Security

Turns a cryptographic protocol's source code, RFC, paper or ProVerif or Tamarin model into a Mermaid sequence diagram annotated with each cryptographic operation.

trailofbits/skills

Annotates a codebase with unit, dimension and decimal-scaling comments to expose mismatches and formula bugs in DeFi, financial and scientific arithmetic.

trailofbits/skills

Scans Android APKs for Firebase security misconfigurations such as open databases, storage buckets, weak authentication and exposed cloud functions, for authorized testing only.

trailofbits/skills

Triages survived mutants and unnecessary test statements using Trailmark call-graph data, sorting them into false positives, missing unit tests and fuzzing targets.

trailofbits/skills

Converts a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model file ready for checking secrecy, authentication and forward secrecy.

trailofbits/skills

Builds a code graph of functions, classes and calls across languages, then queries it for call paths, taint, blast radius, entry points and complexity hotspots.

trailofbits/skills

Compares before and after Trailmark graphs of a branch, pull request or release diff to flag new entry points, tainted paths, removed validation and other structural security regressions.

trailofbits/skills

Uses mutation testing on cryptographic implementations to find coverage gaps, then writes new test vectors for the uncovered paths and compares kill rates to show they help.

trailofbits/skills

Audit GitHub issues before implementation, including skeptical claim verification, safe reproduction, prompt-injection resistance, malicious-link and attachment handling, root-cause analysis…

akitaonrails/my-skills

Expert in threat modeling methodologies, security architecture review, and risk assessment.

davila7/claude-code-templates

A skill your agent uses when adding, updating, or removing CVE/GHSA suppressions in .openvex.json — the OpenVEX document consumed by the weekly image vulnerability scan workflow.

NVIDIA/aicr

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security…

mukul975/Anthropic-Cybersecurity-Skills

Operate Semgrep and source-oriented static analysis as a hypothesis, coverage, and regression system during advanced code audits.

cyberful/cyberful

Review a PR through the CodeReviewSecurityReview persona. An agent skill from eric-tramel/moraine.

eric-tramel/moraine

Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys).

microsoft/skills

Azure Key Vault Keys Java SDK for cryptographic key management.

microsoft/skills

Azure Key Vault Secrets Java SDK for secret management. An agent skill from microsoft/skills.

microsoft/skills

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent.

MuWinds/BUUCTF_Agent

Get a path in the call graph from a source function to a specified destination function in the codebase.

opensage-agent/opensage-adk

AWS Identity and Access Management for users, roles, policies, and permissions.

itsmostafa/aws-agent-skills

Aggiunge a un sito/app un agente di difesa che rileva e blocca richieste malevole (SQL injection, XSS, path traversal, brute force, bot) con rate limiting, blocklist IP e modalità lockdown che…

ccplugins/awesome-claude-code-plugins

Intelligent pattern selection for Fabric CLI. An agent skill from ynulihao/AgentSkillOS.

ynulihao/AgentSkillOS

Complete reference for 28 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples.

Gabson0x/bountyforge

Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Explains authorization in an Arandu Go application: write a Policy, get a security.Grant through security.Authorize, re-authorize each row, and keep tenant isolation.

arandu-io/arandu

Publishes CycloneDX BOMs to Dependency-Track or a TEA (Transparency Exchange API) server from cdxgen, and runs cdxgen in HTTP server mode to generate BOMs on demand for local paths, Git URLs, or…

cdxgen/cdxgen

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

Encod3d-Sec/TORCH

Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator.

transilienceai/communitytools

How to monitor and fix security issues in Massing — CodeQL alerts, dependency audits, secret scanning, and ReDoS/XXE fixes.

ibuilder/massing

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

dralgorhythm/claude-agentic-framework

Run a focused STRIDE-based security review using Bug Hunter-native artifacts.

codexstar69/bug-hunter

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk.

seb1n/awesome-ai-agent-skills

AI-powered security vulnerability detection. An agent skill from selmakcby/claude-agents-skills.

selmakcby/claude-agents-skills

PHP Web 源码任意文件读取/路径穿越审计工具。识别文件读取 Sink，追踪路径来源与校验逻辑，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.

Aedelon/claude-code-blueprint

Adding a new tool to the recon pipeline: the enrichment-module contract and its isolated wrapper (the actual fan-out and test call path), graph completeness, and the preset catalog that silently…

samugit83/redamon

Insecure deserialization detection and gadget chain exploitation

NeoTheCapt/RedteamAgent

Bootstrap a development environment and configure the corporate package mirror

cisco-ai-defense/skill-scanner

Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

A skill your agent uses for anything about how your MSP runs day-to-day support: setting or questioning a ticket's priority, response and resolution targets, "the client says everything is down"…

RTFM-IT-Services-LLC/msp-claude-skills

Steers C++ code toward C++20, C++23 and C++26 idioms such as smart pointers, concepts, std::expected and std::print, with a security focus.

trailofbits/skills

Screens vulnerability reports, CVEs and automated findings against seven rules of thumb to accept, dismiss or ask for more information before any deep analysis.

trailofbits/skills

Review Django security audit patterns for settings and middleware.

IgorWarzocha/Opencode-Workflows

Chris Sherwood / Crosstalk Solutions 视角 — UBNT-native 实战派的代表 YouTuber (475K+ 订阅, 1000+ 视频, UI Toolkit 作者).

swaylq/master-skill

Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns.

Factory-AI/factory-plugins

Guide to maintain creating modern and secure code while developing WordPress plugins.

duracelltomi/gtm4wp

Comprehensive AI security verification using OWASP AI Security Verification Standard (AISVS) framework.

OWASP/secure-agent-playbook

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).

secondsky/claude-skills