Top Claude Skills for Security Engineers (2026 Guide)

Why security engineers need skills now

Your developers are already shipping code a model wrote. The arXiv study above audited 200 deployed apps built with Claude Code and Lovable and logged 1,186 vulnerabilities. 65.77% of them were rated Critical or High, mostly broken access control, injection and authentication failures. The authors also found that better prompting reduced the problems without removing them.

Practitioners feel the review load. A Hacker News thread titled "Im tired of reviewing code nobody actually wrote" drew 275 points and 272 comments in the last month. And one practitioner on Instagram (@insom.ai) put the real job well: "A model can produce twenty plausible leads in a minute, and the skill that matters becomes deciding which three are worth a proof of concept."

That is where skills help. They do not replace your judgement. They make the model check the same things every time, in the order you would.

What Claude skills are (and what they are not)

A skill is a folder with a SKILL.md file inside it. That file teaches Claude how to do one job well: review a diff for injection, trace whether a hardcoded secret is reachable, or audit a config for defaults that fail open.

Claude only loads the skill's name and one-line description until your task matches it. So you can install several and pay almost no context cost until one is needed.

Skills teach. MCP servers connect. Slash commands trigger. A skill is knowledge and procedure. An MCP server is a live connection to a system such as your scanner or ticketing tool. A slash command is a prompt template you fire manually.

For security work you will pair them: a skill for the review method, a connection for live findings. (This is the ground we cover hands-on in our Claude Code training for engineering teams.)

How to install any of these (two patterns, not eight)

Most of these ship a plugin marketplace manifest, so inside Claude Code:

# Add the marketplace, then install the skill
/plugin marketplace add trailofbits/skills
/plugin install differential-review@trailofbits

Trail of Bits and Sentry both document this route (Sentry's marketplace is named sentry-skills). agamm's OWASP skill installs the same way from its own marketplace. Semgrep's README uses npx skills add semgrep/skills. Anthropic's repository is a GitHub Action plus a slash command you copy into .claude/commands/. The two scanners run from the command line, not inside Claude.

For anything you would rather vet first, install by hand: copy the skill folder into .claude/skills/ for one repository, or ~/.claude/skills/ for everywhere, then reload Claude Code. Check each README for its exact command.

The 8 best Claude skills for security engineers

Ranked by trust (first-party beats anonymous), usefulness for real security review, and how recently the skill was maintained. The last-commit date is on every entry. Star counts on larger repositories are repo-wide, not per skill. Two entries are scanners, not skills, because checking the skills is part of the job.

1. claude-code-security-review: Anthropic's own pull request reviewer

This is the vendor's own security review. It runs as a GitHub Action that analyses only the changed files in a pull request, comments on the findings, and filters out the noise it thinks is a false positive. The same analysis ships inside Claude Code as the /security-review command, which you can copy into your project and edit to match your own rules.

The limitation: Anthropic's README says the action is not hardened against prompt injection and should only review trusted pull requests. Turn on "Require approval for all external contributors" before you point it at a public repository.

2. differential-review: Trail of Bits on what a change could break

Trail of Bits is a security firm, and this is its own skill for reviewing a PR, commit or diff. It adapts its depth to the size of the codebase, uses git blame for context, counts callers to work out the blast radius, checks whether the changed code has tests, and writes a markdown report. It also asks whether a change re-introduces a bug that was fixed before.

The skill states its own coverage limits and confidence in the report, which is the right habit. The limitation: depth scales with codebase size, so read the coverage line in the report on a large repository. The CC-BY-SA-4.0 licence is also share-alike, so check it against your policy before copying it into internal tooling.

3. security-review: Sentry's high-confidence reviewer

Sentry's engineering team publishes the skills it uses itself, and this one is built around restraint. It tells Claude to report only high-confidence findings, meaning a clear vulnerable pattern with attacker-controlled input. Before it flags anything it has to research the wider codebase and trace where the input comes from.

The same repository has a gha-security-review skill for GitHub Actions workflows, which is worth a look if your pipelines are part of your attack surface.

The limitation: the repository is Sentry's house skill set, so some of its other skills are specific to Sentry's own stack. Install only the ones you need.

4. owasp-security: a current reference Claude can check against

A single skill that carries OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications, with per-language pitfalls for 20-plus languages. The detail sits in reference files that load only when a task needs them, so the skill stays light.

The limitation: it is one maintainer and 377 stars, and it guides a review rather than running a scanner. Treat it as a checklist Claude reads, and confirm anything important against the OWASP pages themselves.

5. code-security: Semgrep's secure-coding rules as a skill

Semgrep Engineering's skill covers 28 rule categories across 15-plus languages, from SQL injection and command injection to hardcoded secrets and Terraform, Kubernetes, Docker and GitHub Actions configuration. It is mostly Semgrep's open rules rewritten as guidance, so Claude writes safer code first time and flags the same patterns in review. The repository also holds llm-security and semgrep skills.

The limitation: Semgrep calls the collection beta, and it does not run the Semgrep engine for you. The licence is Semgrep's own Rules License v1.0, which GitHub reports as NOASSERTION, so read the terms before you use it in commercial tooling.

6. insecure-defaults: configuration that fails open

Also from Trail of Bits. You point /insecure-defaults:audit at a repository, a folder or one file, and it traces each insecure-default candidate before reporting it, instead of dumping every grep hit. It is a sensible first run on any codebase you did not write.

The limitation: it is narrow on purpose. It looks at default configuration, not business logic or injection, so it sits alongside a diff reviewer and does not replace one.

7. agent-scan: check the skills themselves

Snyk's scanner discovers the agent components on your machine, including skills and MCP servers, and checks them for prompt injection, sensitive data handling and malware payloads hidden in plain language. Its README shows how to scan your whole skills folder with uvx. Run it before you add anything new.

The limitation: Snyk labels the CLI output experimental and says field names and risk codes can change without notice. Use it by hand or in a loose check, not as a pipeline that depends on exact output.

8. skill-scanner: a second opinion with CI output

Cisco AI Defense's scanner combines pattern rules, dataflow analysis and an optional LLM judge to look for prompt injection, data exfiltration and malicious code in skills. It outputs SARIF for GitHub Code Scanning and has a pre-commit hook, which suits teams that write their own skills.

The limitation: the README calls it best-effort and says a scan with no findings does not prove a skill is safe. Its scope is the Agent Skills format, and Claude Code commands only scan with the --lenient flag.

Worth watching (and what we left off)

mukul975/Anthropic-Cybersecurity-Skillshas 33,923 stars, an Apache-2.0 licence and a last commit in August 2026. It offers over 800 skills mapped to MITRE ATT&CK, NIST CSF and other frameworks. We left it off the ranked list for three reasons. It is a community project, and its own README says it is not affiliated with Anthropic despite the name. It includes offensive and dual-use techniques that belong only in authorised testing. And at that size nobody has read every skill.

If you want to use it, copy the handful you need into a folder, read them, scan them, and leave the rest in the repository.

A word on security before you install anything

You know this better than most, but it bears repeating for skills. A SKILL.md can contain prompt-injection instructions, and any script a skill bundles runs with your agent's permissions. On a security workstation that can mean scanner API tokens, cloud credentials, private repository access and the vulnerability reports you have not disclosed yet.

Snyk's 2026 ToxicSkills study found prompt injection in 36% of the skills it examined and 1,467 malicious payloads. A security skill is a more attractive target than most, because it arrives with a reason to read your code.

How to actually use these together

You do not need all eight. For most security teams, five is enough to start:

1. claude-code-security-review on every pull request, as the baseline reader.
2. differential-review for changes that touch auth, crypto, payments or external calls.
3. owasp-security so Claude checks against a current standard, not its memory of one.
4. insecure-defaults whenever you take on a codebase you did not write.
5. agent-scan over your skills folder before any new install.

Swap in Sentry's security-review if you want fewer, higher-confidence findings than differential-review gives. Add code-security from Semgrep if your developers write across many languages, and skill-scanner if you want a pre-commit hook for skills your own team writes.

The short version

Use a diff-level reviewer on every pull request, and treat it as a second reader, not a gate. It will miss things and it will invent a few. The model finds plausible leads quickly. You still decide which ones are real.

Skip the 800-skill libraries. A short, read-and-scanned loadout beats a big unread one, and the biggest risk in this whole list is the skill you installed without reading. If you do nothing else today, run agent-scan over the folder you already have.

If your remit touches the infrastructure these changes run on, our guide to the top Claude skills for platform engineers and SREs covers the credentials-heavy end of that. And if you also own the services the code ends up in, see the top Claude skills for backend engineers.