Best security skills, page 12

Raise Go modules to caller-supplied minimum fixed versions from CVE/GO findings in any format, per tracked module root, sync go.mod/go.sum and root vendor/, audit the source module graphs, run the…

kubernetes-sigs/cloud-provider-azure

Watch a pushed PR's checks with the Monitor tool, and act on the verdict.

parawanderer/OpenTagViewer

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Diagnose a denied Tenuo call and make the legitimate call work with the smallest change to authority.

tenuo-ai/tenuo

Single-pass codebase analysis leveraging a 1M-token context window for comprehensive security scanning, architecture review, and dependency auditing.

yonatangross/orchestkit

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

affaan-m/ECC

Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency…

affaan-m/ECC

A skill your agent uses when asked to sweep, clean up, or revisit pnpm overrides and minimumReleaseAge exclusions in platform/pnpm-workspace.yaml — unwinding a matured temporary CVE pin once its fix…

archestra-ai/archestra

Run Claude programmatically against collections of files in the codebase.

imbue-ai/sculptor

A skill your agent uses for ALL authorized offensive-security / bug-bounty work — the single method to find, chain, prove, dedup, and package the highest-value (High/Critical) findings across every…

mtarcure/claude-vibe-squad

关闭 Code Scanning (CodeQL) 告警，需提供合理理由。当用户要求关闭 Code Scanning 告警、dismiss CodeQL 告警时触发。参数为告警编号。

ModelEngine-Group/fit-framework

Run Warden security scans in this repo using Sentry's warden-skills.

UsefulSoftwareCo/executor

Add Datapages authentication: define and read the Session type, open and close sessions, configure CSRF protection and choose a session manager.

romshark/datapages

Maps threat actor behavior and observed indicators to MITRE ATT&CK, builds Navigator coverage heatmaps, finds detection gaps and produces threat intelligence reports.

mukul975/Anthropic-Cybersecurity-Skills

磁盘取证分析技术，涵盖 NTFS/FAT/ext 文件系统解析、文件恢复、时间线分析、日志挖掘等实战技能. An agent skill from MuWinds/BUUCTF_Agent.

MuWinds/BUUCTF_Agent

Switches on full safety by combining warnings before destructive commands with a block on edits outside one directory you choose, for work on production or live systems.

garrytan/gstack

Documents how quota-axi keeps its disk cache: location, strict file permissions, no stored secrets, and context-scoped identifiers that stop snapshots crossing accounts.

kunchenguid/quota-axi

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Analyzes authentication and authorization events for failed-login clustering, privilege-escalation chains, credential-stuffing patterns, and MFA-bypass indicators.

ahmadvh/octochains

Runs a security scan on a deployed Power Pages site, fetches the latest scan report, and produces a plain-language summary.

microsoft/power-platform-skills

Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.

BlkLeg/CircuitBreaker

Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Refreshes the guide's coding-agent and MCP security threat data through AgentSec Triage: research advisories, add tested records and synchronize the public feed.

FlorianBruniaux/claude-code-ultimate-guide

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…

cdxgen/cdxgen

Set up and run Deepsec vulnerability scans, triage, and CI gates.

first-fluke/fullstack-starter

Deep behavioral code analysis agent for Bug Hunter. An agent skill from codexstar69/bug-hunter.

codexstar69/bug-hunter

Probes an AI agent for supply-chain weaknesses: whether it loads untrusted plugins, tools or models, updates dependencies without pinning, or trusts user-supplied artifacts.

Tencent/AI-Infra-Guard

PHP Web 配置安全审计工具。识别 CORS/错误暴露/调试开关/安全头/危险运行时开关等，输出分级、可利用性分析、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

The Priority Board's three-layer score model (rules BASE, REVIEW by the built-in AI or an MCP agent, a person's DECISION) and who may write which layer.

samugit83/redamon

Reverse-engineers any app into a recon map: screen inventory, user flows, component list, inferred data model and a feature matrix, from public pages, screenshots, app store listings, help docs and…

Jakeschincariol/replica-skill

Turns a company's domains into likely storage bucket names and checks six cloud providers for publicly readable buckets, for authorized security assessments only.

forefy/.context

Capture Mira detection experiments locally, then distill selected evidence into a tracked case only when the user explicitly requests promotion into a report or the knowledge repository.

vw2x/Mira

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k).

ADScanPro/Claude-AD

Keeps truST's architecture simple and well separated, and runs the automated architecture checks.

johannesPettersson80/trust-platform

Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws

NeoTheCapt/RedteamAgent

A paranoid OWASP-Top-10-aware system prompt for AI code review that traces data flow, treats every input as malicious, maps each finding to an OWASP category, and outputs a structured Summary /…

aozyildirim/Agena

Perform exhaustive analysis of a critical IOC. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

deonmenezes/mantishack

Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.

iflytek/skillhub

Debug FlyDSL GPU kernels that produce NaN, inf, wrong results, or crash.

ROCm/FlyDSL

当你需要开发/排查 HTTP 抓取、SSRF、Playwright 受控浏览器、本地字体增强截图，或判断 webfetch 与 browser 工作流如何选型时使用。

xrkseek/XRK-AGT

Python 遗留代码审查：bare except、SQL 注入、反序列化、密钥、调试输出. An agent skill from liuyanghejerry/Clausura.

liuyanghejerry/Clausura

Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

seqra/opentaint

Security guidelines for writing secure code. An agent skill from semgrep/skills.

semgrep/skills

Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

ptn1411/skill

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Maps the state-changing entry points of a smart contract codebase and sorts them by access level, producing a structured audit report that leaves out read-only functions.

trailofbits/skills