Best security skills, page 60

使用 xray 进行 Web 漏洞自动化扫描。当需要对 Web 应用进行全面漏洞扫描（XSS/SQLi/命令注入/SSRF/XXE/路径穿越/文件上传/弱口令等）时使用。xray 是长亭科技出品的综合性 Web 安全评估工具，支持主动扫描、被动代理扫描、基础爬虫扫描三种模式，内置丰富的检测插件和社区 POC。任何涉及 xray 漏洞扫描、Web 安全评估、被动代理扫描的场景都应使用此技能

wgpsec/AboutSecurity

Adversarial self-review for code that touches a trust boundary.

ccplugins/awesome-claude-code-plugins

Dependency gatekeeper. An agent skill from ccplugins/awesome-claude-code-plugins.

ccplugins/awesome-claude-code-plugins

Produce a repository-grounded application security threat model with assets, boundaries, abuse paths, priorities, and mitigations.

nightly-labs/openbot

Review or write Python, JavaScript, TypeScript, or Go code using secure defaults.

nightly-labs/openbot

Security review gate for MCP server installations. An agent skill from bobmatnyc/claude-mpm.

bobmatnyc/claude-mpm

Front door for running the clean-room unattended loop as a Claude Code dynamic WORKFLOW using in-session subagents, so it never spends claude -p API tokens.

hashgraph-online/awesome-codex-plugins

Operate CodeTruss local acceptance gates for coding-agent changes.

hashgraph-online/awesome-codex-plugins

Security review checklist with optional engagement scoping. An agent skill from hashgraph-online/awesome-codex-plugins.

hashgraph-online/awesome-codex-plugins

Threat modeling and attack surface analysis. An agent skill from hashgraph-online/awesome-codex-plugins.

hashgraph-online/awesome-codex-plugins

Systematic vulnerability scan across injection, auth, data exposure, and dependencies — traced by reading code, not grepping for keywords.

hashgraph-online/awesome-codex-plugins

Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms.

alpha-omega-security/scrutineer

Normalize an externally-produced security report in an arbitrary format into scrutineer findings.

alpha-omega-security/scrutineer

Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row.

alpha-omega-security/scrutineer

Look up every package this repository publishes across all registries via packages.ecosyste.ms, with downloads, dependent counts, latest version, registry URL and supply-chain risk flags.

alpha-omega-security/scrutineer

Extract bounded operational lessons from a settled triage cohort without changing finding dispositions or suppressions.

alpha-omega-security/scrutineer

Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts

NeoTheCapt/RedteamAgent

Systematic diagnosis of a red test, a rule that fires or stays silent wrongly, a scan or probe whose artifact looks wrong, a collector error, a red CI run or a gate that is green for the wrong reason.

guardana/guardana

Entry point for any development task in this repo — feature, bugfix, refactor, cleanup, a new command, target or evaluator, a collector change.

guardana/guardana

AWS Advisor workflow skill. An agent skill from diegosouzapw/awesome-omni-skills.

diegosouzapw/awesome-omni-skills

Security Ownership Map workflow skill. An agent skill from diegosouzapw/awesome-omni-skills.

diegosouzapw/awesome-omni-skills

Identify performance bottlenecks, inefficient patterns, and optimization opportunities through static analysis.

EmeaAppGbb/spec2cloud

Audit codebase for security vulnerabilities, insecure patterns, and compliance gaps.

EmeaAppGbb/spec2cloud

当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。

zhaji2333/CkSKILLS

Example security audit skill demonstrating how to audit code for security vulnerabilities.

Microck/ordinary-claude-skills

Play Yoink, an onchain capture-the-flag game on Base. An agent skill from BankrBot/skills.

