Best security skills, page 16

Hunt for exploitable, bounty-worthy security issues in repositories.

affaan-m/ECC

A skill your agent uses when the user asks to log in or out with a wallet session, fetch a wallet sign-in challenge, verify an externally signed challenge, or troubleshoot AltLLM Portal wallet login…

internet-court/internet-court-skill

A skill your agent uses when the user asks to create a NOWPayments crypto payment link, poll payment status, or execute a supported direct wallet payment through the AltLLM Portal CLI.

internet-court/internet-court-skill

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing.

davila7/claude-code-templates

Turn a captured HTTP request/response into a bounded, redacted evidence pack with a stable request-ref using the mantishttpaudit MCP server, instead of pasting raw traffic into a finding

deonmenezes/mantishack

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。

zhaoxuya520/reverse-skill

A skill your agent uses when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA/IDOR, function-level…

makifbaysal/tasktrooper

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills

Hunt for vulnerabilities in a running debuggee by analyzing imports/exports, triaging attack surface, and iteratively testing for bugs with PoC generation.

dariushoule/x64dbg-skills

Package and finalize completed work for delivery — use when a feature is done and ready to ship

nyldn/claude-octopus

Author and verify an OpenTaint rule. An agent skill from seqra/opentaint.

seqra/opentaint

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that…

tinyfish-io/tinyfish-cookbook

Ghost Security - Software Composition Analysis (SCA) scanner.

ghostsecurity/skills

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel…

utkusen/sast-skills

Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste.

microsoft/haste

Run this project's verification — the full local CI mirror (ruff, mypy, import contract, pytest with PostgreSQL, coverage floors, dogfood, generated docs and site, the isolated example suites, the…

guardana/guardana

Scans text that has already been de-identified for leftover identifiers such as SSNs, card numbers, emails and dates, and blocks release if anything turns up.

maziyarpanahi/openmed

Django 安全最佳实践、认证、授权、CSRF 防护、SQL 注入预防、XSS 预防和安全部署配置. An agent skill from affaan-m/ECC.

affaan-m/ECC

在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。

affaan-m/ECC

Java Spring Boot 服务中认证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全性的 Spring Security 最佳实践。

affaan-m/ECC

Manages the repo's supply-chain soak window (SOAKDAYS) — checks and fixes the derived surfaces, bumps or disables the window, adds dated per-package exclusions, and bumps pinned external tools.

nubjs/nub

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Systematically detects all reentrancy vulnerability variants in smart contracts — classic, cross-function, cross-contract, and read-only reentrancy.

quillai-network/quillshield_skills

Reference for aster.yaml, covering review models, analyzers, focus areas, include/exclude globs, minconfidence, and the permissions block that gates edits.

Zfinix/aster

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

alpha-omega-security/scrutineer

A skill your agent uses when publishing, open-sourcing, exporting, sanitizing, or moving code, agent skills, prompts, templates, fixtures, datasets, workshop assets, or other artifacts from a…

serejaris/personal-corp-os

Rules for working behind Iron Proxy: connect external accounts without handling raw tokens, treat blocked requests as policy outcomes, and never claim a connection before it works.

nanocoai/nanoclaw

Reviews code for security, performance, quality and maintainability, then reports findings in a fixed template with a rating, severity levels and suggested fixes.

luongnv89/claude-howto

Runs the installed local Semgrep CLI through a bounded JSON wrapper with two bundled non-secret rules.

KimYx0207/Kim_Service

Runs ffuf for DAST work: directory and file discovery, GET and POST parameter fuzzing, virtual host enumeration and filtered, recursive scans.

AgentSecOps/SecOpsAgentKit

Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.

putervision/state-memory-mcp

Path traversal / Local File Inclusion detection→file-read→RCE for web apps.

s0ld13rr/pentestcode

Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.

irahardianto/awesome-agv

Secure secrets in Google Cloud Secret Manager. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Use before merging security-relevant Rust changes. An agent skill from Jxck/sptth.

Jxck/sptth

Detecta riscos básicos de segurança em repositórios (segredos expostos, configurações perigosas, padrões inseguros) e gera recomendações com evidências.

glaucia86/repocheckai

生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。

xwtro0tk1t-cloud/harness

Audit Entra ID app registration and service principal security posture.

SCStelz/security-investigator

Systematic false positive verification for security findings.

vibeeval/vibecosystem

Analyzes Solidity contract entry points to map attack surface.

alt-research2/SolidityGuard

Dependency audit and cleanup workflow for maintaining healthy project dependencies.

bobmatnyc/claude-mpm

Performs security-focused differential review of code changes (PRs, commits, diffs).

waybarrios/opencode-power-pack

Build structured threat actor profiles using the 5W1H framework and the Diamond Model.

tsale/awesome-dfir-skills

MCP threat-model artifact for a scaffolded harness. An agent skill from ruvnet/metaharness.

ruvnet/metaharness

Run splint after cppcheck/clang-format/clang-tidy precommit sanity to find memory issues, API misuse, and contract violations in staged C code (tolerates older C parser limitations).

MidnightBSD/src

Generates a single standardized submission-style CTF writeup for competition handoff and organizer review.

ljagiello/ctf-skills

Overlays SARIF results, weAudit annotations and binary-analysis exports onto a Trailmark code graph so each finding can be read next to blast radius and taint data.

trailofbits/skills

Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.

trailofbits/skills