Security skills for Gemini CLI
Skills for security reviews, audits, and finding vulnerabilities.
At a glance
This list has 87 skills from 5 public GitHub repos. 81 of them have a license that lets us quote the description. The newest repo update is 2026-10-13. The oldest is 2026-07-24. Most skills come from alirezarezvani (78), ComposioHQ (4), addyosmani (2). Our basic check flagged notes on 8 of them.
Gemini CLI reads skills from .gemini/skills/. See the Gemini CLI skills page and the install guide.
Security skills
Sorted with licensed, described skills first, then by newest repo update.
doubt-driven-development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceedi...
security-and-hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or exte...
supabase
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client li...
a11y-audit
Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML ...
aeo
Answer Engine Optimization (AEO) skill - optimize content to be cited by AI language models (ChatGPT, Perplexity, Claude, Gemini, Mistral) as authoritative...
ai-security
Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers ...
aims-audit
/cs:aims-audit <scope> - ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit...
analytics-tracking
Set up, audit, and debug analytics tracking implementation - GA4, Google Tag Manager, event taxonomy, conversion tracking, and data quality. Use when build...
api-design-reviewer
Comprehensive REST API design review with automated linting, breaking-change detection, and design scorecards. Catches inconsistent conventions, missing vers...
apple-hig-expert
Audits and designs iOS/macOS/watchOS/visionOS interfaces against the Apple Human Interface Guidelines, including the Liquid Glass design language (announced ...
atlassian-admin
Atlassian Administrator for managing and organizing Atlassian products (Jira, Confluence, Bitbucket, Trello), users, permissions, security, integrations, sys...
changelog-generator
Produce consistent, auditable release notes from Conventional Commits. Separates commit parsing, semantic-bump logic, and changelog rendering for automated r...
ciso-advisor
Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIPAA/GDPR), security architecture strate...
ciso-review
/cs:ciso-review <plan> - Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that hand...
cloud-security
Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC...
competitive-teardown
Analyzes competitor products and companies by synthesizing data from pricing pages, app store reviews, job postings, SEO signals, and social media into struc...
compliance-os
Compliance OS - meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal a...
compliance-readiness
/cs:compliance-readiness <program> - Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a n...
confluence-expert
Atlassian Confluence expert for creating and managing spaces, knowledge bases, and documentation. Configures space permissions and hierarchies, creates page ...
content-strategy
When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions \"content ...
data-quality-auditor
Audit datasets for completeness, consistency, accuracy, and validity. Profile data distributions, detect anomalies and outliers, surface structural issues, a...
dependency-auditor
Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade pa...
docker-development
Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security...
dossier
Decision-grade entity research skill - produces a hypothesis-tested dossier on a specific company, person, nonprofit, or government org, not a generic prof...
env-secrets-manager
Manage environment-variable hygiene and secrets safety across local development and production. Practical auditing, drift awareness, rotation readiness. Use ...
fda-consultant-specialist
FDA regulatory consultant for medical device companies. Provides 510(k)/PMA/De Novo pathway guidance, QMSR (21 CFR 820, which incorporates ISO 13485:2016 by ...
fda-qsr-audit-prep
/cs:fda-qsr-audit-prep <scope> - FDA 21 CFR 820 (QSR / QMSR) audit 6-question forcing interrogation. Post-Feb 2026 substantially harmonized with ISO 13485....
feature-flags-architect
Use when adding, retiring, or auditing feature flags. Triggers on "add a flag", "ship behind a flag", "rollout plan", "kill switch", "stale flags", "flag deb...
feature-flags-architect
Use when adding, retiring, or auditing feature flags. Triggers on "add a flag", "ship behind a flag", "rollout plan", "kill switch", "stale flags", "flag deb...
founder-coach
Personal leadership development for founders and first-time CEOs. Covers founder archetype identification, delegation frameworks, energy management, CEO cale...
free-tool-strategy
When the user wants to build a free tool for marketing - lead generation, SEO value, or brand awareness. Use when they mention 'engineering as marketing,' ...
gdpr-audit-prep
/cs:gdpr-audit-prep <scope> - GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit...
gdpr-dsgvo-expert
GDPR and German DSGVO compliance automation. Scans codebases for privacy risks, generates DPIA documentation, tracks data subject rights requests with Art. 1...
google-workspace-cli
Google Workspace administration via the gws CLI (github.com/googleworkspace/cli). Install, authenticate, and automate Gmail, Drive, Sheets, Calendar, Docs, C...
helm-chart-builder
Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw - chart scaffolding, values design, template patterns, d...
incident-response
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection....
information-security-manager-iso27001
ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an ISMS, running security risk assessment...
isms-audit-expert
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use...
iso13485-audit-prep
/cs:iso13485-audit-prep <scope> - ISO 13485 QMS audit 6-question forcing interrogation. Design controls + CAPA + post-market focused. Use before Clause 8.2...
iso27001-audit-prep
/cs:iso27001-audit-prep <scope> - ISO 27001 ISMS audit readiness 6-question forcing interrogation. Use before annual Clause 9.2 internal audit, surveillanc...
iso42001-specialist
ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Claus...
iso42001-specialist
ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Claus...
knowledge-ops
Use when a Head of Ops, Knowledge Manager, or TPM-Internal needs to author, validate, or clean up company SOPs and internal runbooks (procurement intake, ven...
kubernetes-operator
Use when building a Kubernetes Operator - custom controllers that reconcile CRD state. Triggers on "build an operator", "CRD design", "reconcile loop", "co...
