Security · For developers

隐写术检测与提取：文件尾附加、图片 LSB、音频与其他载体、提取验证. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

系统调用/函数调用跟踪：strace/ltrace/dtruss. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

UEFI/BIOS 固件：SEC/PEI/DXE/BDS 阶段判定、DXE 驱动、UEFI 模块、bootkit. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

Zig 编译产物逆向：产物识别、comptime 展开、panic/错误处理路径、C ABI 边界. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

RBAC configuration, row policies, quotas, network security, audit logging, and access control best practices.

chmonitor/chmonitor

A skill your agent uses whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed…

jeremylongshore/tons-of-skills-marketplace

Implement security best practices for Gamma integration. An agent skill from jeremylongshore/tons-of-skills-marketplace.

jeremylongshore/tons-of-skills-marketplace

Token security: Indexing tokens have write access -- never expose in frontend.

jeremylongshore/tons-of-skills-marketplace

Apply Hex security best practices for secrets and access control.

jeremylongshore/tons-of-skills-marketplace

Apply Hootsuite security best practices for secrets and access control.

jeremylongshore/tons-of-skills-marketplace

Detect sql injection detector operations. An agent skill from jeremylongshore/tons-of-skills-marketplace.

jeremylongshore/tons-of-skills-marketplace

Analyze and update dependencies with vulnerability scanning.

jeremylongshore/tons-of-skills-marketplace

Fuzzing skill for automated input-driven bug finding in C/C++.

mohitmishra786/low-level-dev-skills

Static analysis skill for C/C++ codebases. An agent skill from mohitmishra786/low-level-dev-skills.

mohitmishra786/low-level-dev-skills

Guide to software engineering research topics and methodologies

wentorai/research-plugins

Host discovery and port scanning using nmap — ICMP/ARP host discovery, SYN/TCP/UDP port scanning with scope enforcement and audit logging.

automateyournetwork/netclaw

Custom nmap scans with arbitrary flags, plus scan history retrieval and management.

automateyournetwork/netclaw

Service fingerprinting, OS detection, NSE script execution, and vulnerability scanning using nmap MCP.

automateyournetwork/netclaw

Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention.

c0x12c/ai-toolkit

Analyze detected vulnerabilities to assess realistic exploitability by examining control flow, input sources, sanitization logic, and execution context.

ArabelaTso/Skills-4-SE

Generate randomized and edge-case inputs to detect unexpected failures, bugs, and security vulnerabilities through fuzz testing.

ArabelaTso/Skills-4-SE

Analyze source code statically to detect potential functional bugs including null dereferences, incorrect condition checks, unreachable code, inconsistent state updates, logic errors, resource…

ArabelaTso/Skills-4-SE

Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials…

ArabelaTso/Skills-4-SE

Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or…

aws/tools-for-devops-agent

Creating fuzz driver for Python libraries using LibFuzzer. An agent skill from benchflow-ai/skillsbench.

benchflow-ai/skillsbench

WordPress security code review for Codex. An agent skill from jorgerosal/wordpress-skills.

jorgerosal/wordpress-skills

Install-time cooldowns for npm/bun plus a sandboxed pre-install scan for bypasses.

jamditis/claude-skills-journalism

Subagent for figma-from-code Phase 0b. An agent skill from bitovi/ai-enablement-prompts.

bitovi/ai-enablement-prompts

Review or write Python, JavaScript, TypeScript, or Go code using secure defaults.

nightly-labs/openbot

Google Gemini CLI for second opinions, architectural advice, code reviews, security audits.

secondsky/claude-skills

REST API security hardening with authentication, rate limiting, input validation, security headers.

secondsky/claude-skills

Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes.

secondsky/claude-skills

Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks.

secondsky/claude-skills

XSS attack prevention with input sanitization, output encoding, Content Security Policy.

secondsky/claude-skills

Go coding rules: style, patterns, security, testing. An agent skill from softspark/ai-toolkit.

