Security AI Skills
Harden your code with automated security analysis
Security skills scan your codebase for vulnerabilities, generate compliance reports, and help you follow security best practices. From OWASP Top 10 detection to dependency auditing and secrets scanning, these tools catch issues before they become breaches.
Top Security Skills
Hikvision NVR
Ask your AI agent for the Hikvision footage you need, then walk away while it downloads. Pulling video off a Hikvision DVR or NVR usually means web-UI menus, ISAPI XML, ffmpeg flags, and "why is this video broken" troubleshooting. This skill removes all of it. Once your NVRs are registered, you just tell your agent "pull the lobby camera from 8 to 9 PM yesterday" and a clean MP4 lands in your downloads folder. Speaks Hikvision's ISAPI natively, falls back to RTSP when the NVR throttles, works around firmware quirks that return wrong segment data, clips to the exact time window you asked for, and verifies the output (codec, resolution, duration, on-screen timestamp). Credentials live in your OS keychain, never on command lines or in logs. Validated on DS-9016HWI-ST, DS-7316HQHI-SH, DS-7716NI-I4/16P, DS-9632NI-ST, and DS-7716NI-SP/16 with firmware V3.1.10 through V4.50.000.
AgentPass Local
Install a local credential broker with a desktop GUI, allowed-domain policy checks, and OS-protected sensitive fields. Use it when an approved agent workflow needs a narrow login or API handoff without putting passwords, tokens, recovery codes, or payout details into chat, logs, screenshots, or repositories.
code-review-expert
# Code Review Expert ## Overview Perform a structured review of the current git changes with focus on SOLID, architecture, removal candidates, and security risks. Default to review-only output unless the user asks to implement changes. ## Severity Levels | Level | Name | Description | Action | |-------|------|-------------|--------| | **P0** | Critical | Security vulnerability, data loss risk, correctness bug | Must block merge | | **P1** | High | Logic error, significant SOLID violation, performance regres
owasp-security-reviewer
Review code against the OWASP Top 10 and get a prioritized, evidence-based report. Flags injection, broken access control, cryptographic failures, SSRF, and misconfiguration, with the exact file and line, the exploit scenario, and a concrete fix for each finding. Includes severity scoring and a remediation checklist. No account, no API key.
What security skills can do for you
Vulnerability Scanning
Detect SQL injection, XSS, CSRF, and other OWASP Top 10 vulnerabilities in your code. Skills analyze code paths, not just patterns, to find real exploitable issues.
Dependency Auditing
Scan your package dependencies for known CVEs and outdated libraries. Get prioritized remediation advice with specific version upgrade paths.
Compliance & Hardening
Generate security policies, audit trails, and compliance documentation. Skills understand SOC 2, GDPR, HIPAA, and PCI-DSS requirements and help you meet them.
Security Skills at a Glance
| Skill | Type | Price | Downloads | Rating | Security |
|---|---|---|---|---|---|
| Hikvision NVR | Skill | $25 | 0 | — | Review |
| AgentPass Local | Skill | $14 | 0 | — | Verified |
| owasp-security-reviewer | Skill | Free | 1 | — | Verified |
| claw-auditor | Skill | Free | 0 | — | Review |
| code-review-expert | Skill | Free | 1.2k | — | Review |
All Security Skills
Hikvision NVR
Ask your AI agent for the Hikvision footage you need, then walk away while it downloads. Pulling video off a Hikvision DVR or NVR usually means web-UI menus, ISAPI XML, ffmpeg flags, and "why is this video broken" troubleshooting. This skill removes all of it. Once your NVRs are registered, you just tell your agent "pull the lobby camera from 8 to 9 PM yesterday" and a clean MP4 lands in your downloads folder. Speaks Hikvision's ISAPI natively, falls back to RTSP when the NVR throttles, works around firmware quirks that return wrong segment data, clips to the exact time window you asked for, and verifies the output (codec, resolution, duration, on-screen timestamp). Credentials live in your OS keychain, never on command lines or in logs. Validated on DS-9016HWI-ST, DS-7316HQHI-SH, DS-7716NI-I4/16P, DS-9632NI-ST, and DS-7716NI-SP/16 with firmware V3.1.10 through V4.50.000.
AgentPass Local
Install a local credential broker with a desktop GUI, allowed-domain policy checks, and OS-protected sensitive fields. Use it when an approved agent workflow needs a narrow login or API handoff without putting passwords, tokens, recovery codes, or payout details into chat, logs, screenshots, or repositories.
owasp-security-reviewer
Review code against the OWASP Top 10 and get a prioritized, evidence-based report. Flags injection, broken access control, cryptographic failures, SSRF, and misconfiguration, with the exact file and line, the exploit scenario, and a concrete fix for each finding. Includes severity scoring and a remediation checklist. No account, no API key.
claw-auditor
Audit an OpenClaw or ClawHub skill before you install it. Statically inspects the package for red flags: unsafe shell execution, exfiltration paths, over-broad file access, prompt-injection patterns, obfuscated payloads, and missing provenance. Returns a risk score with per-finding evidence and a clear install or reject verdict.
code-review-expert
# Code Review Expert ## Overview Perform a structured review of the current git changes with focus on SOLID, architecture, removal candidates, and security risks. Default to review-only output unless the user asks to implement changes. ## Severity Levels | Level | Name | Description | Action | |-------|------|-------------|--------| | **P0** | Critical | Security vulnerability, data loss risk, correctness bug | Must block merge | | **P1** | High | Logic error, significant SOLID violation, performance regres
Common questions about security skills
What vulnerabilities do security skills detect?
Skills detect the full OWASP Top 10 including injection flaws, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, and insufficient logging.
Can skills fix the vulnerabilities they find?
Yes. Security skills don't just report issues - they provide specific code fixes. For each vulnerability found, you get the affected code, the risk level, and a concrete remediation with the corrected code.
Are the security scans comprehensive enough for compliance?
Security skills are a strong first layer but shouldn't replace professional penetration testing for compliance audits. They catch the vast majority of common issues and significantly reduce the findings from formal security assessments.
Ready to supercharge your
security workflow?
Browse verified security skills and agents built by the community. One-command install, instant results.