What are the best Claude Code skills for security audits?
codeql from trailofbits/skills is the highest-scoring Claude Code skill for security audits, at 92/100 (grade A) on the Suede Skill Check. The table below compares the top 15 of 56 listed security audit skills from 7 repositories by score, publisher and license, using the October 22, 2026 snapshot of SuedeAI.directory.
- 56 listed security audit skills
- 8 full pages scoring 80+
- 14 repositories
Compare 15 Claude Code skills for security audits
Ranked by Suede Skill Check score. Linked names open the directory listing; scores come from the published rubric.
| Skill | Publisher | Suede Skill Check | License | What it does |
|---|---|---|---|---|
| codeql | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes. |
| semgrep | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Runs a Semgrep security scan over a codebase, detecting languages, selecting rulesets, requiring approval of the plan, and merging output to SARIF. |
| vulnerability-triage-brocards | Trail of Bits Official trailofbits/skills | 90/100 · A | CC-BY-SA-4.0 | This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a… |
| api-gateway-backend-security-and-rate-limiting | Google Official google/skills | 89/100 · B | Apache-2.0 | Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including… |
| skill-scanner | Sentry Official getsentry/skills | 88/100 · B | Apache-2.0 | Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation. |
| google-cloud-scc-query | Google Official google/skills | 87/100 · B | Apache-2.0 | Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from… |
| google-cloud-scc-remediation | Google Official google/skills | 87/100 · B | Apache-2.0 | Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and… |
| gha-security-review | Sentry Official getsentry/skills | 86/100 · B | Apache-2.0 | Reviews GitHub Actions workflows for exploitation vulnerabilities such as pwn requests, expression injection, credential theft, and supply chain attacks, with concrete proof-of-concept scenarios. |
| security-review | Sentry Official getsentry/skills | 86/100 · B | CC-BY-SA-4.0 | Reviews code for security vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues, using a systematic process with confidence-based reporting. |
| security-reviewer | jeffallan jeffallan/claude-skills | 86/100 · B | MIT | Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use… |
| code-reviewer | jeffallan jeffallan/claude-skills | 84/100 · B | MIT | Reviews code diffs and files for bugs, security vulnerabilities, code smells, N+1 queries, and naming issues, then produces a prioritized, structured review report. |
| secure-code-guardian | jeffallan jeffallan/claude-skills | 84/100 · B | MIT | Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security… |
| aig-scanner | Tencent Tencent/AI-Infra-Guard | 82/100 · B | MIT | Runs AI security scans of infrastructure, AI tools and skills, and AI agents, and evaluates LLM jailbreak resistance with Tencent's AI-Infra-Guard. |
| security-review | GitHub Official github/awesome-copilot | 81/100 · B | MIT | AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions… |
| claude-security | Anthropic Official anthropics/claude-plugins-official | 80/100 · B | All rights reserved | Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one… |
Questions and answers
Which security audit skill has the highest Suede Skill Check score?
codeql from trailofbits/skills scores 92/100, grade A, the highest of the 56 listed security audit skills in the October 22, 2026 snapshot. It earns full points for structural checks, recent maintenance and curated-list citations. semgrep from trailofbits/skills follows at 92/100.
How do I install a security audit skill in Claude Code?
Run npx skills add with the skill folder's GitHub URL from your project, or copy the folder into .claude/skills/ and Claude Code loads it when a request matches its description. For codeql, run: npx skills add https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/codeql. Each full skill page on SuedeAI.directory lists the same steps for Claude Code and Codex.
Are these security audit skills free?
All 15 security audit skills on this page are published in public GitHub repositories and cost nothing to download. 14 use an open-source or open-content license, led by Apache-2.0 (5), MIT (5) and CC-BY-SA-4.0 (4), so you can use and adapt the files at no cost under those terms. claude-security is published under the publisher's own terms, which restrict copying; read them before you install. 2 skills name credentials for an outside service; each full page lists them under Before you install.
Do these security audit skills work with Codex and Cursor?
Yes. Each of the 15 security audit skills on this page is a SKILL.md folder in the Agent Skills format, which Claude Code, Codex and Cursor all read. The skills CLI (npx skills add) installs 14 of them into Claude Code, Codex, Cursor and other agents, and each full skill page adds a project-level copy into .claude/skills for Claude Code and .agents/skills for Codex. claude-security follows the publisher's own install route, shown on its page.
How does SuedeAI.directory rank security audit skills?
By Suede Skill Check score from 0 to 99, which adds structure, description quality, instruction depth, bundled files, maintenance and curated-list citations, all read from each skill's published files. A skill joins this page when its name or summary matches the security audits keyword map; each repository fills at most three rows, so the table compares publishers.
Which security audit skills come from official publishers?
codeql, semgrep and vulnerability-triage-brocards from Trail of Bits, api-gateway-backend-security-and-rate-limiting, google-cloud-scc-query and google-cloud-scc-remediation from Google, skill-scanner, gha-security-review and security-review from Sentry, security-review from GitHub and claude-security from Anthropic are published by the company behind the tool, marked Official in the table.
Compare alternatives
More Claude Code skills by task
Presentations · Playwright and Browser Testing · Terraform · SEO · Code Review · Git and Pull Requests · MCP Servers · Data Analysis · Kubernetes · AWS · Email · Video · iOS and Swift · Flutter and Dart · React and Next.js · RAG and Vector Search · LLM Evals · SQL and Databases · Technical Documentation · UI Design
Browse by category: Security · DevOps and Cloud · Code Review and Code Quality.