Security · For developers

Audit and harden Algolia credentials, record exposure, index restrictions, and tenant search controls.

jeremylongshore/tons-of-skills-marketplace

Harden ClickUp credentials, OAuth callbacks, Workspace boundaries, webhooks, logging, and incident response with least-privilege controls.

jeremylongshore/tons-of-skills-marketplace

Configure and audit security review capabilities as one layer in a defense-in-depth pull-request program.

jeremylongshore/tons-of-skills-marketplace

Configure BYOK API keys for OpenAI, Anthropic, Google, Azure, and custom models in Cursor.

jeremylongshore/tons-of-skills-marketplace

Analyze and harden Flexport credentials, tokens, webhook verification, data exposure, and mutation controls.

jeremylongshore/tons-of-skills-marketplace

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

jeremylongshore/tons-of-skills-marketplace

Harden Instantly API v2 keys, scopes, tenant boundaries, logs, webhooks, and operational access.

jeremylongshore/tons-of-skills-marketplace

Harden Persona API keys, identity data, inquiry sessions, webhook verification, and destructive redaction.

jeremylongshore/tons-of-skills-marketplace

Audit MCP (Model Context Protocol) server configurations for security issues.

boshi-xixixi/TraeSkill

Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it.

cbrock84/headcount

Configure Claude Code sandbox network isolation with trusted domains, custom access policies, and environment variables

Microck/ordinary-claude-skills

SecOps for application security, vulnerability management, compliance, and secure development.

borghei/Claude-Skills

扫描代码安全漏洞，检测依赖漏洞、密钥泄露和OWASP安全模式。当用户提到安全扫描、漏洞检测、依赖审计、密钥泄露、API key、OWASP、npm audit、pip-audit或SQL注入/XSS等关键词时触发。

rongxinzy/RongxinAI

Run a Python fuzzer script (provided as a string) for a fixed duration.

opensage-agent/opensage-adk

A skill your agent uses when writing fuzz tests for Solidity contracts.

ccashwell/evm-cortex

Comprehensive reentrancy attack patterns and defenses for Solidity.

ccashwell/evm-cortex

A skill your agent uses when running Slither static analysis on Solidity contracts.

ccashwell/evm-cortex

Security-focused Solidity development patterns. An agent skill from ccashwell/evm-cortex.

ccashwell/evm-cortex

Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage.

Dynatrace/dynatrace-for-ai

This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work.

aiskillstore/marketplace

Run defensive pre-release security tests for Python web applications.

aiskillstore/marketplace

Run semgrep via the mantissemgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle

deonmenezes/mantishack

Assess the security of a smart-contract system across protocol economics, trust roles, upgrade and governance paths, oracle and bridge dependencies, deployment state, and off-chain operators.

cyberful/cyberful

Audit desktop client source, binaries, packaging, updater, local storage, IPC, protocol handlers, WebViews, plugins, native bridges, credential use, and OS integration for trust-boundary failures.

cyberful/cyberful

Audit extracted embedded firmware for boot and update trust, credential and secret handling, service exposure, privilege boundaries, parsers, persistence, cryptography, hardening, recovery, and…

cyberful/cyberful

A skill your agent uses when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or…

ericrisco/rsc-harness

A skill your agent uses when writing, reviewing, modernizing, building, or debugging C++ - RAII and resource lifetime, smart-pointer ownership, move semantics and the Rule of Zero/Five, target-based…

ericrisco/rsc-harness

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness

A skill your agent uses when writing or running Go tests — table-driven cases, named subtests, parallel isolation, fakes instead of mock frameworks, coverage profiles, benchmarks, fuzzing, golden…

ericrisco/rsc-harness

A skill your agent uses when bootstrapping architecture documentation for a brownfield project by reverse-engineering ADRs from an existing codebase.

tikalk/adlc-team-skills

Master GitHub Agentic Workflows (gh-aw) - AI-powered repository automation with safe outputs, sandboxed execution, and multi-engine support

Hack23/cia

MCP gateway security patterns, token management, request validation, and audit logging for MCP communications

Hack23/cia

Focused static audit of device firmware and IoT software for update, boot, provisioning, credential, debug-interface and device-communication boundary failures, using an ISVS-informed threat model.

alpha-omega-security/scrutineer

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle.

google/skills

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory

CTF 数字取证与信号分析技术。当挑战提供磁盘镜像(.dd/.E01)、内存 dump(.raw/.vmem)、网络抓包(.pcap/.pcapng)、隐写图片/音频、Windows 事件日志(.evtx)时使用。覆盖 Volatility 内存分析、Wireshark 流量还原、binwalk 隐写提取、文件系统恢复等取证全链路

wgpsec/AboutSecurity

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec/AboutSecurity

日志分析与日志逃逸方法论。理解蓝队如何通过日志追踪攻击行为（SIEM/Event Log/Syslog），以及红队如何规避日志记录或精准清除痕迹。当需要设计无痕操作或分析日志监控覆盖范围时使用

wgpsec/AboutSecurity

Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot.

ccplugins/awesome-claude-code-plugins

Detect and exploit SQL injection vulnerabilities in web application parameters

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

NeoTheCapt/RedteamAgent

Provides AWS Key Management Service (KMS) patterns using AWS SDK for Java 2.x.

giuseppe-trisciuoglio/developer-kit

Provides Gemini CLI delegation workflows for large-context analysis and complex reasoning using Gemini 3.0 Flash and Gemini 3.0 Pro models, including English prompt formulation, execution flags, and…

giuseppe-trisciuoglio/developer-kit

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure…

giuseppe-trisciuoglio/developer-kit

Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure.

giuseppe-trisciuoglio/developer-kit

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable…

Goldziher/ai-rulez

Complete guide for Light Protocol on Solana - includes ZK Compression for rent-free compressed tokens and PDAs using zero-knowledge proofs, and the Light Token Program for high-performance token…

sendaifun/skills

Backend tech-stack identification — web servers, runtimes, languages, frameworks, databases, APIs, and CMS via HTTP headers, cookies, error pages, and API discovery.

transilienceai/communitytools