Security · For developers

Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

uphiago/recon-skills

Guidance for designing secure Azure network architecture — hub-spoke topology (or Virtual WAN), segmentation with NSGs/ASGs, private endpoints / Private Link for PaaS, egress through Azure Firewall…

vinayaklatthe/microsoft-security-skills

Screen a pull request from an outside contributor for hidden, obfuscated, or supply-chain-risky changes before any of its code runs.

different-ai/openwork

CI-only Simplify & Harden workflow for pull requests using gh-aw (GitHub Agentic Workflows).

pskoett/pskoett-ai-skills

Automated .NET/C decompilation and security analysis. An agent skill from ptn1411/skill.

ptn1411/skill

Choose and implement the right Circle wallet type for your application.

circlefin/skills

A skill your agent uses when you have a Foundry or Hardhat repository of Solidity or Vyper contracts and want the end-to-end EVM review workflow on native CLIs — a slither static pass, semgrep taint…

mtarcure/claude-vibe-squad

Use as the lead skill when Python tests must expose scheduler/interleaving bugs in asyncio, threading, queues, workers, databases, caches, or mixed-concurrency code

dzhalaevd/Donatello

Mobile (Android + iOS) application penetration testing methodology.

SnailSploit/Claude-Red

Audit architecture, dead code, duplication, type confusion, and code smells across a codebase.

pedronauck/skills

PreToolUse security-anti-pattern hook for Claude Code. An agent skill from alirezarezvani/claude-skills.

alirezarezvani/claude-skills

Use the open-source CodeQL ecosystem for .NET security analysis.

managedcode/dotnet-skills

A skill your agent uses for OpenIAP monorepo work that should follow the repository's slash-command workflows when the user asks in natural language instead of typing a slash command, including…

hyodotdev/openiap

PR review for DevOps changes — runs the generic /qv-pr-review flow then layers a structured GitHub Actions security audit (action pinning, permissions, OIDC, secrets handling).

tetherto/qvac

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).

elementalsouls/Claude-BugHunter

Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts.

ancoleman/ai-design-components

Orchestrate end-to-end CVE remediation for the Linux CCM, CNM, and health-probe-proxy images on cloud-provider-azure master or a release-X.Y branch, including builds, repeated Trivy verification…

kubernetes-sigs/cloud-provider-azure

Download raw sequencing reads from NCBI SRA using sra-tools (prefetch, fasterq-dump, vdb-validate) or the ENA mirror.

GPTomics/bioSkills

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit

Audit MCP (Model Context Protocol) server configurations for security issues.

github/awesome-copilot

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…

trycompai/comp

Azure Key Vault Keys SDK for Rust. An agent skill from aiskillstore/marketplace.

aiskillstore/marketplace

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp ...

aiskillstore/marketplace

Server-Side Request Forgery detection→internal-access→proof for web apps.

s0ld13rr/pentestcode

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

uphiago/recon-skills

PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 XSS 审计工具。识别用户输入进入输出上下文（HTML/属性/JS/URL/模板），分析转义与防护策略，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Verter codebase architecture: high-level module map, TypeScript packages, plugin system, CSS analysis, MCP server, static analysis types

pikax/verter

Run osv-scanner via the mantisosvscanner MCP server for SCA (vulnerable dependency) findings

deonmenezes/mantishack

Composite Phase-2 audit worker (ADR-150). An agent skill from ruvnet/ruflo.

ruvnet/ruflo

Weekly supply-chain hygiene scan (Perplexity Bumblebee). An agent skill from Szotasz/marveen.

Szotasz/marveen

Review secret detection patterns and scanning workflows. An agent skill from IgorWarzocha/Opencode-Workflows.

IgorWarzocha/Opencode-Workflows

Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code.

waynesutton/markdown-site

Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps and low-value tests by running internal reviews and a peer review in…

tobihagemann/turbo

Security review of MCP (Model Context Protocol) server implementations and configurations.

OWASP/secure-agent-playbook

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's…

mukul975/Anthropic-Cybersecurity-Skills

PHP type juggling and weak comparison (==) bypass. An agent skill from langbyyi/CyberStrikeAI-SRC.

langbyyi/CyberStrikeAI-SRC

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces.

langbyyi/CyberStrikeAI-SRC

Comprehensive smart contract security audit framework with multi-expert analysis.

forefy/.context

Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution

NeoTheCapt/RedteamAgent

Turn smart-contract audit findings and source evidence into a submission-ready Markdown report with an issue index, ordered finding IDs, actor-based scenarios, self-contained unit-test proofs of…

aviggiano/security

A skill your agent uses when creating or editing a skill in this offensive-claude repo — for the SKILL.md conventions (trigger descriptions, technique map, runnable scripts, OPSEC/detection…

hypnguyen1209/offensive-claude

Release preparation workflow - security audit → E2E tests → review → changelog → docs

parcadei/Continuous-Claude-v3

Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing.

gmh5225/awesome-game-security

Guidance for Microsoft Entra Privileged Identity Management (PIM) — just-in-time, time-bound, approval-based, audited elevation for Entra roles, Azure resource roles, and privileged groups.

vinayaklatthe/microsoft-security-skills

Proactive supply-chain watch for this repo. An agent skill from epam/ai-dial-chat.

epam/ai-dial-chat

Generate and inject Frida hooks for dynamic instrumentation — license bypass, SSL pinning bypass, function tracing, crypto interception, anti-debug bypass.

ptn1411/skill