Security testing · 4 free picks

Code audit: find security bugs in your own code

Code written by AI can have missing access checks, injection flaws or unsafe defaults that the owner cannot spot. Add-ons from strangers can be unsafe too. These skills and agents review your own code and the add-ons you installed; use them only on code you own or may test.

Free picks (tested by us)

Most useful first. Each one was installed on a clean test system; start with the first, try it, then add the next.

01
RecommendedskillPartly tested (needs an account)
Check add-ons before you trust them
Snyk Agent Scan
Checks the extras you installed before you trust them.
Test: installs cleanly; its main features need an account we did not use. Not yet used on real work.
EveryoneWatch outA full scan needs a free Snyk account and an API token (SNYK_TOKEN).
For any assistant
Paste this in the terminal
```
$ uvx snyk-agent-scan@latest
```
Other ways to install, and how we tested it
02
RecommendedskillPartly tested (needs an account)
Security review of your code
Trail of Bits Skills
Security experts’ checklists to review your own code.
Test: installs cleanly; its main features need an account we did not use. Not yet used on real work.
Good forSecurity testing, Web developersWatch outUse these skills only on code you own or have written permission to test. Some skills in the collection are for deeper attack research; we list only the review ones.
For Claude Code Also works with Codex CLI — see all steps
Step 1 of 2 · Type this inside Claude Code
```
> /plugin marketplace add trailofbits/skills
```
See all 2 steps
03
agentInstalls cleanly
Quality and security reviewers
VoltAgent quality and security subagents
Reviewers for quality and safety: a security auditor, a tester and an accessibility checker.
Test: installs cleanly and works without an account. Not yet used on real work.
Good forSecurity testing, Web developersWatch outThe pack includes a penetration-tester helper. Use it only on systems you own or may test in writing.
For Claude Code
Step 1 of 2 · Paste this in the terminal
```
$ claude plugin marketplace add VoltAgent/awesome-claude-code-subagents
```
See all 2 steps
04
skillPartly tested (needs an account)
Security check for Gemini
Gemini CLI Security extension
Lets Gemini check your own code for security problems.
Test: installs cleanly; its main features need an account we did not use. Not yet used on real work.
Good forSecurity testing, Web developersWatch outYour code is sent to Google's Gemini model for analysis. Do not use it on code that you may not share.
For Gemini CLI
Paste this in the terminal
```
$ gemini extensions install https://github.com/gemini-cli-extensions/security
```
What it does and how we tested it

Superpowers Pack · early access

Premium superpowers in the Superpowers Pack

We have not planned a skill of our own for code audit yet. The free picks on this page are our advice for now.

Free picks (tested by us)

Check add-ons before you trust them

Security review of your code

Quality and security reviewers

Security check for Gemini

Premium superpowers in the Superpowers Pack