New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Specialist

by fabricioctelles in fabricioctelles/skills

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

Apache-2.0Auto-check passedSecurity

Install Security Specialist

skills CLI
$ npx skills add fabricioctelles/skills --skill security-specialist -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install fabricioctelles/skills security-specialist --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/fabricioctelles/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-specialist .claude/skills/security-specialist && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-specialist
GitHub stars
106
Token cost
~2.8k tokens
SKILL.md length
1,389 words
Files
23 (incl. scripts, references)
Skills in repo
15
Repo updated
First seen
Licence
Apache-2.0

At a glance

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

  • Works in 10 steps: Listar tudo que desvia do OWASP como… → Rating defense-in-depth gaps como… → Ignorar o deployment model. Rate… → …
  • Says security scan
  • SKILL.md covers Core Principles, Input Model, Workflows and Scripts, plus 5 more sections
  • Runs Python and JavaScript scripts from its folder; calls node and python3

What it does

Security Specialist is an agent skill from fabricioctelles/skills. Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".

Its SKILL.md is about 2.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 25 other files, including scripts and reference files (for example `references/finding-format.md`, `references/report-format.md` and `references/report-schema.json`).

It sits in Security, covering Security review, Threat modeling and Bug bounty. The repository describes itself as: A collection of skills for AI agents (Kiro, Cursor, Windsurf, Claude Code, and others). Each skill is a reusable module that teaches the agent to perform complex tasks with… The licence is Apache-2.0.

When your agent uses it

  • Says security scan
  • Audit this repo
  • Review this PR for security
  • Triage vulnerabilities

Example prompts

  • “security scan”
  • “audit this repo”
  • “review this PR for security”
  • “/security-specialist”

Requirements

  • Python 3
  • Node.js

Workflow steps

10 steps, taken from the first numbered list in SKILL.md.

  1. Listar tudo que desvia do OWASP como finding. OWASP é checklist, não bug list. Toda aplicação real faz tradeoffs.
  2. Rating defense-in-depth gaps como HIGH/CRITICAL. "Missing validateIdentifier onde o query builder já escapa identificadores" não é HIGH.
  3. Ignorar o deployment model. Rate limiting no CDN layer é arquitetura válida. Nem toda app precisa rate limiting no application level.
  4. Tratar designed behavior como bug. Entenda o trust model antes de auditar. Se o design diz admins are fully trusted…
  5. Padding o report com LOWs para parecer thorough. Dez LOWs não fazem um report útil. Três MEDIUMs fazem.
  6. "Potential" findings sem proof. Ou você pode explotar ou não pode. Se precisa das palavras "potencialmente" ou "teoricamente", não…
  7. Ignorar o que o codebase faz bem. Se auth é sólido, diga. Constrói confiança nos findings que VOCÊ reporta e ajuda o time a priorizar.
  8. Construir exploits de assumptions incorretas sobre parser/runtime. Os false positives mais convincentes vêm de reasoning "o parser vai…
  9. Pular business logic e creative attacks. As vulnerability classes padrão (SQLi, XSS, SSRF) são o que todo scanner checa. O valor de uma…
  10. Desistir fácil demais. "O codebase usa parameterized queries portanto não tem SQL injection" é conclusão preguiçosa. Cheque CADA uso de…

What it can do on your machine

Read from SKILL.md and the folder at commit 242512d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 5 files in scripts/ (Python and JavaScript, from the files we listed), which the agent can run.

    Shell commands in SKILL.md call:

    • node
    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Specialist loads about 2.8k tokens when it runs, and up to ~13k if it reads all its reference files. Until then it costs about 84 tokens; SKILL.md has 1,389 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~84
When it runs · the whole SKILL.md, loaded when a task matches
~2.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~13k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from fabricioctelles/skills at commit 242512d, republished under its Apache-2.0 licence (© fabricioctelles). 1,389 words, ~2,830 tokens.

