Security

Run an authorized, local-first application security assessment on the current project using this agent's own reasoning.

stijnswapped/Myrqen

Combine multiple individual single-signal DBC files into one combined DBC at the application level.

CSS-Electronics/can-bus-reverse-engineering-skills

Runs Slither and Mythril against Solidity contracts to find reentrancy, overflow and access-control bugs before mainnet deployment, then triages and reports findings.

tradecatlabs/vibe-coding-cn

Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.

activepieces/activepieces

A skill your agent uses when scanning code for security vulnerabilities.

tanviet12/vbsec

Run a pre-deployment security compliance checklist based on KISA guidelines.

cdppcorp/KESE-KIT

渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。

Arenbai/SecSkills

Turns a verbose, reporter-submitted obot security advisory into a short, deployer-facing writeup covering impact, affected versions and mitigation.

obot-platform/obot

Audit an agent skill with Semia inside OpenClaw. An agent skill from berabuddies/Semia.

berabuddies/Semia

Scan a codebase for exploitable security defects. An agent skill from capitalone/VulnHunter.

capitalone/VulnHunter

A skill your agent uses when an agent folder must pass the Agentlas Cloud 2-stage security scan (static rules + BYOK LLM judgment) before private sync or public publish, or when asked to…

agentlas-ai/Agentlas-OS

Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.

cartography-cncf/cartography

Decompile NES ROM files (.nes) into C projects that can be rebuilt with dotnes.

jonathanpeppers/dotnes

Manages Google Cloud Privileged Access Manager entitlements and grants: create and edit entitlements, request temporary access, and approve or deny pending grants.

google/skills

Parses reports from the humble HTTP security header analyzer and explains each finding with remediation steps for DevOps teams.

rfc-st/humble

A skill your agent uses when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and…

Automattic/agent-skills

Triage Apache Roller security reports, maintain private case tracking, prepare CVE records, coordinate fixes and reporter review, and prepare disclosure with a release.

apache/roller

RenoDX DevKit workflow for tracing swapchain/output passes, SwapChainPass, RGBA8U/UNORM limits, RGBA16F proxy resources, gamma-space float pipelines, HDR10-preferred SDR/HDR output toggles, rare…

clshortfuse/renodx

Three-axis review of the branch diff — Standards (this repo's documented standards + public API/bridge surface), Spec (the originating Linear/GitHub issue or PR), and Correctness (runtime bugs + the…

getsentry/sentry-react-native

Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

karimhabush/cyberowl

Safely unpack and investigate existing archives through evidence-first static analysis.

AetherKiri/Aether

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

elementalsouls/Claude-OSINT

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

OrbitCurve/firmware-reverse-engineering

Write, run, test and package Edge Python programs with the edge CLI.

dylan-sutton-chavez/edge-python

Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

tihanyin/REx-skill

A skill your agent uses whenever the user asks the running agent to gain a new capability — phrasings like "build a tool", "add a hook", "give yourself X", "let me <do thing through you", or…

wedow/harness

Migrate a .NET 9 project or solution to .NET 10 and resolve all breaking changes.

dotnet/skills

Reverse engineering session: disassemble, annotate, extract assets, build emulator, port to web.

vgrichina/re-skill

Installs, tunes and enforces Sponsio contracts that block unsafe tool calls in LLM agents, covering setup, auditing, observe mode and flipping to enforce.

SponsioLabs/Sponsio

Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.

zereight/gitlab-mcp

Specialized in reverse-engineering compiled binaries (JARs, DLLs).

HacktronAI/skills

Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree.

openplayerjs/openplayerjs

A skill your agent uses when answering questions about PseudoForge kernel corpus packs through MCP or local evidence packs, including kernel lifecycle, subsystem, function, callgraph, import/string…

kernullist/PseudoForge

GitHub Actions security review for workflow exploitation vulnerabilities.

getsentry/skills

Builds a local architecture wiki for a repository from the CodexQA symbol graph (no model needed): modules, who calls whom and how often, reading paths, and one self-contained HTML page.

openqa-cn/codexqa

Search Solodit for similar smart contract security findings.

marchev/claudit

Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

mukul975/Anthropic-Cybersecurity-Skills

File a Bugzilla bug for Firefox/Gecko work, or draft a bug summary and description.

SAP/project-foxhound

Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

netdata/netdata

Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.

garrytan/gstack

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release…

samber/cc-skills-golang

Triage a security finding in a Symfony UX package into a disposition: a private CVE (coordinated disclosure through the Symfony security process), a public hardening PR (fix in the open, no CVE), or…

symfony/ux

Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs.

six2dez/burp-ai-agent

Rates a threat against the OWASP Risk Rating Methodology, then rates it again counting only the mitigations that are implemented and verified, and again counting dated commitments, and shows the…

TracecatHQ/tracecat

Use kuri-agent to automate Chrome — navigate pages, interact with elements via a11y refs, capture screenshots, run security audits, enumerate cookies/JWTs, probe for IDOR vulnerabilities, and make…

justrach/kuri

Linux 内核态 CVE 漏洞检测与 PoC 验证工具，专为 AI Agent 设计. An agent skill from aliyun/alibabacloud-ecs-troubleshoot-skills.

aliyun/alibabacloud-ecs-troubleshoot-skills

Install or initialize HOL Guard local runtime protection for Claude Code.

hashgraph-online/hol-guard

A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…

chaitin/chaitin-cli