Best security skills, page 61

Reviews Kubernetes manifests and cluster config for security misconfigurations, ranks them by blast radius, and gives a minimal hardening patch for each.

criptogus/agent-evolve-network

Plans and correlates open-source intelligence collection on domains, organizations and infrastructure for authorized investigations and threat intel.

criptogus/agent-evolve-network

Plans and runs authorized reconnaissance to enumerate a target's external attack surface (DNS, subdomains, ports, web tech) and produces a prioritized report.

criptogus/agent-evolve-network

Hunting skill for ssrf vulnerabilities.

sickn33/agentic-awesome-skills

Trigger Pattern Protocol has privileged authorities (admin, operator, upgrade authority, governance) - Inject Into Breadth agents (optional), depth-state-trace

PlamenTSV/plamen

Trigger Pattern updatecurrentcontractwasm detected in codebase - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern stellarbridge|sorobanbridge|horizon|anchorprotocol|bridge|crosschain|relay|wormhole|allbridge|debridge|axelar|LayerZero|sequence|emitter - Inject Into Breadth agents, depth-external

PlamenTSV/plamen

Trigger Pattern MONETARYPARAMETER flag (fee, rate, emission, cap, bps values) - Inject Into Breadth agents (merged via M4 hierarchy)

PlamenTSV/plamen

Trigger Pattern Any external module interaction detected in attacksurface.md - Inject Into Breadth agents (merged via M5 hierarchy)

PlamenTSV/plamen

Trigger Pattern Any env.invokecontract() or env.tryinvokecontract() detected in contract - Inject Into Breadth agents

PlamenTSV/plamen

Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (metabuffer.md enrichment)

PlamenTSV/plamen

Trigger FASTANDARD flag detected (protocol uses FungibleAsset standard) - Used by Breadth agents, depth-token-flow

PlamenTSV/plamen

Protocol Type Trigger NAMEDEXTERNALPROTOCOL (detected when recon finds import/interface for an identifiable external protocol — not standard libraries).

PlamenTSV/plamen

Trigger Pattern Contract upgrades via updatecurrentcontractwasm, storage migration, deprecated functions, token migrations - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case

PlamenTSV/plamen

L1 trigger - audits peer-to-peer networking for DoS vectors (resource exhaustion, amplification), eclipse attack susceptibility, and discovery table poisoning (Kademlia/devp2p).

PlamenTSV/plamen

Trigger REENTRANCY flag detected (dynamic dispatch, closures, dispatchable FA, function values) - Used by Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger HASMULTICONTRACT flag in templaterecommendations.md (recon detects 2+ in-scope contracts/modules sharing parameters or formulas) - Agent Type general-purpose (standal...

PlamenTSV/plamen

Trigger Pattern operator/keeper/crank requireauth checks, authority-gated functions - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern SEP-41 token patterns detected (approve/transfer/transferfrom/allowance/balance) - Inject Into Breadth agents, depth-token-flow, depth-edge-case

PlamenTSV/plamen

Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth agents

PlamenTSV/plamen

Trigger Pattern interval|period|duration|delay|cooldown|lockperiod|timelock|unbonding|claimdelay|withdrawdelay|maturity|ledgersequence|timestamp - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern SEP-41 token transfers, TokenClient::new, transfer/transferfrom/burn, XLM native balance - Inject Into Lifecycle, External-Env agents

PlamenTSV/plamen

Generate a STRIDE-based security threat model for a repository.

Factory-AI/factory-plugins

Reviews package dependencies for security vulnerabilities, outdated versions, and license compliance.

aiskillstore/marketplace

Security auditing and vulnerability assessment specialist. An agent skill from aiskillstore/marketplace.

aiskillstore/marketplace

Turn an investment agent into a supply-chain bottleneck hunter.

aiskillstore/marketplace

Comprehensive dependency mapping, analysis, and visualization tool for software projects

aiskillstore/marketplace

A skill your agent uses when opening or updating a GitHub pull request after Phase 5 of /compliance:analyze-cve has applied and verified a CVE fix locally.

openshift-eng/ai-helpers

On-demand security and code quality audit. An agent skill from MadAppGang/claude-code.

MadAppGang/claude-code

Scan networks to discover devices, gather MAC addresses, vendors, and hostnames.

sundial-org/awesome-openclaw-skills

Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or…

sundial-org/awesome-openclaw-skills

Assess vulnerabilities and audit for security compliance using OWASP and STRIDE methodology — a user-invoked Security Auditor workflow.

dralgorhythm/claude-agentic-framework

CRITICAL: Never modify files in content-addressable storage systems where the filename IS the content hash (SHA256, IPFS CID, etc.).

divinevideo/divine-mobile

Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications.

SpecterOps/skills

Assess identity trust topology, assurance boundaries, issuer and relying-party responsibilities, and failure containment before testing a specific authentication or authorization mechanism.

cyberful/cyberful

Audit where access policy is decided and enforced across source, configuration, services, caches, jobs, and data stores, including deny behavior and decision-input integrity.

cyberful/cyberful

Route a cloud-native security audit across effective IAM, infrastructure as code, build and release paths, containers, Kubernetes, serverless workloads, secrets, event sources, and control-plane…

cyberful/cyberful

Operate a managed Firefox/Marionette laboratory for privileged chrome-context experiments, content automation, real WebDriver windows, permission readback, and synthetic X11 clipboard controls.

cyberful/cyberful

Use the release-embedded MITRE ATT&CK snapshot as a threat-informed reasoning lens without allowing the framework to constrain novel vulnerability discovery.

cyberful/cyberful

Test account and authenticator recovery as an assurance transition, including proofing, channel changes, support overrides, replay resistance, and post-recovery invalidation.

cyberful/cyberful

Route file-ingestion security work across processing pipelines, deserialization and object binding, and SOAP or XML services.

cyberful/cyberful

Route HTTP intermediary testing across request normalization, web-cache behavior, and offline traffic evidence.

cyberful/cyberful

Test identity linking, invitation, merge, provisioning, deprovisioning, and account-association ceremonies for proof-of-control, tenant binding, uniqueness, lifecycle, and rollback failures using…

cyberful/cyberful

Test promotions, referrals, quotas, inventory, and entitlement invariants through authorized, bounded, reversible experiments with tester-controlled accounts and assets.

cyberful/cyberful

A skill your agent uses when drafting an ACM CCS rebuttal during the HotCRP author-response window, covering threat-model defenses, adaptive-attack objections, ethics and disclosure questions…

brycewang-stanford/Awesome-Journal-Skills

A skill your agent uses when positioning an ACM CCS submission against the security big-four and specialist literature, including arXiv preprints, prior CCS/S&P/USENIX/NDSS papers, concurrent…

brycewang-stanford/Awesome-Journal-Skills

A skill your agent uses when deciding whether a security project fits ACM CCS versus IEEE S&P, USENIX Security, NDSS, PETS, or a crypto/theory venue, identifying the security contribution type, and…

brycewang-stanford/Awesome-Journal-Skills