Download SKILL.mdSave it as .claude/skills/security-specialist/SKILL.md (or your agent's skills folder). This skill also uses 22 other files; get the full folder from GitHub.
name
security-specialist
description
Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".
metadata.author
ft.ia.br
metadata.version
2.0.0
metadata.date
2026-06-24
metadata.license
Apache-2.0
metadata.category
runbooks

Security Specialist

You perform security work on source code. Not the hand-wavy kind — you dig into repos, trace data flows, find real bugs, and produce evidence.

Pick a workflow from the table below based on what the user needs. Then read the matching steering doc and follow it. Don't improvise the workflow order — it exists because skipping steps produces garbage findings.

Core Principles

Only report what you can exploit

Every finding must have a concrete attack scenario: who is the attacker, what do they do, and what do they get? "An attacker could theoretically..." is not a finding. "Send this request, get this result" is.

Determine the baseline dynamically

In Phase 1, identify what this application is and what comparable applications exist. Use comparables to calibrate — not to dismiss findings, but to focus effort. If the comparable has the same pattern and it's been exploited there, that's a STRONGER finding. If the comparable has the same pattern and nobody's exploited it in 20 years, understand why before reporting.

Adversarial validation

The agent that checks a finding is never the agent that found it. Hunting agents find; validation agents kill false positives. This separation is critical for report quality.

Severity requires impact

Severity = likelihood × impact, not deviation from a checklist. If you cannot describe the concrete damage an attacker achieves, the severity is probably lower than you think.

Defense-in-depth gaps are not vulnerabilities

If Layer A prevents the attack, the absence of Layer B is a hardening suggestion, not a finding.

Multiple runs improve coverage

Testing shows a single run finds roughly half the total vulnerabilities across multiple runs. Each run explores different code paths. Prior runs inform where to dig deeper.

Input Model

The scan scope depends on what the user provides:

User providesWhat runs
Path onlySAST (source code) → start dev server → DAST (localhost)
Path + URLSAST (source code) → DAST (localhost) → DAST (production URL, requires confirmation)
URL onlyDAST against the URL (confirm if not localhost)

Always start with the least invasive layer and escalate. The three-layer correlation (source → dev → prod) produces the strongest evidence.

Authorization gate
  • localhost, 127.0.0.1, 0.0.0.0, *.local, 192.168.*, 10.*, 172.16-31.* → no confirmation needed
  • Anything else → ask: "This will send active probes to [URL]. You're authorized to test this target? [y/n]"

Workflows

What they wantSteering docTypical asks
Scan a whole reposteering/full-scan.md"scan this repo", "security audit", "find vulnerabilities"
Review a diff/PRsteering/diff-review.md"review this PR", "check my changes", "security review this diff"
Pentest a live targetsteering/pentest.md"pentest this", "recon on target.com", "enumerate the app"
Hunt vulnerabilitiessteering/hunting.md"hunt for bugs", "attack classes", "run the wildcard agent"
Build a threat modelsteering/threat-model.md"threat model", "map attack surface", "identify trust boundaries"
Trace attack pathssteering/attack-paths.md"how could this be exploited", "attack chain", "blast radius"
Discover new findingssteering/discovery.md"look for issues in these files", "what's wrong here"
Triage findingssteering/triage.md"prioritize these", "which ones matter", "assess severity"
Fix a vulnerabilitysteering/remediation.md"fix this vuln", "patch it", "suggest a fix"
Track findings over timesteering/tracking.md"track these findings", "export to GitHub issues", "update status"
Validate a fixsteering/validation.md"verify this fix", "is it actually patched", "regression check"
Generate reportsteering/reporting.md"write the report", "summarize findings", "produce the final output"

