AI security & compliance skills for agents
Security skills carry the highest bar in our pipeline — the same static scanner that quarantines malicious skills screens these for the pitfalls they teach you to avoid.
They cover practical hardening: secret storage, IAM least-privilege, headers and CSP, dependency triage, and prompt-injection defenses for anyone building agents.
21 skills · 4 benchmarked with Lift · sorted by measured performance, then Trust.
Adds structured logging, metrics, distributed tracing, and symptom-based alerting to code so production behavior can be diagnosed from telem
Guides safe production launches with pre-launch checklists, feature flags, staged rollouts, monitoring, and rollback plans.
Guides secure coding practices like threat modeling, input validation, authentication hardening, dependency auditing, and privacy compliance
Automates continuous integration, delivery, and deployment pipelines with structured quality gates and deployment strategies.
Coordinates confidential GitHub Security Advisory handling, including private-fork fixes, CVE requests, and simultaneous publication with an
Statically reviews repo-scoped MCP configuration files for mutable package references (like @latest or version ranges) and classifies their
Starts, verifies, reseeds, and repairs Paperclip isolated dev workspace services, proving health, login readiness, cloned data, and correct
Finds pull requests opened by this agent, reports their merge-readiness confidence, and automatically drives unready ones back to green with
Coordinates a full software release end-to-end, including changelog drafting, verification, canary validation, smoke testing, npm publishing
Reviews code for security best practices, covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, rate limi
Generates an interactive bash wizard script that guides a human step-by-step through manual setup tasks like provisioning infrastructure, co
End-to-end machine learning production workflow including deployment, monitoring, and rollback
Publishes a static HTML directory to a Paperclip-hosted S3/CloudFront page URL for sharing persistent pages, prototypes, or reports.
Generates user-facing stable release changelogs by analyzing git commits, changesets, and merged PRs since the last release tag.
Installs Claude Code hooks that block dangerous git commands like push, reset --hard, and clean before they run.
Monitors and ensures a pull request is ready to merge by tracking CI checks, reviews, and unresolved comments.
Audits a local LazyCodex and Codex CLI installation against the latest upstream sources and produces an evidence-backed PASS/WARN/FAIL healt
Triggers and verifies the full oh-my-opencode release pipeline: GitHub Actions publish, npm package publication, GitHub release notes, and D
Runs a parallel team of vulnerability hunters and PoC engineers to audit a codebase, prove which findings are actually exploitable, and prod
Automates semantic version bumps across all plugin manifests, builds and verifies the project, creates git tags and GitHub releases, regener
Sets up and verifies claude-mem cloud sync to a cmem.ai Pro account, checking sync status and guiding the user through the installer without
FAQ
What is AI red teaming?
Systematically attacking your own AI system — prompt injection, data exfiltration via tools, jailbreaks — before someone else does. The skills here teach the attack taxonomy and the defenses.
Are security skills themselves safe to load?
Every skill passes the same scanner (secrets, hooks, exfiltration URLs, tool breadth) plus two LLM judges — and benchmark canaries catch anything that tries to leak at runtime.