Skip to content
appsgit

10 picks · ranked by GitHub stars

Best agent skills for security

The best agent skills for security are Wizard, Ponytail Audit and Next Bundle Optimizer; Wizard leads with 305,150 GitHub stars.

The list covers 147 agent skills in the appsgit catalog, one entry per repository.

Updated · data from GitHub, refreshed daily

Top picks

  1. Rank 1:

    Wizard

    mattpocock/skills

    Generate an interactive bash wizard that walks a human through steps only they can perform.

    Active · last commit Oct 27, 2026

    SecurityShell

    Stands out for the most GitHub stars. Wizard has 305,150 GitHub stars, has 556,079 installs on skills.sh and runs without an API key.

  2. Rank 2:

    Ponytail Audit

    DietrichGebert/ponytail

    Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split.

    Active · last commit Oct 18, 2026

    SecurityJavaScript

    Stands out for running without an API key. Ponytail Audit has 178,476 GitHub stars, has 559 installs on skills.sh and runs without an API key.

  3. Rank 3:

    Next Bundle Optimizer

    vercel/next.js

    Audit and reduce Next.js browser initial-load work.

    Active · last commit Oct 27, 2026

    OfficialSecurityJavaScript

    Stands out for being published by the vendor itself. Next Bundle Optimizer has 143,173 GitHub stars, is published by the vendor itself and runs without an API key.

At a glance

Agent skills for security compared

Ranked by GitHub stars (installs on skills.sh break ties), at most one entry per repository so one project cannot fill the list.

Top 10 picks compared, data as of Oct 28, 2026
AppStands out forLicenseGitHub starsLast commitAPI key
Wizardthe most GitHub starsMIT305,150Oct 27, 2026Not needed
Ponytail Auditrunning without an API keyMIT178,476Oct 18, 2026Not needed
Next Bundle Optimizerbeing published by the vendor itselfMIT143,173Oct 27, 2026Not needed
Clouda permissive MIT licenseMIT119,344Oct 26, 2026Needed
Security And Hardening–MIT111,265Oct 13, 2026Not needed
Browser Auth Flow–MIT79,852Oct 28, 2026Not needed
Learn Agent Skills–MIT74,816Oct 23, 2026Not needed
Nature Response–Apache-2.051,089Oct 28, 2026Not needed
Improve Animations–MIT50,840Oct 11, 2026Not needed
Security Audit–MIT50,670Sep 14, 2026Not needed

Full ranking

All 10 picks, ranked

Ranked by GitHub stars (installs on skills.sh break ties), at most one entry per repository so one project cannot fill the list.

  1. 1

    Wizard

    Generate an interactive bash wizard that walks a human through steps only they can perform.

    Stands out for the most GitHub stars. Wizard has 305,150 GitHub stars, has 556,079 installs on skills.sh and runs without an API key.

  2. 2

    Ponytail Audit

    Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split.

    Stands out for running without an API key. Ponytail Audit has 178,476 GitHub stars, has 559 installs on skills.sh and runs without an API key.

  3. 3

    Next Bundle Optimizer

    Audit and reduce Next.js browser initial-load work.

    Stands out for being published by the vendor itself. Next Bundle Optimizer has 143,173 GitHub stars, is published by the vendor itself and runs without an API key.

  4. 4

    Cloud

    Documentation reference for using Browser Use Cloud — the hosted API and SDK for browser automation.

    Stands out for a permissive MIT license. Cloud has 119,344 GitHub stars, is published by the vendor itself and needs an API key or token.

  5. 5

    Security And Hardening

    Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a…

    Security And Hardening has 111,265 GitHub stars, has 69,390 installs on skills.sh and runs without an API key.

  6. 6

    Browser Auth Flow

    Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md.

    Browser Auth Flow has 79,852 GitHub stars and runs without an API key.

  7. 7

    Learn Agent Skills

    Focused interactive tutor for the Agent Skills Engineering path in AI Engineering from Scratch.

    Learn Agent Skills has 74,816 GitHub stars, has 4 installs on skills.sh and runs without an API key.

  8. 8

    Nature Response

    Draft, audit, or revise responses to peer review, revision cover letters, and marked-manuscript or LaTeX revision packages.

    Nature Response has 51,089 GitHub stars and runs without an API key.

  9. 9

    Improve Animations

    Survey a codebase's animation and motion code as a senior motion advisor, then produce a prioritized audit and self-contained implementation plans for other agents (or cheaper models) to execute.

    Improve Animations has 50,840 GitHub stars, has 221,891 installs on skills.sh and runs without an API key.

  10. 10

    Security Audit

    Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons.

    Security Audit has 50,670 GitHub stars, is published by the vendor itself, has 2,214 installs on skills.sh and runs without an API key.

FAQ

Questions and answers

Still curious? Email info@appsgit.com.

Do these agent skills need an API key?

1 of the 10 picks need an API key or token, for example Cloud; 9 run without one. Each page on appsgit lists the environment variables a agent skill expects.

Which coding agents work with these skills?

Claude Code (all), Codex (7 of 10), Cursor (5 of 10) and OpenCode (4 of 10). The client list comes from each project's published compatibility data; appsgit does not guess it.

Are any of these agent skills official?

Yes: Next Bundle Optimizer, Cloud and Security Audit are published by the vendor themselves.

How is this list ranked?

Ranked by GitHub stars (installs on skills.sh break ties), at most one entry per repository so one project cannot fill the list.

The weekly digest

New self-hosted apps, every week

Fresh releases, rising projects and one deploy guide a week. Join home labbers and engineers who self-host.

One email a week. No spam, unsubscribe anytime.