Security · For developers

Golang package/module docs via godig, a pkg.go.dev API client (CLI + MCP) — APIs, symbols, versions, importers, licenses, vulnerabilities.

context-labs/whip

Adding partial-recon support for a tool: running a single pipeline phase on demand from the workflow graph, reading its inputs from the existing Neo4j graph and merging results back.

samugit83/redamon

Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.

fengshao1227/ccg-workflow

Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

alexgreensh/repo-forensics

Verify that code changes do not introduce OAuth security vulnerabilities.

doorkeeper-gem/doorkeeper

Security audit for web apps, especially AI-built ("vibe coded") ones.

benavlabs/vibe-check

Triage Dependabot dependency vulnerability alerts for the Activepieces repo — pull open alerts, dedupe to distinct (package, advisory), confirm the vulnerable package + API is actually used, and…

activepieces/activepieces

Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

jeremylongshore/tons-of-skills-marketplace

Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.

smixs/osint-skill

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export.

zebbern/claude-code-guide

Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。

Pa55w0rd/secknowledge-skill

Apply modern web development best practices for security, compatibility, and code quality.

midudev/100cosas.dev

Operates Flounder, an autonomous white-hat security auditor.

adshao/flounder

Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

trailofbits/skills

Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.

greatpie/smart-contract-audit-skill

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses.

pydantic/monty

Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects.

codexstar69/bug-hunter

Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner.

ParzivalHack/PySpector

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.

EpicenterHQ/epicenter

Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.

waybarrios/opencode-power-pack

Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.

Fangcun-AI/SkillWard

Django access control and IDOR security review. An agent skill from getsentry/skills.

getsentry/skills

Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.

duriantaco/skylos

Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files.

HarnessMD/munder-difflin

Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them.

PrefectHQ/fastmcp

Use the rsigma CLI and MCP server: engine eval, engine daemon, rule lint, rule draft, rule tune, rule backtest, backend convert, mcp serve.

timescale/rsigma

Wiring a new tool the AI agent can call (not the recon pipeline): the tool registry, the phase map, the hardcoded dispatch chokepoint, and the duplicated execution paths that make a tool work in…

samugit83/redamon

Hunting skill for business logic vulnerabilities. An agent skill from elementalsouls/Claude-BugHunter.

elementalsouls/Claude-BugHunter

Security audit of Solidity code while you develop. An agent skill from Gabson0x/bountyforge.

Gabson0x/bountyforge

Reverse-engineer missing or incomplete OpenFastTrace system requirements and arc42-style design documentation from a project's user guide, existing documentation, tests, and code.

itsallcode/openfasttrace

Reviews code or recent changes for bugs, security issues, performance problems and maintainability, reporting findings by severity with the reason and a fix.

pretend1111/claude-desktop-app

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery

Run an authorized, local-first application security assessment on the current project using this agent's own reasoning.

stijnswapped/Myrqen

Combine multiple individual single-signal DBC files into one combined DBC at the application level.

CSS-Electronics/can-bus-reverse-engineering-skills

Runs Slither and Mythril against Solidity contracts to find reentrancy, overflow and access-control bugs before mainnet deployment, then triages and reports findings.

tradecatlabs/vibe-coding-cn

Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.

activepieces/activepieces

渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。

Arenbai/SecSkills

Turns a verbose, reporter-submitted obot security advisory into a short, deployer-facing writeup covering impact, affected versions and mitigation.

obot-platform/obot

Decompile NES ROM files (.nes) into C projects that can be rebuilt with dotnes.

jonathanpeppers/dotnes

Parses reports from the humble HTTP security header analyzer and explains each finding with remediation steps for DevOps teams.

rfc-st/humble

Three-axis review of the branch diff — Standards (this repo's documented standards + public API/bridge surface), Spec (the originating Linear/GitHub issue or PR), and Correctness (runtime bugs + the…

getsentry/sentry-react-native

Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

karimhabush/cyberowl

Safely unpack and investigate existing archives through evidence-first static analysis.

AetherKiri/Aether

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

OrbitCurve/firmware-reverse-engineering

Write, run, test and package Edge Python programs with the edge CLI.

dylan-sutton-chavez/edge-python

Migrate a .NET 9 project or solution to .NET 10 and resolve all breaking changes.

dotnet/skills

Installs, tunes and enforces Sponsio contracts that block unsafe tool calls in LLM agents, covering setup, auditing, observe mode and flipping to enforce.

SponsioLabs/Sponsio

Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.

zereight/gitlab-mcp