Security · For developers

Dependency gatekeeper. An agent skill from ccplugins/awesome-claude-code-plugins.

ccplugins/awesome-claude-code-plugins

Security review gate for MCP server installations. An agent skill from bobmatnyc/claude-mpm.

bobmatnyc/claude-mpm

AWS Advisor workflow skill. An agent skill from diegosouzapw/awesome-omni-skills.

diegosouzapw/awesome-omni-skills

当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。

zhaji2333/CkSKILLS

Audit a codebase read-only across seven quality pillars into one ranked report.

ai-driven-dev/framework

漏扫报告分析 Skill。输入主流厂商漏扫报告（绿盟/深信服/悬镜/明鉴/等保/奇安信/启明/华云安/长亭/Nessus/Trivy/Grype/Snyk/OpenVAS 等 Excel/HTML/JSON/XML/.nessus 格式），自动提取漏洞并去重，可选对接知识库 Provider（修复历史）和威胁情报 Provider（CVE 情报），生成 7…

infometa/workbuddyskills

基于 OWASP Top 10 (2021) 标准提供代码安全审查，逐项检查 SQL 注入、XSS、SSRF、访问控制、加密失败等常见漏洞，并给出具体的漏洞代码示例与修复方案。当用户需要代码安全审查、安全加固、渗透测试辅助，或提及 OWASP、安全检查、SQL 注入、XSS、代码审计、安全清单等关键词时触发此技能。

rongxinzy/RongxinAI

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the…

davila7/claude-code-templates

Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets.

harness/harness-skills

Configure PHP ecosystem tooling, dependency management, and static analysis.

HoangNguyen0403/agent-skills-standard

AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.

danielvm-git/bigpowers

Run a reusable JavaScript supply-chain security baseline with pnpm-first hardening, release-age gating, lifecycle-script controls, exotic dependency checks, CI install checks, and optional incident…

instructa/agent-skills

安全测试助手 - 专业的应用安全测试与防护专家。适用场景： (1) Web应用安全测试（OWASP Top 10漏洞检测） (2) API安全测试（认证/授权/数据泄露） (3) 安全测试用例设计与评审 (4) 渗透测试方案制定与执行指导 (5) 安全漏洞分析与风险评估 (6) 安全加固建议与最佳实践 (7) 安全合规检查（GDPR/等保） (8) 安全测试报告编写…

chendongqi/OPB-Skills

Elixir code conventions covering Elixir 1.14+/OTP 25+, pattern matching, mix format, Credo/Dialyzer, ExUnit, ExDoc, OTP process patterns, and dependency security.

Goldziher/ai-rulez

Trigger Pattern Protocol has privileged authorities (admin, operator, upgrade authority, governance) - Inject Into Breadth agents (optional), depth-state-trace

PlamenTSV/plamen

Trigger Pattern updatecurrentcontractwasm detected in codebase - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern stellarbridge|sorobanbridge|horizon|anchorprotocol|bridge|crosschain|relay|wormhole|allbridge|debridge|axelar|LayerZero|sequence|emitter - Inject Into Breadth agents, depth-external

PlamenTSV/plamen

Trigger Pattern MONETARYPARAMETER flag (fee, rate, emission, cap, bps values) - Inject Into Breadth agents (merged via M4 hierarchy)

PlamenTSV/plamen

Trigger Pattern Any env.invokecontract() or env.tryinvokecontract() detected in contract - Inject Into Breadth agents

PlamenTSV/plamen

Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (metabuffer.md enrichment)

PlamenTSV/plamen

Trigger Pattern Contract upgrades via updatecurrentcontractwasm, storage migration, deprecated functions, token migrations - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case

PlamenTSV/plamen

Trigger Pattern operator/keeper/crank requireauth checks, authority-gated functions - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern SEP-41 token patterns detected (approve/transfer/transferfrom/allowance/balance) - Inject Into Breadth agents, depth-token-flow, depth-edge-case

PlamenTSV/plamen

Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth agents

PlamenTSV/plamen

Trigger Pattern interval|period|duration|delay|cooldown|lockperiod|timelock|unbonding|claimdelay|withdrawdelay|maturity|ledgersequence|timestamp - Inject Into Breadth agents, depth-state-trace

PlamenTSV/plamen

Trigger Pattern SEP-41 token transfers, TokenClient::new, transfer/transferfrom/burn, XLM native balance - Inject Into Lifecycle, External-Env agents

PlamenTSV/plamen

Reviews package dependencies for security vulnerabilities, outdated versions, and license compliance.

aiskillstore/marketplace

Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications.

SpecterOps/skills

Assess identity trust topology, assurance boundaries, issuer and relying-party responsibilities, and failure containment before testing a specific authentication or authorization mechanism.

cyberful/cyberful

Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or…

sundial-org/awesome-openclaw-skills

A skill your agent uses when deciding whether a software-engineering project belongs at IEEE ICSME (maintenance, evolution, reverse engineering, program comprehension, technical debt, refactoring…

brycewang-stanford/Awesome-Journal-Skills

Help an adopter or framework developer file a clean, redacted GitHub issue against the Apache Magpie framework repo when a skill, tool, or doc misbehaves.

apache/magpie

Read-only GitHub Actions workflow security audit for one repository, a repository set, or a whole GitHub org.

apache/magpie

HTTP security header auditor that fetches response headers from any URL and grades them against OWASP, Mozilla Observatory, and Google standards.

LeoYeAI/openclaw-master-skills

Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Java 框架特定漏洞源码审计。当在 Java 白盒审计中需要检测框架层面的已知漏洞模式时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Java 源码前端安全类漏洞审计。当在 Java 白盒审计中需要检测前端安全漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

PHP 源码认证、配置与逻辑类漏洞审计。当在 PHP 白盒审计中需要检测认证绕过、 权限控制、安全配置、密码学误用或业务逻辑漏洞时触发。

wgpsec/AboutSecurity

PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、 需要检查框架特有安全机制和常见配置缺陷时触发。

wgpsec/AboutSecurity

PHP 源码前端交互类漏洞审计。当在 PHP 白盒审计中需要检测前端安全相关漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Applies NIST/CWE security hardening to Python and Rust code.

athola/claude-night-market

Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity.

athola/claude-night-market

File upload vulnerability testing — webshells, bypass, path traversal

NeoTheCapt/RedteamAgent

Information disclosure detection — error messages, files, headers, debug endpoints

NeoTheCapt/RedteamAgent

Server-side template injection detection, engine identification, and RCE

NeoTheCapt/RedteamAgent

Android 加密体系审计（crypto audit）：AndroidKeyStore 密钥体系分析（别名/算法/用途/硬件背书）、 Cipher/KeyInfo 审计、加密调用点 hook（Frida 拦截密钥别名与用途）。

dslsdzc/rev-skills

ARM 架构逆向（非 Android）：Cortex-M/A 向量表、Thumb/ARM 切换、AAPCS 调用约定、位置相关代码重定位、MMIO 外设寄存器交叉。

dslsdzc/rev-skills