Best security skills, page 52

Normalize and compare authorized fraud-control observations from local evidence, highlighting decision drift, coverage gaps, and conflicting outcomes without making a fraud or vulnerability verdict.

cyberful/cyberful

Parse bounded classic PCAP files offline into deterministic capture metadata, packet-length and timestamp summaries, link and network protocol counts, truncation indicators, and source digests…

cyberful/cyberful

Model fraud and abuse threats across actors, account states, value flows, controls, and monetization paths.

cyberful/cyberful

Assess the security of a smart-contract system across protocol economics, trust roles, upgrade and governance paths, oracle and bridge dependencies, deployment state, and off-chain operators.

cyberful/cyberful

Audit desktop client source, binaries, packaging, updater, local storage, IPC, protocol handlers, WebViews, plugins, native bridges, credential use, and OS integration for trust-boundary failures.

cyberful/cyberful

Audit extracted embedded firmware for boot and update trust, credential and secret handling, service exposure, privilege boundaries, parsers, persistence, cryptography, hardening, recovery, and…

cyberful/cyberful

Audit security logging and telemetry from event creation through transport, storage, access, correlation, retention, and response use.

cyberful/cyberful

Test browser capability transfer across postMessage, opener, frame, portal, worker, service-worker, BroadcastChannel, MessagePort, and extension messaging boundaries.

cyberful/cyberful

Test whether every segmentation and scope-reduction control isolates the cardholder data environment from claimed out-of-scope systems and differing security levels.

cyberful/cyberful

Test payment decision and value-movement invariants with authorized synthetic instruments and reversible sandbox transactions.

cyberful/cyberful

Trace uploaded, imported, generated, archived, converted, scanned, rendered, and downloaded files across storage, naming, extraction, parser, sandbox, and cleanup boundaries.

cyberful/cyberful

Reconstruct how principal, actor, issuer, audience, assurance, scopes, and delegated authority change across requests, tokens, services, queues, and stored artifacts.

cyberful/cyberful

Reconstruct how tenant and organization context is authenticated, selected, routed, cached, queued, and bound to resources across distributed request paths.

cyberful/cyberful

Reconstruct transaction state across services, ledgers, queues, and compensations from local artifacts, identifying causal gaps, duplicate effects, and value mismatches without active traffic.

cyberful/cyberful

A skill your agent uses when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or…

ericrisco/rsc-harness

A skill your agent uses when writing, reviewing, modernizing, building, or debugging C++ - RAII and resource lifetime, smart-pointer ownership, move semantics and the Rule of Zero/Five, target-based…

ericrisco/rsc-harness

A skill your agent uses when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog…

ericrisco/rsc-harness

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness

A skill your agent uses when writing or running Go tests — table-driven cases, named subtests, parallel isolation, fakes instead of mock frameworks, coverage profiles, benchmarks, fuzzing, golden…

ericrisco/rsc-harness

A skill your agent uses when bootstrapping architecture documentation for a brownfield project by reverse-engineering ADRs from an existing codebase.

tikalk/adlc-team-skills

Implement CIS Controls v8 critical security controls for effective cyber defense in CIA platform

Hack23/cia

Implement strong encryption, secure hashing, and proper key management following NIST and OWASP cryptography guidelines

Hack23/cia

Master GitHub Agentic Workflows (gh-aw) - AI-powered repository automation with safe outputs, sandboxed execution, and multi-engine support

Hack23/cia

Hack23 Information Security Policy integration for SDLC — developer-facing mapping of ISP requirements to daily engineering activities, tooling, and evidence

Hack23/cia

Hack23 ISMS organization-wide compliance requirements, policy enforcement, audit preparation

Hack23/cia

AI-enabled security excellence through transparent ISMS implementation, defense-in-depth, and strategic planning aligned with Hack23 business model

Hack23/cia

MCP gateway security patterns, token management, request validation, and audit logging for MCP communications

Hack23/cia

Map CIA platform security controls to NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover

Hack23/cia

Open source governance, security posture badges, license compliance, SBOM generation, and vulnerability management for transparency-driven development

Hack23/cia

Secure SDLC phases, security requirements, secure coding practices, and security testing integration for the CIA platform

Hack23/cia

Hack23 secure development policy enforcement, SAST/DAST integration, dependency scanning, and code signing practices

Hack23/cia

Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform

Hack23/cia

Threat modeling before coding, STRIDE methodology, defense in depth, security controls in SDLC

Hack23/cia

Maintain comprehensive security documentation including SECURITYARCHITECTURE.md, THREATMODEL.md per Hack23 ISMS standards

Hack23/cia

Focused static audit of device firmware and IoT software for update, boot, provisioning, credential, debug-interface and device-communication boundary failures, using an ISVS-informed threat model.

alpha-omega-security/scrutineer

Focused static audit for attacker-controlled reads, requests, parsers, or error paths that can disclose files, metadata, secrets, or internal responses.

alpha-omega-security/scrutineer

Audit package manager clients, registries, and proxies against a bundled threat model.

alpha-omega-security/scrutineer

Focused static audit for real personal or customer-identifying data committed to source or exposed through logs, URLs, telemetry, exports, and responses.

alpha-omega-security/scrutineer

Focused static audit of web applications and APIs for session, browser-origin, upload and business-workflow boundary failures, using an ASVS-informed threat model.

alpha-omega-security/scrutineer

Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized.

alpha-omega-security/scrutineer

Eval-only short-prompt variant of security-deep-dive for A/B testing against the production prompt.

alpha-omega-security/scrutineer

Audit a Claude/Agent SKILL.md (or any AI skill / system prompt) for safety before installing or merging it.

mohitagw15856/pm-claude-skills

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle.

google/skills

Audits direct and transitive dependencies for license compliance, maintenance health, CVEs, abandoned packages, and bloat.

Mathews-Tom/armory

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory

APT 模拟与情报驱动红队方法论。基于已知 APT 组织的 TTP（MITRE ATT&CK）设计红队行动计划。当需要模拟特定威胁组织、设计高仿真攻击演练、或根据威胁情报制定攻击策略时使用

wgpsec/AboutSecurity

C2 Beacon 配置提取与分析。当捕获到 Cobalt Strike/Sliver/Havoc 等 C2 框架的 Beacon 样本、内存 dump、或网络流量时使用。提取 C2 地址、通信协议、Malleable Profile、Watermark 等关键情报。红队视角：了解蓝队如何从 Beacon 提取 IOC 以改进 C2 OPSEC

wgpsec/AboutSecurity

C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改

wgpsec/AboutSecurity