Claude security skills for audits, scanners and guardrails

Claude security skills fall into three groups. Audit skills tell an agent how to review a codebase for vulnerabilities. Scanner skills wrap a tool that checks other skills, MCP servers or agent configs for risky behavior. Guardrail skills install rules that block dangerous commands. We reviewed 14: 7 get an install verdict and 7 come with caveats.

None of the 14 is rated clean. A tool that inspects code or scans your machine runs scripts, reads files and often installs an external CLI. What matters is whether the skill tells you what it touches.

What to look for in Claude security skills

Look at scope control. Does the skill default to guidance and only write files when you ask for a full run? Does it say where target code may run, and does it forbid probing production systems? Check how findings are verified, since an agent that reports unverified findings creates work. Cloudflare’s skill ships schemas and validators for this reason.

For scanners, check what leaves your machine. Some send redacted component data to a vendor, others call an LLM only if you enable it. And read the score as a prompt for review: documentation text often triggers pattern hits.

Also consider the boundary problem. A hook that blocks git push by matching text is a speed bump, not a sandbox. Of the 14 skills, 10 are marked “review” and 4 have broad access. The security page explains how we assign labels, and the skills docs cover allowed-tools and the permission rules that actually control tool use.

Recommended security skills

• Cloudflare security-audit is a single multi-agent skill that audits a codebase in six phases and writes independently verified findings. It has a 22 KB SKILL.md, 14 companion method files and two validators with unit tests. It defaults to guidance mode and says to run target code only in a network-isolated sandbox. Budget a large token spend for full runs.
• SkillSpector is NVIDIA’s Apache-2.0 scanner for agent skills, with 71 detection patterns and an optional LLM stage. The skill tells the agent to scan with --no-llm first, then review the source read-only. Install of the scanner itself is a separate, unpinned step. Our own scans report SkillSpector hits, and we triage them by hand.
• Cisco Skill Scanner uses YARA and YAML rules, dataflow analysis and an optional LLM judge, with SARIF output and a pre-commit hook. We could not confirm its license from the repository metadata. Its rules-only recall is low, so treat it as one layer.
• Trail of Bits Skills is 97 skills (about 25 plugins) for smart contracts, C/C++ and Rust review, Semgrep and CodeQL. It is expert-written and evaluated, but we label it broad access: several skills pre-approve unrestricted Bash, and the Firebase scanner sends live requests. Pick plugins for your stack, not all 97.
• git-guardrails installs a Claude Code PreToolUse hook that blocks git push, reset --hard, clean -f and branch -D. It needs jq and edits your settings.json if you choose global install. The matching is plain text, so do not rely on it as a boundary.

If you want a vendor scanner, Snyk Agent Scan needs a Snyk token and sends redacted component content, including skill content, to Snyk’s API. Anyone who cannot send skill text off the network should skip it.

For general code checks, see code review skills. To read how our own ratings work, start with how we review; the category page lists all 14.