Scripts

Utility scripts live in scripts/ relative to this skill:

bash
python3 scripts/<name>.py [args]     # Python utilities
node scripts/validate-findings.cjs <file>  # Schema validator
ScriptPurpose
scan_db.pySQLite CRUD: init scans, add/validate/triage findings, export
rank_files.pyScore files by security relevance for discovery worklists
pentest.pyRecon, enumeration, vuln scan wrapper (system tools + Python fallbacks)
finalize.pySeal scan: export JSON + HTML, compute integrity hashes
validate-findings.cjsValidate findings.json against report-schema.json (zero deps, Node.js)

References

FileWhat it governsWhen to read
references/report-format.mdHTML report template, CSS, structure, footerBefore generating security-report.html
references/finding-format.mdFinding structure (simple + structured formats)Before recording any finding
references/severity-policy.mdSeverity classification rules + CVE cross-ref protocolBefore assigning any severity
references/scan-artifacts.mdScan directory structure, file namingBefore initializing a scan
references/report-schema.jsonJSON schema for structured findings.jsonBefore writing Phase 5 output

Report output is HTML (security-report.html) — self-contained dark-themed file with color-coded severities, collapsible evidence, and interactive severity filters. No external dependencies.

Anti-Patterns to Avoid

Erros que tornam auditorias de segurança inúteis:

  1. Listar tudo que desvia do OWASP como finding. OWASP é checklist, não bug list. Toda aplicação real faz tradeoffs.

  2. Rating defense-in-depth gaps como HIGH/CRITICAL. "Missing validateIdentifier onde o query builder já escapa identificadores" não é HIGH.

  3. Ignorar o deployment model. Rate limiting no CDN layer é arquitetura válida. Nem toda app precisa rate limiting no application level.

  4. Tratar designed behavior como bug. Entenda o trust model antes de auditar. Se o design diz admins are fully trusted, admin-does-admin-things não é finding.

  5. Padding o report com LOWs para parecer thorough. Dez LOWs não fazem um report útil. Três MEDIUMs fazem.

  6. "Potential" findings sem proof. Ou você pode explotar ou não pode. Se precisa das palavras "potencialmente" ou "teoricamente", não pesquisou o suficiente.

  7. Ignorar o que o codebase faz bem. Se auth é sólido, diga. Constrói confiança nos findings que VOCÊ reporta e ajuda o time a priorizar.

  8. Construir exploits de assumptions incorretas sobre parser/runtime. Os false positives mais convincentes vêm de reasoning "o parser vai interpretar isso como..." sem verificar. Se o exploit depende de parser behavior, cite a spec ou teste. Não assuma.

  9. Pular business logic e creative attacks. As vulnerability classes padrão (SQLi, XSS, SSRF) são o que todo scanner checa. O valor de uma auditoria manual é encontrar o que scanners não podem: logic errors, state machine violations, chained attacks, implicit trust assumptions.

  10. Desistir fácil demais. "O codebase usa parameterized queries portanto não tem SQL injection" é conclusão preguiçosa. Cheque CADA uso de sql.raw(). Cheque dynamic identifiers. Cheque search/FTS. Cheque se existe code path que bypassa o query builder. Insista.

Show full SKILL.md (436 more words)Show less

Hard Rules

These apply to every workflow. No exceptions.

  1. Respect the user's preferred language. Report content in the user's language. HTML template structure stays as-is.
  2. Evidence or it didn't happen. Every finding needs source location, data flow trace, and concrete exploitability explanation.
  3. Don't invent severity. If you can't demonstrate impact, mark it as needs-investigation.
  4. Preserve scan state. SQLite database holds progress. Never nuke it. Later runs pick up where you left off.
  5. Findings are immutable once sealed. After finalization, original evidence record doesn't change.
  6. Relative paths only. All file references use repo-relative paths.
  7. CVE severity ≠ real severity. Always cross-reference against actual project usage.
  8. Follow reference specs exactly. Read matching file in references/ before generating structured output.
  9. Validate structured output. Run node scripts/validate-findings.cjs before delivering findings.json.
  10. Adversarial validation is mandatory for full-scan. Never skip Phase 3 or Phase 6.

Report Compliance Checklist

Before delivering security-report.html, verify ALL against references/report-format.md:

Structure (must exist in this order)
  • <title> with repo name
  • Meta grid: Repository, Date, Target, Methodology
  • Summary cards (count per severity)
  • Executive summary paragraph
  • Filter buttons (Todos, Critical, High, Medium, Low, Info)
  • Finding cards sorted by severity desc
  • CVE analysis table (if deps have advisories)
  • Pentest results section (if applicable)
  • Negative results table — what was tested and found secure
  • Remediation priority table
  • Footer: Generated by security-specialist skill by github.com/fabricioctelles/skills
Styling
  • Dark theme, color-coded severity badges
  • No external dependencies, works offline
Content integrity
  • All tests performed appear in report (positive AND negative)
  • Evidence is actual output, not paraphrased
  • CVE severities cross-referenced against project context
  • Findings validated adversarially (Phase 3 passed)
  • Confidence score present for each finding (full-scan)

Lessons Learned

CVE Severity × Real Impact: Always Cross-Reference

A CVE with CVSS 9.8 means nothing if the vulnerable code path is unreachable. Before classifying a dependency CVE, verify preconditions:

StepWhat to checkIf absent →
1Vulnerable function/module used directly?Drop to LOW or INFO
2Project uses the triggering feature?Drop to LOW or INFO
3Environmental conditions met?Drop to LOW or INFO
4DAST confirmed exploitability?Flag as "not confirmed in production"
Three-Layer Correlation

A finding confirmed in localhost may not exist in production because infrastructure mitigates it. Always test both and document the delta.

Storage Abuse is Underrated

Lack of input size validation on persisted fields is often missed. Real DoS vector — especially with SQLite where full disk kills the entire app.

Multi-Run Coverage Strategy

Each run should explicitly target what prior runs missed. If prior runs found 5 injection bugs and 0 logic bugs, the next run should weight toward business logic, feature abuse, and wildcard agents.

© fabricioctelles, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 22 other files (scripts, references) in skills/security-specialist of fabricioctelles/skills.

  • SKILL.md
  • references/finding-format.md
  • references/report-format.md
  • references/report-schema.json
  • references/scan-artifacts.md
  • references/severity-policy.md
  • scripts/finalize.py
  • scripts/pentest.py
  • scripts/rank_files.py
  • scripts/scan_db.py
  • scripts/validate-findings.cjs
  • steering/attack-paths.md
  • steering/diff-review.md
  • steering/discovery.md
  • steering/full-scan.md
  • steering/hunting.md
  • steering/pentest.md
  • steering/remediation.md
  • … and 5 more

Open the folder on GitHubat commit 242512d

Compare with similar skills

Security Specialist next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Specialist compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Specialist this skillfabricioctelles/skills106—~2.8kAutomated safety check: PassApache-2.0
Wooyun Legacytanweai/wooyun-legacy1.8k—~1.9kAutomated safety check: PassCustom licence
Security Audit Scannerruvnet/ruflo74k1 repos~823Automated safety check: PassMIT
Flounderadshao/flounder518—~9.2kAutomated safety check: PassAGPL-3.0
Osint Methodologyelementalsouls/Claude-OSINT2.8k—~8.7kAutomated safety check: NotesMIT
CSO Security Auditgarrytan/gstack136k—~4.5kAutomated safety check: PassMIT

Similar skills

  • Wooyun Legacy

    tanweai/wooyun-legacy

    WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

    1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 1 repo~823 tokens
    SecurityAuto-check passed

  • Flounder

    adshao/flounder

    Operates Flounder, an autonomous white-hat security auditor.

    518 GitHub stars~9.2k tokensUpdated 5 days ago
    SecurityAuto-check passed

  • Osint Methodology

    elementalsouls/Claude-OSINT

    Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

    2.8k GitHub stars~8.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • CSO Security Audit

    garrytan/gstack

    Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.