kubernetes-operator
Use when building a Kubernetes Operator - custom controllers that reconcile CRD state. Triggers on "build an operator", "CRD design", "reconcile loop", "co...
linkedin-profile
Use when someone wants their LinkedIn profile audited or rewritten - headline, About section, experience bullets, Featured, banner, recommendations - or ...
local-seo-manager
Manage local SEO for service-area businesses - appliance repair, HVAC, plumbing, cleaning, and any business that serves customers at their location. Use wh...
loop-library
Discover, find, compare, audit, repair, adapt, and design repeatable AI-agent loops with explicit triggers, actions, verification, stopping conditions, guard...
memory-engineering
Use when designing, reviewing, or paying for an agent memory system - adding memory to an agent, choosing between long-context / RAG / graph / agentic memo...
ms365-tenant-manager
Microsoft 365 tenant administration for Global Administrators. Automate M365 tenant setup, Office 365 admin tasks, Azure AD user management, Exchange Online ...
patent
Patent prior-art and landscape intelligence skill - not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search / free...
pm-skills
Use when coordinating project-delivery work across the 8 project-management sub-skills - sprint/velocity analytics, portfolio health, Jira/JQL, Confluence,...
pr-review-expert
Use when the user asks to review pull requests, analyze code changes, check for security issues in PRs, or assess code quality of diffs.
procurement-optimizer
Use when running an annual SaaS audit, doing category-level spend review, or rationalizing the supplier base - when the user needs a spend audit, spend cat...
programmatic-seo
When the user wants to create SEO-driven pages at scale using templates and data. Also use when the user mentions "programmatic SEO," "template pages," "page...
pw-review
Review Playwright tests for quality. Use when user says "review tests", "check test quality", "audit tests", "improve tests", "test code review", or "playwri...
qms-audit-expert
ISO 13485 internal audit expertise for medical device QMS. Covers audit planning, execution, nonconformity classification, and CAPA verification. Use when pl...
quality-manager-qms-iso13485
ISO 13485 Quality Management System implementation and maintenance for medical device organizations. Provides QMS design, documentation control, internal aud...
ra-qm-skills
Router/index for the 15 regulatory & quality-management skills bundled in this plugin (ISO 13485 QMS, EU MDR 2017/745, FDA submissions under QMSR, ISO 14971 ...
red-team
Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain plann...
research
Default entry point for any research request - a hybrid router that classifies the question deterministically and either delegates to a specialist research...
rfp-responder
Use when an RFP, RFI, RFQ, security questionnaire, vendor questionnaire, or proposal request arrives and the team needs a structured response - parsing mul...
schema-markup
When the user wants to implement, audit, or validate structured data (schema markup) on their website. Use when the user mentions 'structured data,' 'schema....
secrets-vault-manager
Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key V...
security-guidance
PreToolUse security-anti-pattern hook for Claude Code. Catches 12 common security risks (command injection, XSS, SQL injection, unsafe deserialization, GitHu...
security-pen-testing
Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Cover...
senior-fullstack
Fullstack development toolkit with project scaffolding for Next.js, FastAPI, MERN, and Django stacks, code quality analysis with security and complexity scor...
senior-secops
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST sc...
seo-audit
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranki...
site-architecture
When the user wants to audit, redesign, or plan their website's structure, URL hierarchy, navigation design, or internal linking strategy. Use when the user ...
skill-security-auditor
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a s...
skill-tester
Validate, test, and score the quality of skills within the claude-skills ecosystem. Comprehensive meta-skill: structure validation, Python script testing (sy...
soc2-audit-prep
/cs:soc2-audit-prep <scope> - SOC 2 Type II readiness 6-question forcing interrogation. Observation-period focused. Use before Type II observation begins, ...
soc2-compliance
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or asse...
social-media-analyzer
Social media campaign analysis and performance tracking. Calculates engagement rates, ROI, and benchmarks across platforms. Use when analyzing social media p...
social-media-manager
When the user wants to develop social media strategy, plan content calendars, manage community engagement, or grow their social presence across platforms. Al...
stock-analysis
Produce a rigorous, sector-relative, multi-factor fundamental analysis of a publicly listed company - Indian (NSE/BSE) or US/global. Use when the user asks...
tech-stack-evaluator
Technology stack evaluation and comparison with TCO analysis, security assessment, and ecosystem health scoring. Use when comparing frameworks, evaluating te...
terraform-patterns
Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management...
vendor-management
Use when reviewing, scoring, or auditing third-party SaaS / vendor relationships - running a vendor scorecard with industry tuning, tracking SLA compliance...
weekly-review
Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed r...
web-design-guidelines
Open the source on GitHub to read what this skill does.
Ahrefs Automation
Open the source on GitHub to read what this skill does.
hypeauditor-automation
Open the source on GitHub to read what this skill does.
securitytrails-automation
Open the source on GitHub to read what this skill does.
SEMrush Automation
Open the source on GitHub to read what this skill does.
Related categories
The Daily 5 newsletter
Five good agent skills in one email. Unsubscribe any time.
Placeholder. The mailing list is not connected yet, so nothing is collected.
Questions
What are security skills?
Skills for security reviews, audits, and finding vulnerabilities. Each one is a folder with a SKILL.md file that Gemini CLI reads when a task matches.
How do I install a security skill?
Copy the skill folder into .gemini/skills/ and start a new Gemini CLI session. Each skill page shows the exact command.
Can I trust these skills?
We run a basic automated check for risky patterns. It is not a full audit. Read a skill before you install it.