Security · For developers

Runs and interprets Psalm security (taint) analysis on a Laravel project.

cachethq/core

Reference vocabulary for designing instrumented harnesses that drive vulnerability discovery — design classes (trigger-driven vs coverage-driven), tiered scope (T1 isolated function / T2…

provos/ironcurtain

Builds a skeptical reviewer grounded in the codebase and research notes to try to refute a spec before any code is written, citing file:line evidence and ending in a go or no-go gate.

JuliusBrussee/cavekit

Scans a codebase for raw API/CLI calls (curl, gh, stripe-cli, psql, grpcurl, etc.) and replaces them with Earl templates — one provider at a time.

mathematic-inc/earl

Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.

zhaoxuya520/reverse-skill

Review code for quality, correctness, and security vulnerabilities.

hiroshiyui/GuilelessBopomofo

Audit GitBook integrations for script injection, sensitive-data access, unsafe requests, authorization gaps, and manifest or dependency risk.

GitbookIO/integrations

End-to-end Stellar development playbook. An agent skill from VelaPayments/vela-payments.

VelaPayments/vela-payments

用于 Android/iOS 移动应用安全逆向分析：Frida 动态插桩、绕过反调试/反注入/加固壳、脱壳、加密与 native SO 层 hook、运行时行为分析、jadx-mcp 静态攻击面分析、离线 SO 静态分析（ELF 侦察/字符串/交叉引用/反汇编/JNI 判型）。用户提到"绕过检测/闪退/脱壳/加密/抓包/行为摸底/内存扫描/分析 so/ELF…

index-login/MobileRE-Skill

Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

ptn1411/skill

Codebase intelligence for TypeScript and JavaScript. An agent skill from fallow-rs/fallow-skills.

fallow-rs/fallow-skills

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection.

zebbern/claude-code-guide

Evidence-based security report generation for firmware assessments.

OrbitCurve/firmware-reverse-engineering

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

vechain/x-app-template

Run and record a hardware experiment on the 2C53T bench using a controlled five-step cycle.

DavidClawson/OpenScope-2C53T

Deep EVM smart contract security audit system. An agent skill from austintgriffith/ethskills.

austintgriffith/ethskills

Automate low-impact web vulnerability verification through Burp MCP.

langbyyi/CyberStrikeAI-SRC

Three-axis review of the branch diff — Standards (this repo's documented standards + public API surface), Spec (the originating Linear issue / PR), and Correctness (runtime bugs + the SDK threat…

getsentry/sentry-dart

Security audit of Solidity code while you develop. An agent skill from pashov/skills.

pashov/skills

A skill your agent uses when a user provides a TikTok profile or account link and asks for account analysis, competitor research, content or commerce performance, operational-logic research…

aronhy/tiktok-agent-skills

A skill your agent uses when working with the DecompilerServer MCP server to inspect, search, decompile, analyze, or compare .NET assemblies, especially foreign code such as Unity/RimWorld…

pardeike/DecompilerServer

Diagnose and fix Session Sniffer bugs, errors, tracebacks, logs, lint failures, static-analysis findings, and IDE-reported problems.

BUZZARDGTA/Session-Sniffer

移动安全漏洞挖掘知识库，基于HackerOne公开报告提供Android和iOS应用的漏洞挖掘手法、技术细节和代码模式分析；用于安全研究人员和漏洞挖掘者学习参考、代码审计和漏洞检测指导。

s7safe/android-h1

Update project documentation when features are added or changed.

boostsecurityio/poutine

Format and pretty-print Hak5 WiFi Pineapple recon JSON scan files for readability.

sneakerhax/Arsenal

使用 jar-analyzer-engine 从 JAR/WAR/Class 文件构建 SQLite 分析数据库。这是进行 Java 代码安全审计、方法调用分析的第一步。

jar-analyzer/jar-analyzer-claude

Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.

trailofbits/skills

Covers recovering and verifying the VC7 C runtime, compiler-runtime and D3DX library functions in the TH08 decompilation, with hash-pinned evidence.

N0zoM1z0/th08

A skill your agent uses when performing a cybersecurity audit, security review, OWASP Top 10 compliance check, vulnerability assessment, or preparing for a penetration test on a…

LIDR-academy/AI4Devs-LTI-extended

Create or delegate Tenuo warrants from natural-language authority requirements.

tenuo-ai/tenuo

Tests a security patch against the original bug, its variants and normal behavior, with reproducible baseline-versus-patched evidence before you merge or call it fixed.

trailofbits/skills

Audits an Azure API Management setup against the OWASP API Security Top 10 and Azure Security Benchmark, covering policies, network layout and identity.

thomast1906/github-copilot-agent-skills

Enriches an existing CycloneDX BOM with occurrence, callstack, reachability, data-flow, and crypto-flow evidence using cdxgen evinse, including Go analysis via Golem and Rust analysis via Rusi, and…

cdxgen/cdxgen

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

transilienceai/communitytools

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references,"…

zebbern/claude-code-guide

PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。

0xShe/PHP-Code-Audit-Skill

Adding an LLM provider to RedAmon: the credential boundary (keys must never reach scan containers), prefix-routed model ids, and the provider registry.

samugit83/redamon

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

Distills repeated workflows into new skills, improves existing ones and promotes them through local, project and community tiers after a default-deny safety scan.

telagod/code-abyss

A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…

zhaoxuya520/reverse-skill

A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

zhaoxuya520/reverse-skill

Decomposes goals into team blueprints using evidence-based scaling laws, topology selection, and role design.

jdforsythe/forge

Run Mira environment risk collection. An agent skill from vw2x/Mira.

vw2x/Mira

Debug and emulate specific code fragments or functions using the Unicorn engine.

index-login/MobileRE-Skill

Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout.

secondsky/sap-skills

Ultimate AI-powered cybersecurity code review skill. An agent skill from AgriciDaniel/claude-cybersecurity.

AgriciDaniel/claude-cybersecurity

Security review for Scalus/Cardano smart contracts. An agent skill from scalus3/scalus.

scalus3/scalus