Cybersecurity Agent Skills
Cybersecurity skills for AI agents cover the full loop of governing risk, knowing what you have, protecting it, noticing incidents, responding, and recovering. That means skills here can help an agent work through questions of accountability and acceptable risk, inventory systems, data, and threats, apply controls, surface signs that something is wrong, limit damage during an incident, and get operations back afterward. Use the ranked list by starting with the sub-topic that matches the job in front of you, then read the skill's description to confirm it addresses that stage rather than a neighboring one. Pick one skill, load it, and see whether its output fits how your team already works. If it does not, move to the next entry in that sub-topic.
8 to start with46 top options
Start with these.
Cybersecurity is a loop, not a product: decide how you will govern risk, know what you have, protect it, notice incidents, respond, and recover.
These are the closest matches for this work. Start with the first one and open it to install.
- Rank 01View Agent SkillDirect
security-threat-model
OfficialRepository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
- Rank 02View Agent SkillDirect
stride-threat-modeling
Runs a STRIDE-based threat modeling workshop: diagram the system, enumerate threats per element, rank them, and drive mitigations into the backlog.
1,153 · popularity - Rank 03View Agent SkillDirect
stride-analysis-patterns
Applies STRIDE methodology to systematically identify threats during threat modeling sessions and security documentation.
18,277 · popularity - Rank 04View Agent SkillDirect
threat-modeling
Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests.
Needs (stated): Credentials
447 · popularity - Rank 05View Agent SkillDirect
threat-modeling-techniques
Threat modeling methodologies using STRIDE, attack trees, and risk assessment for proactive security analysis during system design.
354 · popularity - Rank 06View Agent SkillDirect
threat-modeling-with-aws-security-agent
Runs an AWS Security Agent threat model review on spec/design documents against source code using STRIDE methodology.
1,426 · popularity - Rank 07View Agent SkillDirect
senior-security
Owns STRIDE/DREAD threat modeling with a threat_modeler script and quick secret scan, routing other security requests to specialist skills.
1,220 · popularity - Rank 08View Agent SkillDirect
security-review
Security code review for vulnerabilities with confidence-based reporting, tracing data flow and covering injection, XSS, auth, and crypto issues.
19,221 · popularity
Explore 38 more Agent Skills
- Rank 09View Agent SkillDirect
owasp-audit
Audits application source code against the OWASP Top 10 (2021), covering broken access control, injection, crypto failures, and SSRF.
492 · popularity - Rank 10View Agent SkillDirect
golang-security
Go security best practices and vulnerability prevention covering injection, crypto, SSRF, secrets, STRIDE/DREAD threat modeling, gosec, and fuzz testing.
38,753 · popularity - Rank 11View Agent SkillDirect
application-security-testing
Application security testing across a product, deciding which asset needs which test and turning results into a ranked remediation plan.
8,637 · popularity - Rank 12View Agent SkillDirect
cybersecurity-analyst
Analyzes events through a cybersecurity lens using threat modeling, attack surface analysis, defense-in-depth, and frameworks like CIA, STRIDE, and MITRE ATT&CK.
1,403 · popularity - Rank 13View Agent SkillDirect
security-auditor
Expert security auditor covering DevSecOps, application security, compliance, vulnerability assessment, and threat modeling.
1,396 · popularity - Rank 14View Agent SkillDirect
security-compliance
Guides defense-in-depth security architecture, compliance frameworks, threat modeling, risk assessment, and security operations across the SDLC.
842 · popularity - Rank 15View Agent SkillDirect
testing-api-security-with-owasp-top-10
Systematically assesses REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10 using Burp Suite and Postman.
692 · popularity - Rank 16View Agent SkillDirect
conducting-api-security-testing
Conducts security testing of REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10, covering auth, authorization, and input validation.
605 · popularity - Rank 17View Agent SkillDirect
performing-web-application-penetration-test
Performs systematic web application security testing following the OWASP WSTG methodology using Burp Suite and manual techniques.
599 · popularity - Rank 18View Agent SkillDirect
testing-for-xss-vulnerabilities
Tests web applications for reflected, stored, and DOM-based XSS by injecting payloads with Burp Suite and bypassing sanitization and CSP.
574 · popularity - Rank 19View Agent SkillDirect
azure-compliance
OfficialRuns Azure compliance and security audits with azqr plus Key Vault expiration checks, covering best-practice assessment and security posture.
544,531 · popularity - Rank 20View Agent SkillDirect
information-security-manager-iso27001
Implements ISO 27001 ISMS and cybersecurity governance, covering risk assessments, controls, certification, and incident response.
842 · popularity - Rank 21View Agent SkillDirect
python-cybersecurity-tool-development
Guidelines for building Python cybersecurity tools with secure coding practices, async scanning, and structured security testing.
936 · popularity - Rank 22View Agent SkillDirect
bug-bounty
Complete bug bounty workflow covering recon, vulnerability hunting (IDOR, SSRF, XSS, auth bypass), validation gates, and reporting.
395 · popularity - Rank 23View Agent SkillDirect
analyzing-api-gateway-access-logs
Parses API Gateway access logs to detect BOLA/IDOR, rate limit bypass, credential scanning, and injection attempts using pandas.
Needs (stated): Python
734 · popularity - Rank 24View Agent SkillDirect
analyzing-cyber-kill-chain
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain to identify completed phases and defensive gaps.
593 · popularity - Rank 25View Agent SkillDirect
analyzing-cloud-storage-access-patterns
Detects abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing audit logs for bulk downloads and new-IP access.
Needs (stated): Python
545 · popularity - Rank 26View Agent SkillDirect
analyzing-active-directory-acl-abuse
Detects dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths.
