer PolicyUse when reviewing HTTP response headers for privacy hardening on any website that handles authentication, session state, or sensitive URL…100+17 pts23/23 A5c AI/Iac Security ScannerInfrastructure as Code security scanning and policy enforcement for Terraform, CloudFormation, Kubernetes, and Pulumi99+57 pts23/23 A5c AI/Keychain Credential ManagerManage credentials in OS keychains across Windows, macOS, and Linux98+45 pts22/22

108 live skills tagged Security & AppSecBrowse them in the registry →

Ready to supercharge your AI agents?

Security & AppSec pack

Starter skills

Starter system prompt

Add more when you need them