AI 코딩 에이전트를 위한 사이버보안 기술 모음입니다. AI가 무더운 일을 처리하고; 당신이 스택과 우선순위에 대한 맥락을 전달합니다.

모든 경험 수준에서 유용하도록 설계됨:

• 보안 엔지니어 및 펜테스터가 공식 감사를 수행하는 경우 — 구체적인 GREP 패턴, OWASP / NIST/ATT&CK 정렬, 감사인 검토를 통과하는 보고서 템플릿
• 개발자들 전담 보안팀 없이 더 안전한 코드를 배포하는 것 — 일반적인 스프린트에 맞는 보안 작업, 각 발견이 왜 중요한지에 대한 쉬운 영어 설명
• 창업자, 운영 담당자, 소규모 팀 운영자들이 CISO를 고용할 수 없는 스택을 확보하는 경우 — 가장 일반적인 보안 업무에 대한 가이드되고 의견이 뚜렷한 플레이북, 감사 기술이 발견한 내용과 이유를 설명하는 방식
• 빨강/파랑/보라색 팀 실제 교전 수행 — 공격 정찰, 웹 펜테스트, 위협 사냥, 탐지 엔지니어링, SOC 작전

이 기술을 사용하려면 보안 전문가일 필요는 없습니다. 이 기술은 AI 에이전트가 종단 간 실행을 통해 모든 기술 독자가 이해할 수 있는 언어로 결과를 설명할 수 있도록 작성되었습니다.

Cybersecurity Skills for AI Agents

A collection of cybersecurity skills for AI coding agents. The AI does the heavy lifting; you bring the context about your stack and your priorities.

Built to be useful at every experience level:

• Security engineers and pentesters running formal audits — concrete grep patterns, OWASP / NIST / ATT&CK alignment, report templates that pass auditor review
• Developers shipping safer code without a dedicated security team to lean on — security work that fits into a normal sprint, plain-English explanations of why each finding matters
• Founders, ops folks, and small-team operators securing a stack they can’t afford a CISO for — guided, opinionated playbooks for the most common security work, with the audit skill explaining what it found and why
• Red / blue / purple teams running real engagements — offensive recon, web pentest, threat hunting, detection engineering, SOC operations

You do not need to be a security expert to use these skills. The skills are written so the AI agent can run them end-to-end and explain the findings in language any technical reader can follow. If you can describe what you have and what you want to know about it, the agent can do the work.

Skills are authored as Claude Code SKILL.md files (the canonical format) and built into adapters for Cursor and Codex. Installable via npx skills or the Claude Code plugin marketplace.

Built by Bri Russell. I run real audits with these skills, then bring the gaps I find back into the skill itself — so each version is a little less opinion and a little more evidence.

Contributions welcome! Field feedback is the most valuable contribution — whether you’re a security engineer who hit a gap during an audit, a developer whose AI agent missed something obvious, or a founder who used a skill and got an answer that wasn’t quite right. Open a PR or open an issue — every level of expertise produces useful signal.

Where to start

Not every skill is for every user on day one. A good starting point by context:

• Not sure? Ask for security-start (or just say “where do I start with security?”). It asks two or three questions and picks the skill.
• Reviewing your own code or product: start with owasp-audit for the source-code sweep, then api-audit if you have API endpoints, then dependency-audit for the CVE pass
• A CVE wave just dropped and you run many apps: patch-sweep to work out which apps are affected and ship fixes across the fleet, with dependency-audit for each project