---
title: "security"
description: "Project-agnostic security skills for repository audits, diff review, deterministic scanning, supply chain, threat modeling, smart contracts, and AI systems."
canonical: https://agentpluginsdirectory.com/plugins/security
last-updated: 2026-09-22
---

# security
Project-agnostic security skills for repository audits, diff review, deterministic scanning, supply chain, threat modeling, smart contracts, and AI systems.
- Slug: security
- Publisher: Aboubakar Koïta
- Repository: https://github.com/akoita/agent-toolkit
- Manifest: plugins/portable/security/plugin.json
- Version: 0.7.4
- Category (editorial): security
- Skills: 7 (security-ai, security-audit, security-review, security-scan, security-smart-contracts, security-supply-chain, security-threat-model)
- MCP servers: 0
- Stars: 0
- Repository created: 2026-07-09
- Repository last pushed: 2026-09-17
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/security
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## Skills

- security-ai: Security review for LLM applications, AI agents, MCP servers and clients, the AI and ML supply chain, and repositories that ship agent skills or plugins. Covers prompt injection and indirect injection, exfiltration paths, agent permission and sandbox hardening, MCP authorization requirements, model…
- security-audit: Run a repository-wide security audit and own the shared doctrine, severity, evidence, triage, suppression, reporting, that the other security skills restate. Use for a deep audit of a whole codebase or a large subsystem, for turning scanner output into evidence-backed findings, and for producing…
- security-review: Review a diff or pull request for security-relevant changes and return falsifiable, inline, advisory comments. Use when the unit of work is a change, a branch, a pull request, staged edits, and the question is whether it introduces risk. Do not use as a blocking gate, for a whole-repository audit…
- security-scan: Run the free deterministic security toolchain, SAST, ecosystem linters, SCA, secrets, IaC, DAST, fuzzing, normalize the output to one digest, and handle each tool's exit codes and suppression syntax. Use when the task is choosing, installing, invoking, or wiring scanners into pre-commit, CI, nigh…
- security-smart-contracts: Audit Solidity and EVM smart contracts, web3 protocols, and on-chain code. Use for smart contract review, Solidity or DeFi audit, proxy and upgradeability checks, invariant and property fuzzing design, oracle and price manipulation review, ERC-4337 or EIP-7702 account abstraction, Permit2 and signa…
- security-supply-chain: Harden a project's software supply chain: audit CI/CD workflows, pin actions to commit SHAs, control package-manager and install-script risk, enforce lockfiles and release cooldowns, emit an SBOM, sign artifacts and produce build provenance, and work through the repository checklists and regulatory…
- security-threat-model: Build a repository-grounded threat model: extract the system model from the code, derive trust boundaries, assets and entry points, calibrate attacker capabilities, enumerate abuse paths, rank them by likelihood and impact, and separate existing mitigations from recommended ones. Use for threat mod…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.