BankrBot/skills

Audit a codebase read-only across seven quality pillars into one ranked report.

ai-driven-dev/framework

Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets.

harness/harness-skills

Add an SLSA Verification (SlsaVerification) step to an existing Harness pipeline to verify SLSA provenance attestations and optionally enforce OPA policy sets on provenance data.

harness/harness-skills

Add a SLSA Generation step (YAML type: provenance) to an existing Harness pipeline to generate SLSA provenance and optionally attest with Cosign (keyless, key-based, or Vault).

harness/harness-skills

主机安全CVE漏洞修复验证引擎。从主机漏扫报告(Excel)或CVE编号自动提取漏洞，查询威胁情报(NVD/EPSS/MSRC/OVAL)，生成修复脚本(fix.sh/fix.ps1)，SSH验证脚本可执行性，产出修复验证报告。覆盖 Linux(centos/ubuntu/debian/suse/amazon/fedora/alpine/arch) + Windows + Web-CMS…

infometa/workbuddyskills

漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7…

infometa/workbuddyskills

基于 OWASP Top 10 (2021) 标准提供代码安全审查，逐项检查 SQL 注入、XSS、SSRF、访问控制、加密失败等常见漏洞，并给出具体的漏洞代码示例与修复方案。当用户需要代码安全审查、安全加固、渗透测试辅助，或提及 OWASP、安全检查、SQL 注入、XSS、代码审计、安全清单等关键词时触发此技能。

rongxinzy/RongxinAI

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the…

davila7/claude-code-templates

Analyze and mitigate the bullwhip effect where demand variability amplifies upstream in supply chains.

asgard-ai-platform/skills

Net-zero transition playbook: GHG inventory (ISO 14064-1, GHG Protocol Scope 1/2/3), science-based targets (SBTi), TCFD and ISSB S1/S2 climate disclosure, Taiwan carbon fee, decarbonization roadmap…

asgard-ai-platform/skills

Analyze supply chain operations using the SCOR model across Plan, Source, Make, Deliver, and Return processes.

asgard-ai-platform/skills

Analyze Taiwan's manufacturing industry structure including semiconductor, electronics, machinery, and petrochemical sectors.

asgard-ai-platform/skills

Configure PHP ecosystem tooling, dependency management, and static analysis.

HoangNguyen0403/agent-skills-standard

Tool to get the program slice for a given function using Joern.

opensage-agent/opensage-adk

Tool to search for a function in the codebase. An agent skill from opensage-agent/opensage-adk.

opensage-agent/opensage-adk

Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment.

rsmdt/the-startup

AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.

danielvm-git/bigpowers

Run a reusable JavaScript supply-chain security baseline with pnpm-first hardening, release-age gating, lifecycle-script controls, exotic dependency checks, CI install checks, and optional incident…

instructa/agent-skills

Teaches agents to recognize and avoid security threats during normal activity.

trailofbits/skills-curated

服务器安全审计与加固。扫描 SSH、防火墙、端口暴露、文件权限、暴力破解等安全问题，生成报告并提供一键修复。当用户说服务器安全、安全审计、安全检查、安全加固时使用

majiayu000/spellbook

安全事件响应助手 - 专业的安全事件处置与应急响应专家。适用场景： (1) 安全事件识别与分类 (2) 应急响应计划制定 (3) 事件调查与取证分析 (4) 遏制与根除方案设计 (5) 系统恢复与业务连续性 (6) 事件复盘与改进建议 (7) 安全事件报告撰写 触发关键词：安全事件、应急响应、事件处置、入侵检测、安全告警、取证分析、恢复计划、事件复盘、安全报告、勒索软件、数据泄露

chendongqi/OPB-Skills

安全测试助手 - 专业的应用安全测试与防护专家。适用场景： (1) Web应用安全测试（OWASP Top 10漏洞检测） (2) API安全测试（认证/授权/数据泄露） (3) 安全测试用例设计与评审 (4) 渗透测试方案制定与执行指导 (5) 安全漏洞分析与风险评估 (6) 安全加固建议与最佳实践 (7) 安全合规检查（GDPR/等保） (8) 安全测试报告编写…

chendongqi/OPB-Skills