Security · For developers

Perform comprehensive security audit of a repository with detailed findings and step-by-step PoCs.

commercetools/ui-kit

Rust 服务审查：panic、SQL 注入、密钥、错误吞没、遗留标记

liuyanghejerry/Clausura

Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants.

trailofbits/skills

A skill your agent uses when reviewing Swift Concurrency performance and responsiveness, including task explosions, actor hopping, MainActor bottlenecks, cancellation, AsyncSequence cleanup…

Livsy90/iOS-Performance-Agent-Skills

Queries a local CodexQA symbol graph for change review, regression scope, test gaps, error location, and entry risk.

openqa-cn/codexqa

Respond to blocked package installs and manage the Interlinked supply-chain allowlist.

QuentinCody/interlinked-cli

Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification.

aftermathlabs/llvm-msvc

Detect persistent instruction injection or long-term memory poisoning.

Tencent/AI-Infra-Guard

AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment

Hack23/cia

How RedAmon tests actually run and how to author them: the per-file Docker gate, the unit/integration/live tiers, and the failure modes that make a green run a lie.

samugit83/redamon

Instruments code to track the flow of untrusted or sensitive data at runtime, enabling detection of injection vulnerabilities, data leaks, and privilege violations.

ArabelaTso/Skills-4-SE

Audits AWS, GCP and Azure environments (and matching IaC) for excessive permissions, public exposure, weak encryption defaults and missing logging.

criptogus/agent-evolve-network

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes.

bagofwords1/bagofwords

Comprehensive API security review against OWASP API Security Top 10 (2023).

OWASP/secure-agent-playbook

Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies.

VeryGoodOpenSource/vgv-ai-flutter-plugin

Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding

deonmenezes/mantishack

OSINT username search across 400+ social networks. An agent skill from Tommy-yw/RunbookHermes.

Tommy-yw/RunbookHermes

Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.

trailofbits/skills

Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.

trailofbits/skills

Behaviour-preserving restructuring and cleanup — splitting an oversized module, removing dead code, finished scripts, flags or documents, consolidating duplicates, tightening comments.

guardana/guardana

Usar para sincronizar la documentación viva del proyecto después de una fase.

686f6c61/alfred-dev

Multi-tenant authz, pre-auth disclosure hardening, and Kali disposition.

bbartling/open-fdd

A skill your agent uses when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction…

hypnguyen1209/offensive-claude

Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Administer Windows Server systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart).

softspark/ai-toolkit

Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR…

awarexone/Agentic-Bug-Hunter

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI.

github/awesome-copilot

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/.yml).

github/awesome-copilot

Run and fix the repository static analysis suite. An agent skill from ethereum/execution-specs.

ethereum/execution-specs

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

cobusgreyling/loop-engineering

Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection.

AgentSecOps/SecOpsAgentKit

Deep reentrancy vulnerability analysis for Solidity contracts.

alt-research2/SolidityGuard

Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across SQL databases (PostgreSQL, SQL Server, Oracle).

totvs/engpro-advpl-tlpp-skills

S3 resiliency, security, and data protection review. An agent skill from aws/tools-for-devops-agent.

aws/tools-for-devops-agent

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

trailofbits/skills

Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

trailofbits/skills

Security rules for eserstack in TypeScript and Go: secrets, output hygiene, input validation, authorization, injection, SSRF, error sanitization, httpfx hardening, tokens, passwords, cookies…

eser/stack

Kimlik doğrulama eklerken, kullanıcı girdisi işlerken, secret'larla çalışırken, API endpoint'leri oluştururken veya ödeme/hassas özellikler uygularken bu skill'i kullanın.

affaan-m/ECC

Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…

akitaonrails/my-skills

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation…

mukul975/Anthropic-Cybersecurity-Skills

Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f

CommonHuman-Lab/nyxstrike

For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the…

lyonzin/knowledge-rag

Generates edge case, failure mode, and spec-driven test cases.

ash1794/vibe-engineering

Collects live operating-system inventory (OBOM) and host hardware inventory (HBOM) as CycloneDX documents using the cdxgen obom and hbom commands, including osquery-backed runtime artifacts, Linux…

cdxgen/cdxgen

Constructs distributor accounts, inventory binds, commission or markup, and browse-and-quote, including the ready-to-sell scene.

openqa-cn/codexqa

Security-focused code review mapped to OWASP Top 10 and ASVS.

OWASP/secure-agent-playbook