Best security skills, page 14

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

affaan-m/ECC

Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.

Encod3d-Sec/TORCH

Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.

transilienceai/communitytools

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

jnMetaCode/shellward

Static Application Security Testing orchestration — run and compose Semgrep, CodeQL, Bandit, gosec, Brakeman, SpotBugs, ESLint; author custom rules; ingest SARIF; triage and rank findings by…

hardw00t/ai-security-arsenal

Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation.

aftermathlabs/llvm-msvc

Detect error propagation, chain failures, and single-point breakdowns that cascade across agent workflows.

Tencent/AI-Infra-Guard

AI governance, EU AI Act compliance, OWASP LLM security, responsible AI practices for GitHub Copilot agents

Hack23/cia

Use webspec-index to query WHATWG, W3C, IETF and TC39 web specifications from the command line

SAP/project-foxhound

Audit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation.

briiirussell/cybersecurity-skills

Security audit skill. An agent skill from blueberrycongee/termcanvas.

blueberrycongee/termcanvas

Changing or adding a project setting / default value in RedAmon.

samugit83/redamon

Route Mira detection findings into a reusable knowledge pipeline.

vw2x/Mira

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB.

ADScanPro/Claude-AD

CORS misconfiguration testing for data theft and access control bypass

NeoTheCapt/RedteamAgent

Subdomain takeover playbook — sweep subdomains for dangling CNAMEs / NS records pointing at unclaimed third-party resources (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, ...), confirm with the…

PentesterFlow/agent

Lets the agent list and read the secrets a user has configured, such as API keys and tokens, through two tai tools instead of hardcoding credentials into code or commands.

YaoApp/yao

Enrich an IOC (IP, domain, hash, URL) with threat intelligence.

dandye/ai-runbooks

Run snapshot regression tests after changes to OPA rules, scanners, analyzers, or formatters to detect output regressions.

boostsecurityio/poutine

当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…

zhaji2333/CkSKILLS

Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities.

sreichholf/dreamDroid

Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails.

OWASP/secure-agent-playbook

Review or implement security-sensitive code in the Static Web Server (SWS) project — path traversal defenses, symlink and hidden-file policy, TLS, security headers, CORS, basic auth, untrusted input…

static-web-server/static-web-server

嵌入式网络调试工具，用于发现接口、抓包、分析 pcap/pcapng、做连通性测试、端口扫描和流量统计. An agent skill from zhinkgit/embeddedskills.

zhinkgit/embeddedskills

Follow the money via public records and sanctions data. An agent skill from Luciole-Studio/Misaka-Agent.

Luciole-Studio/Misaka-Agent

A skill your agent uses when reviewing an agent Skill before sharing, installing, or executing it and when checking a Skill bundle for credentials, dangerous commands, suspicious network behavior…

zrt-ai-lab/opencode-skills

Shows, adds and removes the host directories that NanoClaw agent containers may access, recording each as read-only or read-write in an allowlist file.

nanocoai/nanoclaw

Explains how to call external APIs through the OneCLI proxy, which injects stored credentials into outgoing HTTPS requests so the agent never handles keys.

nanocoai/nanoclaw

Code review covering security, performance, quality and maintainability, with a fixed report layout and two analysis scripts; the SKILL.md itself is in Ukrainian.

luongnv89/claude-howto

TypeScript monorepo 审查：XSS、SQL 注入、密钥、any、console.log. An agent skill from liuyanghejerry/Clausura.

liuyanghejerry/Clausura

Finds exploitable application security vulnerabilities in code changes.

getsentry/warden

Model a method's taint propagation as a passThrough approximation.

seqra/opentaint

Ghost Security — combined security report. An agent skill from ghostsecurity/skills.

ghostsecurity/skills

Guides writing, reviewing and tuning YARA-X malware detection rules, covering string selection, performance, false-positive reduction and migration from legacy YARA.

trailofbits/skills

Hunt for the failure this project exists to prevent — code that compiles, types, tests green, and quietly reports "all clear" about something it never examined.

guardana/guardana

KISA 기반 보안 취약점 분석평가를 수행합니다. An agent skill from cdppcorp/KESE-KIT.

cdppcorp/KESE-KIT

A skill your agent uses when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum…

hypnguyen1209/offensive-claude

Procedure for keeping playwright-rust's cargo audit / cargo deny / cargo vet checks green when bumping the project's own version, when external crates change, and when a security advisory drops.

padamson/playwright-rust

Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.

alpha-omega-security/scrutineer

Scans a whole codebase or a set of changes for security issues, and turns findings into verified patch files that you apply yourself.

anthropics/claude-plugins-official

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets.

zebbern/claude-code-guide

Walks a backend-dev agent through OWASP API Top 10 checks, authentication and authorization patterns, and defense code during API design.

revfactory/harness-100

Turns a leaked key, token or password into one tracked rotation task the moment it's spotted, instead of a reminder repeated every session.

avelikiy/great_cto

Find similar vulnerabilities and bugs across codebases using pattern-based analysis.

waybarrios/opencode-power-pack

Paid API marketplace for AI agents via Corbits. An agent skill from moonpay/skills.

moonpay/skills

Security review of an open-autonomy agent service — cryptographic key handling, dynamic code execution, ABCI authentication and replay, secret exposure, dependency supply chain, and deployment…

valory-xyz/open-autonomy

Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs.

AgentSecOps/SecOpsAgentKit

SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。

xwtro0tk1t-cloud/harness