UnboundCompute/security-agent-skills

What it is

UnboundCompute/security-agent-skills is an MIT-licensed collection of 194 security-testing skills. Each is a directory containing a SKILL.md (YAML frontmatter plus a standalone playbook body). The skills name the capability a step needs, such as "something that answers who calls this from a real parse", rather than a specific product. The README presents them as authorized-use only: your own code, OSS you contribute to, CTFs, and in-scope engagements.

How the catalog is organized

The README table tags each skill with a lane (white-box, research, agent, supply-chain, black-box, cloud, iac, k8s, api, mobile, windows, web3, identity, injection, and others). A few entries are useful starting points:

• hunting-bugs-with-a-code-graph is the white-box master loop: orient, enumerate the whole taxonomy, adjudicate.
• adjudicating-taint-paths turns a source-to-sink lead into a confirmed finding or a documented kill.
• adjudicating-dependency-cve-reachability decides whether a dependency CVE is reachable from your code.
• vetting-skills-before-install, auditing-skill-and-mcp-instructions and auditing-declared-vs-used-permissions check a third-party skill or MCP server and end in an install, constrain or deny verdict.
• writing-vuln-reports turns a confirmed finding into a reproducible writeup. All skills emit findings in one shared schema so results can be deduplicated and passed to it.

What to do

Install every skill and keep them updatable through the Claude Code plugin marketplace:

/plugin marketplace add UnboundCompute/security-agent-skills
/plugin install security-agent-skills@unboundcompute

Update later with:

/plugin marketplace update unboundcompute

To take a single skill, copy its directory into a skills path. Project-local, checked in with your repo:

cp -r skills/detecting-race-conditions .claude/skills/

Or personal, available in every project:

cp -r skills/detecting-race-conditions ~/.claude/skills/

Installed skills are matched by Claude automatically from their name and description. Other runtimes that follow the Agent Skills format can be pointed at the skills/ directory. You can also read a SKILL.md and follow its loop by hand, running your own tools at each step.

Preconditions

The white-box skills assume you can answer structural questions from a real parse. The page lists a code property graph, a static analyzer, or careful manual tracing on a small target as acceptable. Black-box and other lanes likewise rely on tools you supply.

Caveats

• The page gives no sample findings, no benchmarks and no evidence of how reliably skills trigger or perform. It states design intent only.
• It says each skill carries a "rationalizations to reject" section and worked examples, and that every skill opens with a scope check or gate. The page does not say how those gates are enforced.
• Installing through the marketplace pulls all 194 skills at once. For a narrower footprint, use the single-directory copy. Because these are third-party skills, the repo's own vetting-skills-before-install lane applies to it too.