Best security skills, page 20

How RedAmon tests actually run and how to author them: the per-file Docker gate, the unit/integration/live tiers, and the failure modes that make a green run a lie.

samugit83/redamon

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…

samugit83/redamon

Working on the HTTP capture proxy and its replay/fuzz path: the egress guard that stops the proxy becoming an SSRF pivot, why it checks the resolved IP, and keeping capture off the scan's critical…

samugit83/redamon

AD 域环境持久化技术。当已获取域管/本地管理员权限、需要建立持久访问以确保重启或密码更改后仍能回到目标环境时使用。覆盖主机级持久化（计划任务/注册表Run/COM劫持/WMI事件订阅/Windows服务/启动文件夹）、域级持久化（Golden Ticket/Silver Ticket/Skeleton…

wgpsec/AboutSecurity

Discover hidden directories, files, and endpoints on a web server

NeoTheCapt/RedteamAgent

Instruments code to track the flow of untrusted or sensitive data at runtime, enabling detection of injection vulnerabilities, data leaks, and privilege violations.

ArabelaTso/Skills-4-SE

Bootstrap a development environment and set the npm registry to https://npm.artifacts-mirror.internal-corp.dev

cisco-ai-defense/skill-scanner

Security-focused review for frontend/Web3 code. An agent skill from hyperlane-xyz/hyperlane-explorer.

hyperlane-xyz/hyperlane-explorer

Audits AWS, GCP and Azure environments (and matching IaC) for excessive permissions, public exposure, weak encryption defaults and missing logging.

criptogus/agent-evolve-network

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes.

bagofwords1/bagofwords

Comprehensive API security review against OWASP API Security Top 10 (2023).

OWASP/secure-agent-playbook

Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies.

VeryGoodOpenSource/vgv-ai-flutter-plugin

Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding

deonmenezes/mantishack

Agent skill for security-manager - invoke with $agent-security-manager

ruvnet/ruflo

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

ruvnet/ruflo

Rebuilds an app screen by screen from the recon map: app shell first, then the core flow as a vertical slice, then every screen with all its states, ticking off the feature matrix as it goes.

Jakeschincariol/replica-skill

Detect out-of-bounds memory accesses in CPU or GPU code using static interval analysis and runtime assertions/printfs.

ROCm/FlyDSL

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch.

ADScanPro/Claude-AD

Web vulnerability hunting playbook. An agent skill from PentesterFlow/agent.

PentesterFlow/agent

Flag only new security issues introduced by this diff. An agent skill from different-ai/openwork.

different-ai/openwork

OSINT username search across 400+ social networks. An agent skill from Tommy-yw/RunbookHermes.

Tommy-yw/RunbookHermes

Classify project-used dependency members and record taint sources as rule-authoring units.

seqra/opentaint

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates.

utkusen/sast-skills

Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.

trailofbits/skills

Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing.

trailofbits/skills

Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.

trailofbits/skills

Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.

trailofbits/skills

Behaviour-preserving restructuring and cleanup — splitting an oversized module, removing dead code, finished scripts, flags or documents, consolidating duplicates, tightening comments.

guardana/guardana

Usar para sincronizar la documentación viva del proyecto después de una fase.

686f6c61/alfred-dev

Multi-tenant authz, pre-auth disclosure hardening, and Kali disposition.

bbartling/open-fdd

A skill your agent uses when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction…

hypnguyen1209/offensive-claude

安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling new systems, implementing zero-trust…

telagod/code-abyss

Implement centralized audit logging and SIEM integration. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Configure iptables, nftables, and cloud firewalls. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain.

sickn33/agentic-awesome-skills

Automate security workflows and remediation. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Conduct threat modeling using STRIDE methodology. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Administer Windows Server systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart).

softspark/ai-toolkit

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation.

alpha-omega-security/scrutineer

Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR…

awarexone/Agentic-Bug-Hunter

Judge product usability and evidence quality. An agent skill from aryaniyaps/lamina.

aryaniyaps/lamina

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI.

github/awesome-copilot

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/.yml).

github/awesome-copilot

Run and fix the repository static analysis suite. An agent skill from ethereum/execution-specs.

ethereum/execution-specs

威胁归因方法论：钻石模型、基础设施图谱、置信度分级与归因报告. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills