Security

Scans for security vulnerabilities including XSS, SQL injection, CSRF, and auth flaws using OWASP Top 10 methodology.

proffesor-for-testing/agentic-qe

Search and contribute to the shared AI-modding knowledge base, where field notes record how specific games were modded, decompiled or reverse-engineered (exact versions, route, engine facts…

rehan-remade/universal-modder

Scan a built container image with Trivy, classify fixable Go-module and base-image CVEs, apply dependency and Dockerfile fixes, and verify the result with file checks and an optional image rescan.

kubernetes-sigs/cloud-provider-azure

Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.

SCStelz/security-investigator

Installs and configures the WizTelemetry Auditing extension for KubeSphere, which collects and stores Kubernetes audit events, and covers the audit query API.

kubesphere/kubesphere

"보안 점검", "security check", "security audit", "취약점 분석", "vulnerability scan", "보안 감사", "시크릿 노출", "API 보안", "인증 점검", "rate limit" 등 보안 관련 코드 리뷰나 취약점 감사 시 사용하세요.

imgompanda/fireauto

Fix open Dependabot and CodeQL/code-scanning alerts directly on the current branch.

cloudposse/atmos

Run clang-format (prefer clang-format19), clang-tidy19, and cppcheck on staged C/C header changes before committing; auto-format then fail on serious diagnostics.

MidnightBSD/src

Harden an application or service against common attack vectors.

agulli/atlas-agents

Give the AI agent its own EVM wallet with admin-controlled policies the agent CANNOT bypass even under prompt injection.

internet-court/internet-court-skill

Build a high-fidelity network and service inventory using Nmap, Masscan, packet capture, DNS, and protocol-specific follow-up.

cyberful/cyberful

Classify Datapages findings by reach and severity and write review-.md reports.

romshark/datapages

Guides designing a layered permission pipeline for agent tools that decides which calls are allowed, need confirmation or are denied, with scopes and hooks.

simbajigege/book2skills

Extract crash inputs from fuzzing output into a target directory.

opensage-agent/opensage-adk

Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.

zhaoxuya520/reverse-skill

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, conditionally-valid-with-chain table, temp email creation scripts, XXE/deserialization/host header injection…

Gabson0x/bountyforge

Estimate the severity of a vulnerability finding and produce a CVSS 3.1 vector + impact framing, calibrated against how similar findings were rated in the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Guides writing and improving fuzzing harnesses for C, C++ and Rust so random byte input gets translated into structured, reproducible test cases for the target code.

trailofbits/skills

Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts…

cdxgen/cdxgen

Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.

Encod3d-Sec/TORCH

Review code quality, security, and maintainability before committing.

Thank-you-Linus/Linus-Dashboard

Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

transilienceai/communitytools

Constructs catalog products (standard or limited), catalog orders, and account-credit enrollment, including product-then-credit scenes.

openqa-cn/codexqa

Reviews a diff, module or network surface for exploitable defects, mapping trust boundaries and sinks, then reports only findings with a verified reachable path and a fix.

codewhale-hq/Codewhale

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

jd-opensource/JoySafeter

Tests a target AI agent for sensitive information disclosure, such as its system prompt, credentials, personal data and internal configuration, using escalating dialogue probes.

Tencent/AI-Infra-Guard

Black box flight recorder for the server. An agent skill from bolivian-peru/os-moda.

bolivian-peru/os-moda

Loads a missing environment variable or API key from the team's Infisical workspace into the current shell, or runs a command with all project secrets injected.

Devin-AXIS/iPolloWork

Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover).

briiirussell/cybersecurity-skills

PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Wiring an LLM into a recon tool's decisions ("let AI pick {feature} for {tool}"): the never-raise contract, the per-target cache, the full+partial coverage, and the two UI toggles bound to one field.

samugit83/redamon

Plans and builds full-stack features with frontend, backend and security handled together, including a written design and a security checklist before any code.

Jeffallan/claude-skills

Guides secure implementation of authentication, authorization, input validation and security headers, with password hashing, parameterized queries and OWASP Top 10 checks.

Jeffallan/claude-skills

Audits code and infrastructure for vulnerabilities and produces a severity-rated report with locations and remediation, using SAST, dependency and secrets scans plus manual review.

Jeffallan/claude-skills

Replaces raw offsets and anonymous fields in a TH08 C++ source reconstruction with evidence-backed names and types, without changing accepted bytes or playable behavior.

N0zoM1z0/th08

Maintain a Mira detection topic after user confirmation. An agent skill from vw2x/Mira.

vw2x/Mira

Plans ComPDF Server API requests to encrypt PDFs with AES-128, AES-256 or RC4, set passwords and permissions, and remove passwords from files you are authorized to open.

ComPDFKit/compdf-skills

Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, constrained/S4U, RBCD).

ADScanPro/Claude-AD

Cross-site request forgery testing for state-changing operations

NeoTheCapt/RedteamAgent

Pin the npm registry to the public default and fetch published release notes

cisco-ai-defense/skill-scanner

Check reburp's Montoya API coverage and detect when a Burp/Montoya upgrade added or changed APIs.

forefy/reburp

Chief Security Officer mode. An agent skill from no-session/pstack.

no-session/pstack

Web2 recon pipeline — subdomain enum, URL crawling, JS analysis, temp emails, directory fuzzing.

Gabson0x/bountyforge

Search for existing cases related to specific indicators or entities.

dandye/ai-runbooks

Update the embedded build platform vulnerability database from the CVE Project's cvelistV5 repository.

boostsecurityio/poutine

当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…

zhaji2333/CkSKILLS

Review Convex security audit patterns for authentication and authorization.

IgorWarzocha/Opencode-Workflows

Security patterns for autonomous trading agents with wallet or transaction authority.

affaan-m/ECC