Hey Product Hunt! agentools.sh is live there today. Tell me what to add →
Sponsor

Security skills

4 Security skills, most installed first. I read every file in each one to see what it can access, and show the security audits from skills.sh. See all skills.

Best for Solo founders who want their coding agent to check code for security bugs

This page lists the Agent Skills I picked for security work: code reviews, static scans and full audits that coding agents like Claude Code, Codex and Cursor load on demand. I read every skill file by file to rate its access (Low, Medium or High), and each page shows security audits from skills.sh. The list is sorted by total installs.

Start with Security Review by Sentry. It is the most installed here, has Low access, and reports only high-confidence, exploitable issues, so you get few false alarms.

For a static scan, try Semgrep Scan from Trail of Bits: it proposes rulesets for your approval before running them. For a deeper pass, Security Audit (Cloudflare) runs six phases and has a second agent try to disprove every finding.

1Security Reviewgetsentry/skillsOWASP security review with few false alarmsLow1 fail21.5K2Semgrep Scantrailofbits/skillsSemgrep security scan with approval gateHigh1 warn9.6K3Security Audit (Cloudflare)cloudflare/security-audit-skillA six-phase security audit where every finding is checked by a second agentMediumNo audits—4Security Auditcloudflare/security-audit-skillCloudflare's multi-phase vulnerability hunt, with every finding checked by a fresh agent that tries to disprove itMediumNo audits—

Questions

What is the best Agent Skill for a code security review in Claude Code?

I would start with Security Review by Sentry. It is the most installed skill on this page, has Low access, and it traces where input comes from and reports only high-confidence, exploitable issues with severity. Install it with claude plugin marketplace add getsentry/skills && claude plugin install sentry-skills@sentry-skills.

How do I install the Cloudflare security audit skill?

Run npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit and add --global for a user-level install. Then ask your agent to "security audit this codebase". It is MIT licensed and works with Claude Code, Codex, Cursor and OpenCode.

What is the difference between Security Audit and Security Audit (Cloudflare)?

Both come from Cloudflare, use the same install command and are MIT licensed. Both have Medium access. Security Audit also lists Gemini CLI support and describes all six phases in more detail, including attack class guides for web and auth, LLM and agent tools, supply chain and cloud.

Does the Semgrep security scan skill work with Codex?

Yes, Semgrep Scan from Trail of Bits works with Claude Code and Codex. Install it with /plugin marketplace add trailofbits/skills, then pick static-analysis in the /plugin menu. It detects your languages, asks you to approve rulesets, and merges the results into SARIF.