Agentic AI Security Skills: Specialized Capabilities for AI Assistants
The rise of AI coding assistants has created a new category of security tooling — skills that give AI agents specialized cybersecurity capabilities. From automated SAST scanning to multi-stage pentesting subagents, these skills transform general-purpose AI assistants into security power tools. This guide covers the ecosystem of security skills available for AI agents.
What Are AI Security Skills?
AI security skills are specialized prompt packages and tool integrations that give AI agents (like Claude Code, Cursor, Copilot) domain-specific cybersecurity knowledge and capabilities. They work by:
- Loading domain knowledge: Injecting security frameworks, attack patterns, and best practices into the agent’s context
- Providing structured workflows: Defining step-by-step security assessment procedures
- Integrating with tools: Connecting the agent to security scanning and testing tools
- Enforcing methodology: Ensuring the agent follows established security methodologies
SAST and Vulnerability Detection Skills
llm-sast-scanner
llm-sast-scanner is a SAST skill for AI coding agents with impressive capabilities:
- 34 vulnerability classes: Comprehensive coverage of common vulnerability types
- Source-to-sink taint analysis: Tracks data flow from untrusted inputs to dangerous sinks
- Judge verification: Uses a secondary LLM to verify findings and reduce false positives
- 99%+ precision/recall on benchmarks: Validated accuracy on standard datasets
- Compatible with: Claude Code, Codex CLI, and other AI coding agents
sast-skills
sast-skills by Utku Sen is a collection of agent skills that turn your AI coder into a SAST scanner:
- Static analysis capabilities within the coding assistant
- Pattern matching for common vulnerability types
- Context-aware analysis that understands framework-specific risks
Semgrep Skills
Semgrep Skills are the official skills for Claude Code and other AI assistants:
- Security scanning with Semgrep’s pattern-based analysis
- Code analysis for vulnerability detection
- Integration directly into AI-assisted development workflows
- Leverages Semgrep’s extensive rule library
Offensive Security Skills
pentest-ai-agents
pentest-ai-agents provides 31 Claude Code subagents for offensive security, organized across multiple domains:
| Domain | Specializations |
|---|---|
| Reconnaissance | OSINT, network mapping, social engineering |
| Web Application | XSS, SQLi, SSRF, IDOR, authentication bypass |
| Active Directory | Kerberos, LDAP, privilege escalation |
| Cloud | AWS, Azure, GCP misconfiguration testing |
| Mobile | Android, iOS application testing |
| Wireless | WiFi, Bluetooth, NFC assessment |
| Reverse Engineering | Binary analysis, malware analysis |
| Payload Crafting | Evasion techniques, encoding, obfuscation |
| Detection Engineering | SIEM rule writing, alert tuning |
| Forensics | Disk, memory, and network forensics |
| Reporting | Finding documentation, executive summaries |
Tier 2 agents can execute tools directly with approval gates, enabling semi-autonomous pentesting workflows.
claude-bug-bounty
claude-bug-bounty is a Claude Code skill for AI-assisted bug bounty hunting:
- Automated reconnaissance
- IDOR, XSS, SSRF, OAuth, and GraphQL testing
- LLM injection testing
- 4-gate validation checklist
- Automated report generation
Threat Modeling Skills
tm_skills
tm_skills provides agent skills for Continuous Threat Modeling:
- Automated threat identification for new features
- STRIDE methodology implementation
- Integration with development workflows
- Continuous assessment as code changes
Anthropic Cybersecurity Skills
Anthropic Cybersecurity Skills is a massive collection of 734+ structured cybersecurity skills:
- MITRE ATT&CK mapped: Every skill mapped to specific ATT&CK techniques
- agentskills.io standard: Following the emerging standard for agent skill definitions
- Compatible with: Claude Code, Copilot, Codex CLI, Cursor, and Gemini CLI
- Comprehensive coverage: From initial access to exfiltration
Industry and Community Skills
Elastic Agent Skills
Elastic Agent Skills enable natural language security investigations:
- Query logs, traces, and threat intelligence through conversation
- Correlate security events across data sources
- Generate detection rules from investigation findings
Ghost Security Skills
Ghost Security Skills provide application security capabilities for Claude Code:
- SAST and DAST integration
- API security testing
- Code review with security focus
Trail of Bits Skills Marketplace
Trail of Bits Skills brings Trail of Bits’ security expertise to Claude Code:
- Security research capabilities
- Vulnerability detection methodologies
- Audit workflows based on Trail of Bits’ proven processes
Building Custom Security Skills
Skill Structure
A well-designed security skill typically includes:
name: "security-sast-scan"description: "Run SAST analysis on the current codebase"triggers: - pattern: "scan for vulnerabilities" - pattern: "security review"steps: - name: "identify languages" prompt: "Identify all programming languages in the codebase" - name: "select rules" prompt: "Select appropriate SAST rules for each language" - name: "run analysis" prompt: "Analyze code for each vulnerability class" - name: "verify findings" prompt: "Verify each finding with a secondary check" - name: "report" prompt: "Generate structured findings report"Best Practices for Security Skills
- Include verification steps: Reduce false positives with secondary analysis
- Map to frameworks: Reference OWASP, MITRE ATT&CK, CWE for credibility
- Provide remediation: Don’t just find vulnerabilities — suggest fixes
- Respect scope: Include explicit boundary checks to prevent testing outside authorized scope
- Log everything: Maintain audit trails for compliance
The Future of AI Security Skills
The skills ecosystem is rapidly evolving:
- Standardization: The agentskills.io standard is emerging as a common format
- Marketplaces: Trail of Bits and others are creating curated skill marketplaces
- Integration: Skills are becoming native features of AI coding assistants
- Automation: Skills are enabling autonomous security testing workflows
- Compliance: Skills are being used for automated compliance checking
Key Takeaways
- AI security skills transform general-purpose AI assistants into specialized security tools
- SAST skills (llm-sast-scanner, sast-skills) bring static analysis directly into the coding workflow
- Pentesting skills (pentest-ai-agents, claude-bug-bounty) enable AI-driven security testing with human oversight
- Threat modeling skills (tm_skills, Anthropic Cybersecurity Skills) automate security assessment
- The ecosystem is standardizing around formats like agentskills.io, making skills portable across AI platforms
- 734+ skills in the Anthropic Cybersecurity Skills collection demonstrate the breadth of security capabilities available