Best security skills, page 21

Squad de 15 agentes de seguranca ofensiva e defensiva (Georgia Weidman, Peter Kim, Jim Manico, Chris Sanders, Omar Santos, Marcus Carey) cobrindo pentest, red team, blue team, AppSec, recon e…

ohmyjahh/xquads-squads

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

cobusgreyling/loop-engineering

Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection.

AgentSecOps/SecOpsAgentKit

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and…

zebbern/claude-code-guide

Cryptography expert for TLS, symmetric/asymmetric encryption, hashing, and key management

RightNow-AI/openfang

Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology

RightNow-AI/openfang

Record a vetted Hex package version in hexvet.exs after a security review — manages the audit ledger, not the scanner.

oliver-kriska/claude-elixir-phoenix

Deep reentrancy vulnerability analysis for Solidity contracts.

alt-research2/SolidityGuard

Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across SQL databases (PostgreSQL, SQL Server, Oracle).

totvs/engpro-advpl-tlpp-skills

S3 resiliency, security, and data protection review. An agent skill from aws/tools-for-devops-agent.

aws/tools-for-devops-agent

Run competitive research like an intelligence agency: eight collection disciplines (OSINT to MASINT), signal-to-inference chains, and fusion.

deanpeters/Product-Manager-Skills

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

trailofbits/skills

Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

trailofbits/skills

Query token security audit to detect scams, honeypots, and malicious contracts before trading.

npc-live/clawfirm

Security rules for eserstack in TypeScript and Go: secrets, output hygiene, input validation, authorization, injection, SSRF, error sanitization, httpfx hardening, tokens, passwords, cookies…

eser/stack

Kimlik doğrulama eklerken, kullanıcı girdisi işlerken, secret'larla çalışırken, API endpoint'leri oluştururken veya ödeme/hassas özellikler uygularken bu skill'i kullanın.

affaan-m/ECC

Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…

akitaonrails/my-skills

Secure LLM-powered applications with input validation, output controls, tenant isolation, and abuse prevention.

sickn33/agentic-awesome-skills

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation…

mukul975/Anthropic-Cybersecurity-Skills

Tool to get the caller of a function in the codebase. An agent skill from opensage-agent/opensage-adk.

opensage-agent/opensage-adk

Analyze user callbacks for re-entrancy defects (deadlock, corruption)

ben-manes/caffeine

Helps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export.

GRCEngClub/claude-grc-engineering

Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f

CommonHuman-Lab/nyxstrike

For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the…

lyonzin/knowledge-rag

Generates edge case, failure mode, and spec-driven test cases.

ash1794/vibe-engineering

A skill your agent uses when performing deep analysis of specific findings or high-risk areas during a security audit.

ccashwell/evm-cortex

Collects live operating-system inventory (OBOM) and host hardware inventory (HBOM) as CycloneDX documents using the cdxgen obom and hbom commands, including osquery-backed runtime artifacts, Linux…

cdxgen/cdxgen

[omh] Attack paths into an operated system: turn a system's components and data flows into assets, trust boundaries, attack scenarios, controls, and the security test that proves each control holds.

rlaope/oh-my-hermes

Constructs distributor accounts, inventory binds, commission or markup, and browse-and-quote, including the ready-to-sell scene.

openqa-cn/codexqa

Security review: (1) vet an untrusted SKILL.md or .mcp.json BEFORE installing it — the injection/exfiltration scanner; CRITICAL blocks the install; (2) audit code on an untrusted-input path (a…

redhat-et/ripwire

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup.

briiirussell/cybersecurity-skills

PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Transform AI agents from task-followers into proactive partners.

LeoYeAI/openclaw-master-skills

Meta's 86M prompt injection and jailbreak detector. An agent skill from Orchestra-Research/AI-Research-SKILLs.

Orchestra-Research/AI-Research-SKILLs

A skill your agent uses when invalid data causes failures deep in execution - validates at every layer data passes through to make bugs structurally impossible rather than temporarily fixed

ed3dai/ed3d-plugins

Audits an external (third-party) Claude Code plugin pinned in this marketplace for security risk before it is vendored, and writes the report to a file for downstream posting.

bitwarden/ai-plugins

Answer general or cross-domain questions with a non-pleasing rational mode: adversarial red-team and blue-team expert analysis, mutually exclusive conclusions, up to five debate rounds, saved…

digoal/blog

Hunt for a specific APT/threat actor in your environment. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Perform a comprehensive security audit of all project files in the current working directory.

LaravelDaily/AI-Workflows-For-Laravel

Hunts for the other instances of a bug already found — the variants of one root cause across a codebase.

trailofbits/skills

Review Express.js security audit patterns for middleware and routes.

IgorWarzocha/Opencode-Workflows

Security-focused code review mapped to OWASP Top 10 and ASVS.

OWASP/secure-agent-playbook

Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated…

tobihagemann/turbo

Autonomously deep-scan entire codebase line-by-line, understand architecture and patterns, then systematically transform it to production-grade, corporate-level professional quality with optimizations

davila7/claude-code-templates

Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…

hardw00t/ai-security-arsenal

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks.

github/awesome-copilot

Verify supply chain integrity for AI agent plugins, tools, and dependencies.

github/awesome-copilot

Quality standards for Salesforce Lightning Web Components (LWC), Aura components, and Visualforce pages.

github/awesome-copilot