Security · GitHub

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).

secondsky/claude-skills

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis…

awarexone/Agentic-Bug-Hunter

Draft a security-audit scope from GitHub repos or API access, with a protocol narrative and a sizing table.

forefy/.context

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation.

alpha-omega-security/scrutineer

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI.

github/awesome-copilot

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/.yml).

github/awesome-copilot

Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…

akitaonrails/my-skills

Helps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export.

GRCEngClub/claude-grc-engineering

Security best practices for gh-aw workflows and Go code: template injection prevention, shell script security, supply chain hardening, and static analysis integration.

github/gh-aw

Automated code review and security linting integration for CI/CD pipelines using reviewdog.

AgentSecOps/SecOpsAgentKit

Deep audit before GitHub push: removes junk files, dead code, security holes, and optimization issues.

sickn33/agentic-awesome-skills

Human review workflow for AI-generated GitHub projects with spec-based feedback, security review, and follow-up PRs from the Vibers service.

sickn33/agentic-awesome-skills

Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across…

mukul975/Anthropic-Cybersecurity-Skills

Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and…

mukul975/Anthropic-Cybersecurity-Skills

Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUBTOKEN permissions, protecting secrets…

mukul975/Anthropic-Cybersecurity-Skills

Google Workspace administration via the gws CLI (github.com/googleworkspace/cli).

alirezarezvani/claude-skills

Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…

mukul975/Anthropic-Cybersecurity-Skills

Personally identifiable information (PII) leak prevention for EverClaw.

profbernardoj/everclaw-community-branches

A skill your agent uses when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover…

hypnguyen1209/offensive-claude

Full Go CVE analysis workflow. An agent skill from openshift-eng/ai-helpers.

openshift-eng/ai-helpers

Audit a shipped repo for production-readiness gaps across RLS, webhooks, secrets, grants, Stripe idempotency, mobile UX, and deployment health.

sickn33/agentic-awesome-skills

CI-only Simplify & Harden workflow for pull requests using gh-aw (GitHub Agentic Workflows).

pskoett/pskoett-ai-skills

Use the open-source CodeQL ecosystem for .NET security analysis.

managedcode/dotnet-skills

A skill your agent uses for OpenIAP monorepo work that should follow the repository's slash-command workflows when the user asks in natural language instead of typing a slash command, including…

hyodotdev/openiap

PR review for DevOps changes — runs the generic /qv-pr-review flow then layers a structured GitHub Actions security audit (action pinning, permissions, OIDC, secrets handling).

tetherto/qvac

Review secret detection patterns and scanning workflows. An agent skill from IgorWarzocha/Opencode-Workflows.

IgorWarzocha/Opencode-Workflows

Proactive supply-chain watch for this repo. An agent skill from epam/ai-dial-chat.

epam/ai-dial-chat

High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

uphiago/recon-skills

A skill your agent uses for OpenIAP monorepo work that should follow the repository's shared agent workflows, including review-pr, audit-code, audit-security, audit-iapkit, compile-knowledge…

hyodotdev/openiap

Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.

tobihagemann/turbo

A skill your agent uses when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring…

yaojingang/yao-open-skills

Scan the ClawHunter agent bounty marketplace for opportunities that genuinely match this agent's real capabilities (code, security research, writing) and surface only real matches — never a raw…

aeonfun/aeon

Hunting skill for auth bypass vulnerabilities. An agent skill from elementalsouls/Claude-BugHunter.

elementalsouls/Claude-BugHunter

Multi-source threat intelligence and vulnerability lookup. An agent skill from ptn1411/skill.

ptn1411/skill

External recon for software supply-chain attack surface. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Use the open-source CodeQL ecosystem for .NET security analysis.

managedcode/Storage

Subdomain takeover detection and exploitation playbook. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Binance Web3 official skill — security audit for token contracts, detecting honeypots, rug pulls, and malicious functions across BSC, Base, Solana, and Ethereum.

TermiX-official/cryptoclaw

Resolve Dependabot security alerts on owid/etl by upgrading vulnerable dependencies.

owid/etl

Drive responsible disclosure of a proven finding to a CVE. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

OSINT-side tech-stack identification — public repositories (GitHub/GitLab), job postings & ATS, and Wayback Machine historical snapshots.

transilienceai/communitytools

Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date.

ArabelaTso/Skills-4-SE

Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.

mukul975/Anthropic-Cybersecurity-Skills

Stage a scanned repository into a private repo in the configured GitHub organisation.

alpha-omega-security/scrutineer

File a finding on the upstream repository through GitHub's private vulnerability reporting, request the temporary private fork, and push the proposed patch to it when available.

alpha-omega-security/scrutineer

Configure Claude Code sandbox network isolation with trusted domains, custom access policies, and environment variables

Microck/ordinary-claude-skills

Master GitHub Agentic Workflows (gh-aw) - AI-powered repository automation with safe outputs, sandboxed execution, and multi-engine support

Hack23/cia

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory