More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    security txt builder and checker

    1

    Free: build a valid RFC 9116 security.txt so researchers can report vulnerabilities to you, lint existing files, and get server snippets.

    Free

    Security scanned
    security txt builder and checker

    security txt builder and checker

    Example session with this skill installed

    Make a security.txt for acme-shop.test. Reports should go to security@acme-shop.test first, or our contact page at https://acme-shop.test/security. Our policy is at https://acme-shop.test/security-policy, and we read English and Spanish. Also check the old file our last developer left. It's in examples/broken-security.txt.

    • Read your context and instructions
    • Compiled the security txt builder
    • Generated the UI component

    New file (valid, 0 errors), saved to .well-known/security.txt:

    Canonical: https://acme-shop.test/.well-known/security.txt
Contact: mailto:security@acme-shop.test
Contact: https://acme-shop.test/security
Policy: https://acme-shop.test/security-policy
Preferred-Languages: en, es
Expires: 2027-04-08T00:00:00Z

    Suggestions: add an Encryption: link to a public key so reporters can encrypt, and consider PGP-signing the file. Put a reminder to renew before April 8, 2027 in your calendar.

    Old file: INVALID, 8 errors. It uses a bare email instead of mailto:, an http:// contact link, and a pasted PGP key instead of a key URL. It has two Expires lines (one in the wrong date format, one already expired 252 days ago) and a broken line. Its Bounty: field isn't a registered field name, so researchers will ignore it. Replace it with the new file.

    Publishing: nginx, Apache, Caddy and static-host snippets are ready (securitytxt.py serve). After deploying, check that the URL returns 200 with text/plain; charset=utf-8.

    (Output from a real run on the bundled examples. The domain is a reserved .test name.)

    security-txt-builder-and-checker.tsx

    TSX · React component

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Give security researchers a way to reach you, in one command. Free.

    security.txt is a short text file at https://yourdomain/.well-known/security.txt that tells people who find a vulnerability how to report it. Without one, reports end up in sales inboxes, social media, or nowhere. This free skill gives your AI agent a builder and checker for the official format (RFC 9116), so your file is valid on the first try and stays valid.

    What it does

    • Build: a valid file from a few answers: contact (email, phone or web page, in order of preference), expiry (default 180 days), disclosure policy, encryption key URL, acknowledgments, hiring and preferred languages. Plain email addresses get mailto: added. The output is self-checked before it's written.
    • Check: lints an existing file against every MUST in RFC 9116: Contact present, exactly one Expires in RFC 3339 format, not expired (with warnings over a year out or within 30 days), https-only web links, mailto/tel URIs, no keys pasted inline, one field per line, valid language tags, PGP-signed layout, Canonical matching the served URL, and IANA-registered field names. It also spots an HTML page saved by mistake, which usually means the file isn't published.
    • Serve: copy-paste snippets for nginx, Apache, Caddy and static hosts (Netlify, Cloudflare Pages, GitHub Pages, Vercel) to publish at /.well-known/ with text/plain; charset=utf-8, plus a curl command to confirm it.

    Who it's for

    Website owners, small businesses, startups, developers and MSPs who want a simple, standard way to receive vulnerability reports, and anyone whose security scanner flagged "security.txt missing".

    Going further: paid skills from the same creator

    • phishing email analyzer: triage suspicious emails offline with SPF/DKIM/DMARC, look-alike domain detection, defanged IOCs and a risk score.
    • server log threat hunter: hunt nginx/Apache and SSH logs for attacks and break-ins, with ATT&CK mapping, an incident timeline, IOCs and a reviewable blocklist.
    • small business security audit: a broader security checkup for a small business.

    What's included

    • SKILL.md: what to ask, build/check/serve commands, how to explain each finding, and how to publish
    • scripts/securitytxt.py: build, check and serve commands
    • references/rfc9116-rules.md: every rule with its RFC 9116 section, the IANA field registry, and server-doc sources
    • examples/: a valid file and a deliberately broken one

    Standard-library Python only. No API keys, no network calls, no installs.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 9 days ago

    • Free to download with an account

    Requires

    Python

    Listed9 days ago

    What's inside

    Frequently Asked Questions