Security

Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

dslsdzc/rev-skills

Runs Trivy filesystem scan against the repo root and emits structured vulnerability findings (CVE, package, versions) in the SDLC reviewer schema.

epam/ai-dial-chat

A skill your agent uses when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning…

jabrena/plinth

Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.

ptn1411/skill

Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation…

guardana/guardana

A skill your agent uses when asked to generate a "no way to prevent this" / no-way-to-prevent-this satire post for a memory-safety CVE (out-of-bounds write/read, buffer/heap overflow…

Xe/site

Walks through mutual TLS between services in a zero-trust setup: certificate hierarchy, rotation, a gradual PERMISSIVE-to-STRICT rollout and handshake debugging.

wshobson/agents

Generate secure coding prompts and guides for AI tools (Claude, ChatGPT, Cursor, Copilot).

cdppcorp/KESE-KIT

Professional network reconnaissance and port scanning using nmap.

BrownFineSecurity/iothackbot

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through…

zebbern/claude-code-guide

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering.

elementalsouls/Claude-BugHunter

Fix a CRITICAL Trivy finding that is failing CI in this repo (a vulnerability, misconfiguration, or secret from security-scan.yml or image-scan.yml), or add, review, or retire an entry in…

malloydata/publisher

C++ naming, formatting, static analysis, and RTTI rules for LuisaCompute.

LuisaGroup/LuisaCompute

Use HOL Guard to preview and protect AI-agent package installs, Cursor surfaces, CI, and automation workflows.

hashgraph-online/hol-guard

Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis.

tsale/awesome-dfir-skills

Give a decisive, project-grounded verdict on an external input — judged against the current project, not in the abstract.

leo-kuang-ai/spec-first

A skill your agent uses when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview.

ccashwell/evm-cortex

Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input…

utkusen/sast-skills

A skill your agent uses when scanning source code for bugs, anti-patterns, code smells, or quality issues in a codebase, or when running a proof-driven bug hunt that must find, prove, fix, and…

WrongStack/WrongStack

Dual-model code review via Codex CLI. An agent skill from suyuan2022/suyuan-skill.

suyuan2022/suyuan-skill

A skill your agent uses when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan.

vlinx-io/VelaTerm

Runs a security health check on an OpenClaw environment and audits skills before or after installation for supply-chain and data-leak risks.

Tencent/AI-Infra-Guard

Worked bug bounty case study of a yield aggregator: target scoring, fund-flow mapping, prior audit triage and a verdict per bug class, with role misconfiguration in focus.

tradecatlabs/vibe-coding-cn

Starting guide for Web3 bug bounty hunts: validating each finding, ten checks per external function, six questions to disprove your own bug, plus recon setup and target scoring.

tradecatlabs/vibe-coding-cn

Records a Web3 bug bounty hunt on ZKsync Era that ended with no findings, using it to show what a hardened protocol looks like and when to drop a target.

tradecatlabs/vibe-coding-cn

Generate a PR-ready technique proposal when an attack step doesn't map to existing SITF techniques.

wiz-sec-public/SITF

Audit, explain, or compare existing Tenuo warrants and delegation chains.

tenuo-ai/tenuo

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps.

wshobson/agents

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition.

wshobson/agents

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.

wshobson/agents

Generates fuzz test scaffolding for parsers handling external input (YAML, JSON, config files, user input).

ash1794/vibe-engineering

Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.

nordstjernen-web/northstar-browser

Static safety audit of a SKILL.md that scores five dimensions and acts as a gate: skills below the pass line do not ship, whatever else they score.

openJiuwen-ai/agent-core

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.

trailofbits/skills

The Massing release discipline — how to ship a verified, CI-green version-numbered release direct to main.

ibuilder/massing

分析 Code Scanning (CodeQL) 告警，评估安全风险并创建修复任务。当用户要求分析 Code Scanning 告警、CodeQL 告警时触发。参数为告警编号。

ModelEngine-Group/fit-framework

Finds security threats in a design with a STRIDE pass per component, rates severity and records fixes, with extra checks for AI agent and tool risks.

dralgorhythm/claude-agentic-framework

Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

mukul975/Anthropic-Cybersecurity-Skills

Run a Nuclei security scan against the target URL and report findings by severity.

MigoXLab/webqa-agent

Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images

CommonHuman-Lab/nyxstrike

Scans a Power Pages site project for security issues in source code and dependencies.

microsoft/power-platform-skills

Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

seqra/opentaint

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…

cdxgen/cdxgen

Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

Encod3d-Sec/TORCH

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

transilienceai/communitytools

Run a Codex-CLI static-analysis parity review of the current diff against the local RPython/PyPy sources, then act on it — fix the regressions and new mismatches in-session, and file the rest as…

youknowone/pyre

Public-records OSINT investigation framework — SEC EDGAR filings, USAspending contracts, Senate lobbying, OFAC sanctions, ICIJ offshore leaks, NYC property records (ACRIS), OpenCorporates…

johnson7788/MultiUserClaw