Security Bundle Skill

Curated by Skill Harbor. This is not a fixed pack that installs many skills at once, and it is not a page that only links to other pages. It is a dynamic orchestrator: a single skill that works for you, in plain words, at the moment you need to check something before you click or publish. How it works, in order: 1. You show what worries you, in normal words: a suspicious email, a link, a file, a page to publish, or a project to check. No jargon needed. Never click the suspicious link just to test it, and never enter a password or a code to test it. 2. It does a quick check of what a safe check means for your case: sender and links in an email, dependencies in a project, or rules in a published app. 3. It searches Skill Harbor for skills that fit that need. 4. By default, it only looks for free skills that need no API key, no account, and no payment. That way it works right away, with no setup. 5. It shows you a short list, three to five skills, with what each one does, what it does not do, and its verification status. It never invents a skill and never hides a requirement. 6. It waits for your go before installing anything. Nothing is installed without the list shown first. 7. It installs only what you approved, uses those skills step by step, and then summarizes the result in plain words: what was checked, what looks risky, what looks clear, and what to do next. If you want to go deeper, say so. Only then, on your explicit word, it can look at API options: cloud security posture with your own cloud account, or online scan tools with a key. Those need an account, sometimes a paid service, and access to your own data. It explains that before, never after. You connect those yourself, in your own environment. It never asks for a secret in chat. Honest limits, written in the bundle itself: - A check is not a proof that you are safe. It says what was checked and what was found, not that nothing else can go wrong. Never promise that an email, a file, or a site is safe. - A clean dependency audit does not prove that code is safe. It lists known issues found by that check. - A phishing check does not open a suspicious link and does not enter credentials. If a link must be opened, it is the user's decision, after the summary, not a step of the check. - The Skill Harbor MCP, when used as the search engine inside the bundle, is read-only. It finds fiches and install prompts; installation and execution happen outside it, in your own environment. - Free, no-API skills give local checks and guides, not live cloud data and not a full security audit. Live cloud data is the API opt-in, not the default. - Every skill chosen at runtime must be verified at that moment: slug exists, price is free, API need is checked, verification status is shown. Examples that fit today, to be re-verified at runtime, not a fixed list, all verified present and free in the local file on 2026-10-31, category Security: anti-phishing-email-check, trailofbits-skills-fp-check, briiirussell-cybersecurity-skills-dependency-audit, firebase-security-rules-auditor.