Application security

The top-rated launch-quality Application security skill for AI agents is codeql-scan (grade A), followed by performing-fuzzing-with-aflplusplus and securityheaders. Skillspace rates 1,926 Application security skills; 272 are launch-quality.

Secure coding, OWASP, threat modelling, and any scan whose output is security vulnerabilities (SAST, DAST, fuzzing, dependency and code scanning) regardless of which tool or pipeline stage runs it.

Launch-quality skills first, then by grade, then by our Skill Score, which adds judge reviews, test results, GitHub stars and adoption.

  1. codeql-scan A
  2. performing-fuzzing-with-aflplusplus A
  3. securityheaders B
  4. yao-websecurity-skill B
  5. ssllabs B
  6. audit B
  7. exploiting-stack-buffer-overflows B
  8. fuzzing-for-memory-bugs B
  9. vulnerability-analysis B
  10. gwxapkg-ai-audit B
  11. discover-attack-surface B
  12. security-setup B
  13. fuzz B
  14. smart-contract-audit B
  15. security-stinger B
  16. security-audit-methodology B
  17. dependency-auditor B
  18. security-audit-rlm B
  19. infra-security B
  20. performing-agentless-vulnerability-scanning B
  21. detecting-shadow-api-endpoints B
  22. implementing-api-security-posture-management B
  23. finding-security-misconfigurations B
  24. checking-session-security B
  25. spectra-audit C

Frequently asked questions

What is the best Application security skill for AI agents?

The top-rated launch-quality Application security skill for AI agents is codeql-scan (grade A), followed by performing-fuzzing-with-aflplusplus and securityheaders. Skillspace rates 1,926 Application security skills; 272 are launch-quality.

How does Skillspace rate Application security skills?

Skillspace grades every Application security skill from A to F with a published scoring engine that reads the skill's SKILL.md: architecture and maturity make the score, and a security scan can cap it. In crowded categories, a judge model also compares the strongest contenders side by side, and some skills are tested head-to-head on real tasks against other skills in the same category (including a deliberately weak one) and a no-skill baseline. Launch-quality skills are graded A to C with a clean safety verdict, and not excluded by a quality filter: the filters catch skills our model's safety screen flags for prompt injection, guardrail bypass, harmful content or credential exposure; test fixtures and attack benchmarks; skills written only for the repository they live in; templates and stubs; and near-duplicate variants and copies of other skills. Ratings were last updated on 24 September 2026; the full method is on the methodology page.

Are Application security skills safe to install?

Of the 1,926 Application security skills Skillspace rates, 1,427 passed its safety scan with no flag from its model, and 499 are flagged: 42 for review, 389 as risky, 65 as unsafe, 2 as attack benchmarks and 1 as a test fixture. Each skill's page shows its safety verdict. A pass is not a guarantee: the scan reads only the skill's SKILL.md, not the scripts or other files it ships, and looks for patterns such as piping a remote script into a shell, reading credentials or hiding actions from the user. Skills are third-party code that Skillspace indexes but does not host or endorse, so read a skill's source on GitHub before you install it.

Skillspace indexes and rates skills; it does not host or endorse them. Run third-party skills at your own risk.