533 · popularity - Rank 27View Agent SkillDirect
analyzing-apt-group-with-mitre-navigator
Queries ATT&CK data and builds MITRE ATT&CK Navigator layers mapping APT group TTPs for detection-gap analysis.
516 · popularity - Rank 28View Agent SkillDirect
analyzing-dns-logs-for-exfiltration
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domains, and covert C2 using entropy and volume anomalies.
516 · popularity - Rank 29View Agent SkillPossible
code-review
Reviews code changes for security, performance, and correctness, including OWASP top 10, injection, and auth flaws.
9,668 · popularity - Rank 30View Agent SkillPossible
best-practices
Applies modern web best practices for security, compatibility, and code quality, based on Lighthouse audits, covering CSP, SRI, and XSS sinks.
26,666 · popularity - Rank 31View Agent SkillPossible
analyzing-certificate-transparency-for-phishing
Monitors Certificate Transparency logs using crt.sh and Certstream to detect phishing domains and unauthorized certificate issuance.
533 · popularity - Rank 32View Agent SkillPossible
analyzing-android-malware-with-apktool
Performs static analysis of Android APK malware using apktool, jadx, and androguard to identify dangerous permissions and suspicious API calls.
643 · popularity - Rank 33View Agent SkillPossible
analyzing-email-headers-for-phishing-investigation
Parses email headers to trace phishing origin and validate SPF, DKIM, and DMARC results to confirm or rule out spoofing.
585 · popularity - Rank 34View Agent SkillPossible
analyzing-docker-container-forensics
Investigates compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts.
563 · popularity - Rank 35View Agent SkillPossible
acquiring-disk-image-with-dd-and-dcfldd
Creates forensically sound bit-for-bit disk images with dd or dcfldd, preserving evidence integrity through hash verification.
652 · popularity - Rank 36View Agent SkillPossible
analyzing-browser-forensics-with-hindsight
Parses Chromium browser databases with Hindsight to extract browsing history, downloads, cookies, and saved passwords into a timeline.
571 · popularity - Rank 37View Agent SkillPossible
entra-app-registration
OfficialGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration, including API permissions and service principals.
545,934 · popularity - Rank 38View Agent SkillPossible
convex-reviewer
Convex code reviewer covering security, auth, validators, performance, and pattern checks for code in a convex/ directory.
29,770 · popularity - Rank 39View Agent SkillPossible
nestjs-best-practices
NestJS best practices and architecture patterns including security rules for JWT auth, input validation, guards, and rate limiting.
29,131 · popularity - Rank 40View Agent SkillPossible
sql-code-review
Universal SQL code review covering security, maintainability, and quality, focusing on SQL injection prevention and access control.
13,444 · popularity - Rank 41View Agent SkillPossible
postgresql-code-review
PostgreSQL-specific code review covering JSONB, arrays, schema design, and PostgreSQL security features like Row Level Security.
12,464 · popularity - Rank 42View Agent SkillPossible
ai-prompt-engineering-safety-review
Reviews AI prompts for safety, bias, security vulnerabilities, and effectiveness with improvement recommendations.
10,253 · popularity - Rank 43View Agent SkillPossible
doubt-driven-development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands, useful for high-stakes or security-sensitive logic.
43,386 · popularity - Rank 44View Agent SkillPossible
testing-handbook-generator
Generates Claude Code skills from the Trail of Bits Testing Handbook, analyzing handbook pages and emitting SKILL.md files.
4,909 · popularity - Rank 45View Agent SkillDirect
security-best-practices
OfficialPerform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
- Rank 46View Agent SkillDirect
azure-kusto-irql
OfficialCompose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.
What this topic covers
Each sub-topic groups Agent Skills for a specific situation.
- Govern
- Who is accountable, what risk is acceptable, and which rules apply.
- Identify
- Know the systems, data, and threats you actually have.
- Protect
- Controls that stop a likely attack from succeeding.
- Detect
- Notice that something is wrong while there is still time to act.
- Respond
- Limit damage and learn what happened when an incident is underway.
- Recover
- Get operations back and keep the lesson, not just the outage.
Frequently asked questions
- What kinds of skills are listed under Cybersecurity?
- Skills are grouped by the stages of the security loop: Govern, Identify, Protect, Detect, Respond, and Recover. Govern covers accountability, acceptable risk, and which rules apply; Identify covers the systems, data, and threats you actually have; Protect covers controls that stop a likely attack; Detect covers noticing something is wrong in time to act; Respond covers limiting damage and learning what happened; Recover covers getting operations back and keeping the lesson.
- How is the list ordered?
- The list is ranked by observed search demand, with direct matches to the topic placed first. A cap limits how many skills any single publisher can occupy in the ranking.
- Should I start with Govern or with Protect?
- Start with the stage that matches your current problem, not with the first stage in the loop. If you do not yet know what systems, data, and threats you have, Identify comes before Protect, because controls chosen without that knowledge may not fit. If an incident is already underway, go straight to Respond.
- Can one skill cover the whole loop?
- Cybersecurity is a loop, not a product, so treat the sub-topics as separate jobs an agent may need different skills for. A skill that helps you govern risk is doing different work from one that helps you detect an incident. Expect to combine skills across stages rather than rely on a single one.
How to install an Agent Skill
Start with the first skill on this page. Claude Code reads a SKILL.md once it is in the skills directory:
- Claude Code — copy the SKILL.md for security-threat-model into ~/.claude/skills/security-threat-model/ for yourself, or .claude/skills/security-threat-model/ to share it with a project.
- From the registry — run npx skills add openai/skills@security-threat-model.
- Or download security-threat-model from its source and place that SKILL.md in the directory above.
How to choose Check the source and the skill’s own instructions before you install. Official and Notable describe where a skill comes from.