    136k GitHub stars~4.5k tokensUpdated today
    SecurityAuto-check passed

  • Behavioral State Analysis

    quillai-network/quillshield_skills

    Token-efficient smart contract security auditing via Behavioral State Analysis (BSA).

    130 GitHub stars~1.4k tokensUpdated 6 mo ago
    SecurityAuto-check passed

More from fabricioctelles/skills

All 15 skills in this repo

  • Motion Ad

    fabricioctelles/skills

    Produce a short motion-graphics video ad — a 15s Facebook/Instagram/TikTok spot — as a rendered MP4.

    106 GitHub stars~4.1k tokensUpdated today
    Auto-check passed

  • Agent Plugin Eval

    fabricioctelles/skills

    Audit, score, and compare repositories containing portable Agent Plugins against the official Agent Plugins specification.

    106 GitHub stars~2.1k tokensUpdated today
    Auto-check passed

  • Loop Architect

    fabricioctelles/skills

    Design well-structured agent loops with best-practice coaching and cross-model review gates before you run them.

    106 GitHub stars~2.1k tokensUpdated today
    Auto-check: notes

  • Pier Cloud

    fabricioctelles/skills

    This skill should be used when the user needs to consume the Pier Cloud (Lighthouse) API for cloud cost management — including JWT authentication, listing contexts, workspaces, workspace groups, and…

    106 GitHub stars~1.1k tokensUpdated today
    Auto-check: notes

  • Ralph Loop Kiro Specs

    fabricioctelles/skills

    Automated iterative agent runner for spec-based development in Kiro.

    106 GitHub stars~2.6k tokensUpdated today
    Auto-check passed

  • Skill Evaluation

    fabricioctelles/skills

    Evaluate any agent skill against a merged framework — Anthropic's Claude Code best practices plus Matt Pocock's writing-great-skills methodology — across 4 axes (Trigger, Structure, Steering…

    106 GitHub stars~3.8k tokensUpdated today
    Auto-check passed

Categories

Questions about Security Specialist

What does Security Specialist do?

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Security Specialist is an agent skill from fabricioctelles/skills. Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

When should I use Security Specialist?

Security Specialist fits situations like: says security scan; audit this repo; review this PR for security; triage vulnerabilities.

How do I install Security Specialist in Claude Code?

Run `npx skills add fabricioctelles/skills --skill security-specialist -a claude-code`. Or copy the skill folder (skills/security-specialist in fabricioctelles/skills) into .claude/skills/security-specialist in your project. Claude Code loads it when a task matches its description.

How do I install Security Specialist in Codex?

Run `npx skills add fabricioctelles/skills --skill security-specialist -a codex`. Or copy the skill folder (skills/security-specialist in fabricioctelles/skills) into .agents/skills/security-specialist in your project. Codex loads it when a task matches its description.

Can I use Security Specialist in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add fabricioctelles/skills --skill security-specialist -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-specialist, .gemini/skills/security-specialist, .github/skills/security-specialist and .opencode/skills/security-specialist in your project.

What does Security Specialist need to run?

Going by SKILL.md and its folder, Security Specialist needs Python and JavaScript for the scripts in its folder and the command-line tools its instructions call (node and python3). Our summary lists: Python 3; Node.js.

Does Security Specialist access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security Specialist safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Security Specialist use?

Security Specialist is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Specialist use?

About 2.8k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 10k tokens, read only when the agent opens those files.

What are the alternatives to Security Specialist?

Skills that share tags, products or a category with Security Specialist: Wooyun Legacy (tanweai/wooyun-legacy, 1.8k stars), Security Audit Scanner (ruvnet/ruflo, 74k stars), Flounder (adshao/flounder, 518 stars) and Osint Methodology (elementalsouls/Claude-OSINT, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Specialist?

fabricioctelles (a GitHub user) maintains it in fabricioctelles/skills, which has 106 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on October 11, 2026.

Source: fabricioctelles/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.