Security · For developers

Status-first routing, bounded evidence collection, and safety guidance for issue-graph.

vercel-labs/issue-graph

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns.

wshobson/agents

Plans and runs material repository changes with the AI SAFE2 method: classify delivery shape and risk, isolate the work, collect test evidence and finish with a completion receipt.

CyberStrategyInstitute/ai-safe2-framework

Workflow for updating gem dependencies and fixing CVEs in the ruby-git project: assess with bundle outdated and audit, edit the gemspec, test, then commit with conventional messages.

ruby-git/ruby-git

Upgrade CodeNarc and the bundled Java dependencies (jackson, logback, slf4j, janino, GMetrics, Groovy libs) that ship inside lib/java/, rebuild the deterministic CodeNarcServer.jar, and verify…

nvuillam/npm-groovy-lint

Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis.

s0ld13rr/pentestcode

Automated Dynamic Application Security Testing (DAST) using Playwright MCP plus standard OS pentest tooling.

hardw00t/ai-security-arsenal

Run a spec-driven agent loop where coding tasks live as markdown specs that move through inbox → active → archive, get implemented by Claude Code or Codex, and pass a review gate before they count…

JuliusBrussee/skills

Reference for building payment systems that meet PCI DSS: the 12 requirements, merchant levels, data that must never be stored, tokenization and encryption.

wshobson/agents

Display Hak5 WiFi Pineapple recon scan data as a formatted table.

sneakerhax/Arsenal

对 jar-analyzer-engine 构建的 SQLite 数据库执行安全审计分析查询。支持方法调用搜索、调用链追踪、Spring 组件分析、字符串搜索、漏洞模式检测等。

jar-analyzer/jar-analyzer-claude

A skill your agent uses when a Granblue Fantasy Relink game patch breaks the GBFR Logs hook — signatures no longer match, "Could not find match for pattern" / "Could not find <offset" warnings…

villith/relink-logs

Runs trace-mcp security, quality-gate and antipattern checks before a commit or pull request, and builds a symbol-level diff for the PR description.

nikolai-vysotskyi/trace-mcp

Security code review for Tauri/Rust/TypeScript desktop apps and Hono/oRPC APIs.

deadlock-mod-manager/deadlock-mod-manager

Reviews APIs, configuration schemas and library interfaces for footguns, the designs where the easy path leads to insecure use, using a four-phase analysis.

trailofbits/skills

Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe…

openclaw/openclaw

Creates a new Earl HCL template for a specific API, database, or shell command.

mathematic-inc/earl

Adding, removing or changing a tool on RedAmon's INBOUND MCP server, where external agents connect in with a personal access token.

samugit83/redamon

A skill your agent uses when 用户需要对代码进行安全审计、发现安全漏洞、上线前安全评估、检查代码是否存在安全风险时。触发场景：代码安全审计、安全审计、白盒审计、安全扫描、漏洞检测、漏洞挖掘、SQL注入、命令注入、XSS、SSRF、反序列化、认证绕过、越权、代码安全检查、security audit、code…

ProgrammerAnthony/Expert-Coding-Harness

Close a case or alert with proper reason and documentation. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Perform a requested security review of a NemoClaw PR or a PR linked to an issue.

NVIDIA/NemoClaw

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells.

Eyadkelleh/awesome-skills-security

Runs Trivy filesystem scan against the repo root and emits structured vulnerability findings (CVE, package, versions) in the SDLC reviewer schema.

epam/ai-dial-chat

A skill your agent uses when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning…

jabrena/plinth

Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation…

guardana/guardana

Professional network reconnaissance and port scanning using nmap.

BrownFineSecurity/iothackbot

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering.

elementalsouls/Claude-BugHunter

Fix a CRITICAL Trivy finding that is failing CI in this repo (a vulnerability, misconfiguration, or secret from security-scan.yml or image-scan.yml), or add, review, or retire an entry in…

malloydata/publisher

Use HOL Guard to preview and protect AI-agent package installs, Cursor surfaces, CI, and automation workflows.

hashgraph-online/hol-guard

Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input…

utkusen/sast-skills

A skill your agent uses when scanning source code for bugs, anti-patterns, code smells, or quality issues in a codebase, or when running a proof-driven bug hunt that must find, prove, fix, and…

WrongStack/WrongStack

Dual-model code review via Codex CLI. An agent skill from suyuan2022/suyuan-skill.

suyuan2022/suyuan-skill

Audit, explain, or compare existing Tenuo warrants and delegation chains.

tenuo-ai/tenuo

Generates fuzz test scaffolding for parsers handling external input (YAML, JSON, config files, user input).

ash1794/vibe-engineering

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.

trailofbits/skills

The Massing release discipline — how to ship a verified, CI-green version-numbered release direct to main.

ibuilder/massing

Finds security threats in a design with a STRIDE pass per component, rates severity and records fixes, with extra checks for AI agent and tool risks.

dralgorhythm/claude-agentic-framework

Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images

CommonHuman-Lab/nyxstrike

Scans a Power Pages site project for security issues in source code and dependencies.

microsoft/power-platform-skills

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

Encod3d-Sec/TORCH

Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

transilienceai/communitytools

Public-records OSINT investigation framework — SEC EDGAR filings, USAspending contracts, Senate lobbying, OFAC sanctions, ICIJ offshore leaks, NYC property records (ACRIS), OpenCorporates…

johnson7788/MultiUserClaw

Guide for creating new Android gradle modules in the android-components project.

SAP/project-foxhound

A skill your agent uses when you need to call an API, run a database query, or execute a shell command via Earl.

mathematic-inc/earl

Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

briiirussell/cybersecurity-skills

CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。

0xShe/PHP-Code-Audit-Skill

Update Mira topic articles from cases and patterns. An agent skill from vw2x/Mira.

vw2x/Mira