Security

Fingerprints which language or framework produced a serialized blob, then helps build a working gadget chain to test for insecure deserialization.

PentesterFlow/agent

Run HOL Guard scanner and guard operations via uv run hol-guard.

hashgraph-online/hol-guard

Verify that code changes do not introduce OAuth security vulnerabilities.

doorkeeper-gem/doorkeeper

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic…

agamm/claude-code-owasp

Security audit for web apps, especially AI-built ("vibe coded") ones.

benavlabs/vibe-check

Triage Dependabot dependency vulnerability alerts for the Activepieces repo — pull open alerts, dedupe to distinct (package, advisory), confirm the vulnerable package + API is actually used, and…

activepieces/activepieces

Analyze user-provided reference images and reverse-engineer high-fidelity AI image-generation prompts.

LunarXuan/image-prompt-reverse

Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

jeremylongshore/tons-of-skills-marketplace

Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.

smixs/osint-skill

Audit an agent skill with Semia inside Codex. An agent skill from berabuddies/Semia.

berabuddies/Semia

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export.

zebbern/claude-code-guide

Reference knowledge for open-source intelligence collection: the collection cycle, source reliability tiers, search query patterns and entity extraction.

RightNow-AI/openfang

Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。

Pa55w0rd/secknowledge-skill

Apply modern web development best practices for security, compatibility, and code quality.

midudev/100cosas.dev

Figure out how a specific installed game can be modded, before writing any mod code.

rehan-remade/universal-modder

Operates Flounder, an autonomous white-hat security auditor.

adshao/flounder

Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

trailofbits/skills

Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.

trailofbits/skills

Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.

greatpie/smart-contract-audit-skill

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses.

pydantic/monty

Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities.

gocronx-team/gocron

Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects.

codexstar69/bug-hunter

Repro-first QA for Inkline — minimal .ink.tsx reproductions, the visual-parity and cross-target harnesses, fuzz targets, and how to audit teammates' claims.

inkline/inkline

Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner.

ParzivalHack/PySpector

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.

EpicenterHQ/epicenter

Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.

waybarrios/opencode-power-pack

Builds a cited research base on normal system behavior and adversary abuse patterns before a threat hunt hypothesis gets written.

OTRF/ThreatHunter-Playbook

安全研究元思考方法论 - 从先知社区5600+篇安全文档中提炼的漏洞挖掘方法论框架. An agent skill from tanweai/xianzhi-research.

tanweai/xianzhi-research

General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

SunWeb3Sec/llm-sast-scanner

Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.

Fangcun-AI/SkillWard

Django access control and IDOR security review. An agent skill from getsentry/skills.

getsentry/skills

Scans eight warning signs behind a stock tip from a friend, chat group or online teacher and returns a four-level risk rating with evidence.

wbh604/UZI-Skill

Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

mukul975/Anthropic-Cybersecurity-Skills

Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

evdenis/cvehound

Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.

duriantaco/skylos

Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files.

HarnessMD/munder-difflin

Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them.

PrefectHQ/fastmcp

Run an ASSERT evaluation against a described risk. An agent skill from responsibleai/ASSERT.

responsibleai/ASSERT

Use the rsigma CLI and MCP server: engine eval, engine daemon, rule lint, rule draft, rule tune, rule backtest, backend convert, mcp serve.

timescale/rsigma

Wiring a new tool the AI agent can call (not the recon pipeline): the tool registry, the phase map, the hardcoded dispatch chokepoint, and the duplicated execution paths that make a tool work in…

samugit83/redamon

Hunting skill for business logic vulnerabilities. An agent skill from elementalsouls/Claude-BugHunter.

elementalsouls/Claude-BugHunter

Unattended VulnHunter operator. An agent skill from nealbridges/VulnHunter.

nealbridges/VulnHunter

Security audit of Solidity code while you develop. An agent skill from Gabson0x/bountyforge.

Gabson0x/bountyforge

Reverse-engineer missing or incomplete OpenFastTrace system requirements and arc42-style design documentation from a project's user guide, existing documentation, tests, and code.

itsallcode/openfasttrace

Reviews code or recent changes for bugs, security issues, performance problems and maintainability, reporting findings by severity with the reason and a fix.

pretend1111/claude-desktop-app

Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

AgentSecOps/SecOpsAgentKit

Manage Oh Dear website monitoring using the ohdear CLI. An agent skill from ohdearapp/ohdear-cli.

ohdearapp/ohdear-cli

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery