Dependency Upgrade Planner
by Edric Vale
Free
Safe dependency upgrade plans: changelog-aware risk scoring, test hints, and rollback paths.
11
82
Security & Compliance Skills for Windsurf
Skills for security audits, static analysis, vulnerability triage, and compliance checks. Ship safer software and meet regulatory requirements faster.
318 live security & compliance skills for Windsurf.
security first
by Roy Yuen
Free
Prevent vulnerabilities before they happen by forcing early security framing and secure-by-default design patterns.
2
33
cybersecurity bridge for all agentic
by Roy Yuen
Free
A high-performance wrapper to route security tasks directly to the Anthropic-Cybersecurity-Skills library.
3
23
Bounty Security Pattern Master Library — 399 Vulnerability Patterns
$75
A premium library of 399 vulnerability patterns and DeFi attack vectors for AI-driven bug hunting and security audits.
6
135.0(1)
ai security auditor
by Timoranjes
Free
Comprehensive security auditing for AI agents, covering prompt injection, tool permissions, and data leakage risks.
2
11
AI Cleanroom Solutions Tool Cleanroom Design
Free
Expert AI guidance for ISO-compliant cleanroom design, HVAC filtration setup, and controlled environment installation.
2
9
dependency health check
by Timoranjes
Free
Automated security audit and health check for software dependencies across polyglot projects.
2
6
ADA Compliance Checker (Free) Most Common problems only
Free
A fast, free 3-point accessibility screen (text contrast, image alt text, form labels) to spot the most common ADA/WCAG problems before they cost you.
2
5
accessibility auditor
by Timoranjes
Free
Audit frontend code for WCAG 2.2 AA compliance with prioritized remediation steps and deep semantic analysis.
2
4
AI Prompt Injection Defense Shield & LLM Jailbreak Security Auditor Code Review Agent
Free
Stop leaving your AI startup exposed to malicious users trying to steal your proprietary system prompts or bypass your paywalls. The AI Prompt Injection Defense Shield is an automated code review agent that deeply analyzes your Next.js or Python backend, instantly detecting insecure LLM input fields, un-sanitized API data streams, and weak prompt boundaries. By automatically generating the exact copy-paste code patches required to harden your AI wrapper against the latest OWASP top 10 LLM vulnerabilities, this skill allows solo developers and indie hackers to confidently launch their SaaS without the fear of massive, unexpected API billing spikes or catastrophic data leaks.
1
4
sast configuration
by LocoLoboZ
$10
Automate the setup and optimization of Semgrep, SonarQube, and CodeQL for high-signal security testing.
3
3
Fact Check
by Summer
Free
Automated factual verification using tiered official sources to eliminate hallucinations and circular reasoning.
2
35.0(1)
soc2 compliance pack
by Kaymue
Free
Get SOC2 Type II-ready in 90 days. 17 policy templates, 64 control mappings, automated AWS/GCP/GitHub evidence collection.
2
3
prompt injection auditor v2
by Kaymue
Free
Audit prompts and MCP tools for prompt injection. 47 attack patterns, OWASP LLM Top 10, generates adversarial tests. CVSS-scored.
2
3
🔒 PII & Data Leak Scanner
$15
Scan local SQL, CSV, JSON, seed, fixture, and log files for PII-indicating names plus email-, SSN-, card-, and phone-like values. Get file/line findings with matched values redacted by default—no network, writes, database connection, or compliance claim.
2
3
AI Code Reviewer
Free
Evidence-first AI code review that discovers, verifies, prioritizes, and explains meaningful code problems.
1
3
Cybersecurity Engine
by Joker
Free
Enterprise security with NIST/ISO27001/zero-trust frameworks. Threat modeling, GDPR compliance, DevSecOps guidance.
1
3
text moderation tool
by Jose Luis
Free
Moderate toxic language, detect personal data leaks, and audit domain security configurations via MCP.
3
2
Prompt Injection Red Team Kit
Free
Red-team your own AI agent for prompt-injection and tool-misuse vulnerabilities before it ships — then fix them. Maps your attack surface, generates a defensive test plan with the safe behavior expected for each case, and gives a prioritized mitigations list. Defensive use only.
1
2
code repair spine
by GTDataworks
Free
Generate source-safe repository audits and repair handoff bundles without mutating your code.
1
2
kubernetes manifest reviewer
by Timoranjes
Free
Professional-grade Kubernetes YAML auditor for security, API deprecations, and deployment best practices.
1
2
Senior Web App Architect for Coding Agents
$9.99
Messy, insecure, unfixable — that's what AI builds without architecture. This file is the architecture: 10 years of senior judgement on rendering, caching, security and SEO, so your agent builds it right from day one.
6
15.0(1)
truth first enterprise
by Roy Yuen
$5
Transform AI claims into verified, risk-assessed technical reports for production, DevOps, and enterprise governance.
3
1
Ironclad — Senior Software Developer
by OnwireFlow
$9.99
Makes your coding agent work like a senior developer: exact money with no rounding errors, configurable rules, real audit trails, honest testing and review. Any stack, any country.
2
1
Why security & compliance skills work in Windsurf
Each skill on this page is a SKILL.md file built for security & compliance work and confirmed to run in Windsurf. Install one into .windsurf/skills/ (project) or ~/.windsurf/skills/ (global), start a new session, and Windsurf follows the workflow the creator encoded instead of improvising from a short prompt.
Listings are ranked by installs, upvotes and reviews, so what surfaces first is what other Windsurf users actually keep. Free and paid skills compete on the same page, and every listing shows its security scan result before you download anything.