softspark/ai-toolkit

Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them.

sundial-org/awesome-openclaw-skills

Write up a supply chain disruption — port delay, carrier failure, customs hold, or in-transit damage — as a decision-ready incident report.

mohitagw15856/pm-claude-skills

AWS VPC networking audit covering CIDR architecture, Security Group and NACL rule analysis, Transit Gateway connectivity, VPC Flow Log forensics, Route Table validation, and ENI/EIP resource…

LeoYeAI/openclaw-master-skills

Dual-platform Cisco ASA and Firepower Threat Defense (FTD) firewall audit with ACL analysis, NAT policy validation, Modular Policy Framework / Access Control Policy evaluation, Snort IPS assessment…

LeoYeAI/openclaw-master-skills

Cross-cloud security posture assessment covering IAM analysis, encryption audit, and public exposure detection across AWS, Azure, and GCP using [AWS]/[Azure]/[GCP] inline labels for…

LeoYeAI/openclaw-master-skills

Network forensics evidence collection and analysis during security incidents.

LeoYeAI/openclaw-master-skills

Reverse engineer minified, bundled, and obfuscated browser/Node JavaScript — unpacking webpack chunks, recovering source from sourcemaps, undoing obfuscator.io string-array and control-flow…

trilwu/secskills

思维链 (Chain-of-Thought) 注入攻击方法论。当目标系统使用 ReAct/CoT 框架进行多步推理、 Agent 依赖中间推理结果做决策、或需要测试思维链完整性时触发。

wgpsec/AboutSecurity

CTF/靶场 Flag 强制验证流程。当通过任何方式发现疑似 flag 字符串（含 flag{、FLAG{、ctf{ 等格式）时必须立即使用此 skill 验证，不要直接提交。防止因字符截断、编码错误、HTML 实体、base64 不完整解码、hex 截断等原因导致提交错误 flag。即使 flag 看起来完整，也可能存在隐藏字符或编码问题。覆盖 SQL…

wgpsec/AboutSecurity

CTF Web 挑战专用侦察方法。当面对 CTF 靶场目标需要快速发现攻击入口时使用。与真实渗透的 recon 不同——CTF 是单个应用、有意留线索、侦察应在 2-3 轮内完成。覆盖源码泄露、备份文件、隐藏路径、页面线索提取

wgpsec/AboutSecurity

使用 naabu 进行高速端口扫描。当需要对目标主机/网段进行端口发现、存活检测时使用。naabu 是 ProjectDiscovery 出品的快速端口扫描器，支持 SYN/CONNECT/UDP 扫描，性能远超 nmap，支持批量目标、CDN 排除、nmap 集成。任何涉及端口扫描、端口发现、主机存活检测、网段探测的场景都应使用此技能。如果 naabu 结果不足再降级用 nmap

wgpsec/AboutSecurity

使用 nmap 进行端口扫描和服务识别。当需要对目标进行精细端口扫描、服务版本探测、操作系统指纹识别、NSE 脚本漏洞扫描时使用。nmap 是最经典的网络扫描器，支持 SYN/TCP/UDP/ACK 等多种扫描模式，内置 600+ NSE 脚本。任何涉及端口扫描、服务识别、漏洞脚本扫描、操作系统指纹的场景都应使用此技能。速度不如 naabu，但功能远超 naabu

wgpsec/AboutSecurity

Nuclei 漏洞扫描工具使用方法论。当需要对目标进行已知漏洞扫描、CVE 验证、批量 PoC 检测时使用。Nuclei 拥有社区维护的 9000+ 模板，覆盖 CVE、默认口令、配置错误、信息泄露等。任何涉及 nuclei 扫描、CVE 批量验证、PoC 检测、漏洞模板搜索的场景都应使用此技能。也适用于需要从 nuclei 模板中提取 payload 用于手动利用的场景

wgpsec/AboutSecurity