Security

Perform a security review of a diff, branch, or pull request — assessing what the change introduces, weakens, or exposes, with a triage-first workflow and false-positive discipline.

trilwu/secskills

Review cryptographic implementations and protocol usage for misuse — weak primitives, nonce and IV handling, key management, authentication of ciphertext, randomness, timing side channels, TLS and…

trilwu/secskills

Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities.

trilwu/secskills

Test mobile inter-process communication and deep link attack surface — exported Android activities, services, receivers and content providers, intent redirection, PendingIntent hijacking, App Links…

trilwu/secskills

Work a security alert queue to a defensible disposition — separating true positives from false positives and benign true positives, reasoning about base rates before escalating, ordering enrichment…

trilwu/secskills

Author and maintain Sigma detection rules — structure, logsource taxonomy, detection logic with modifiers, false-positive filtering, backend conversion with pySigma, and offline validation with…

trilwu/secskills

Onboard yourself to a repo where several agents work in parallel, syncing through a shared TODO.md.

forefy/.context

Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.

ccplugins/awesome-claude-code-plugins

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs.

oliver-kriska/claude-elixir-phoenix

Record a vetted Hex package version in hexvet.exs after a security review — manages the audit ledger, not the scanner.

oliver-kriska/claude-elixir-phoenix

Record vetted Hex versions after security review. An agent skill from oliver-kriska/claude-elixir-phoenix.

oliver-kriska/claude-elixir-phoenix

Record a vetted Hex package version in hexvet.exs after a security review — manages the audit ledger, not the scanner.

oliver-kriska/claude-elixir-phoenix

Build and harden Phoenix auth and security — OAuth login, password hashing, sessions, RBAC, rate limiting, CSRF, XSS, SQL injection, secrets.

oliver-kriska/claude-elixir-phoenix

Run evidence-backed workflows for supply chain, dependency neighborhoods, architecture, performance, unsafe and ownership review, upgrades, and ecosystem integration.

richlander/dotnet-inspect

结对编程搭档。当用户要求"边写边审"、"结对编程"、"写完自己 review 一遍"、"高可靠地实现"，或明确希望代码交付时附带自我审查意见时使用。交付代码的同时输出结构化审查（正确性/安全/性能/可读性/健壮性五维度），重点捕捉 AI 生成代码的特有缺陷。不用于：对已有 PR 的正式评审（用 code review 流程）、安全专项扫描（用 security-audit）、10…

staruhub/ClaudeSkills

解决方案架构师助手。当用户要设计新系统架构、评审现有架构、做技术选型决策、诊断性能/可扩展性/可用性问题、规划架构演进或重构时使用。覆盖微服务、事件驱动、云原生等架构模式，技术趋势通过实时搜索获取而非依赖内置知识。不用于：具体功能的代码实现、安全漏洞审计（用security-audit）、产品需求分析（用product-manager）、只需一句话回答的技术常识问题。

staruhub/ClaudeSkills

Security threat modeling, attack surface mapping, and trust boundary analysis on a codebase.

pproenca/dot-skills

Remediate security findings by producing minimal, surgical code patches.

pproenca/dot-skills

Beginner-friendly workflow for DEX extraction and repair: header, checksum, map list, multi-dex, oat, odex, vdex, and decompiler validation.

manyuegong33/r0crawl_skills

Provisions, connects, migrates, and operates Amazon RDS for Db2.

aws/agent-toolkit-for-aws

Systematic diagnosis of a red test, a rule that fires or stays silent wrongly, a scan or probe whose artifact looks wrong, a collector error, a red CI run or a gate that is green for the wrong reason.

guardana/guardana

Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS, TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection.

blacklanternsecurity/red-run

Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.

blacklanternsecurity/red-run

SMB share enumeration, access testing, password policy extraction, and content searching.

blacklanternsecurity/red-run

Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation.

blacklanternsecurity/red-run

Detect CVEs and security issues in project dependencies. An agent skill from jwynia/agent-skills.

jwynia/agent-skills

Create a prioritized security remediation plan from security assessment findings.

EmeaAppGbb/spec2cloud

Audit and harden Algolia credentials, record exposure, index restrictions, and tenant search controls.

jeremylongshore/tons-of-skills-marketplace

Review a Bright Data integration for least privilege, public-data authorization, secret containment, and controlled use.

jeremylongshore/tons-of-skills-marketplace

Secure your Anthropic integration — API key management, input validation, Use when working with security-basics patterns.

jeremylongshore/tons-of-skills-marketplace

Secure Clari identities, credentials, exported revenue data, Copilot content, and ingestion mutations.

jeremylongshore/tons-of-skills-marketplace

Harden ClickUp credentials, OAuth callbacks, Workspace boundaries, webhooks, logging, and incident response with least-privilege controls.

jeremylongshore/tons-of-skills-marketplace

Configure and audit security review capabilities as one layer in a defense-in-depth pull-request program.

jeremylongshore/tons-of-skills-marketplace

Issue an evidence-backed Cohere production go or no-go decision covering capacity, quality, security, operations, and rollback.

jeremylongshore/tons-of-skills-marketplace

Configure BYOK API keys for OpenAI, Anthropic, Google, Azure, and custom models in Cursor.

jeremylongshore/tons-of-skills-marketplace

Apply Deepgram security best practices for API key management and data protection.

jeremylongshore/tons-of-skills-marketplace

Threat-model Exa credentials, query intent, retrieved web content, generated output, and retained operational evidence as separate trust boundaries.

jeremylongshore/tons-of-skills-marketplace

Secure Firecrawl identities, targets, request options, webhooks, untrusted content, retention, logs, and self-hosted exposure.

jeremylongshore/tons-of-skills-marketplace

Analyze and harden Flexport credentials, tokens, webhook verification, data exposure, and mutation controls.

jeremylongshore/tons-of-skills-marketplace

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

jeremylongshore/tons-of-skills-marketplace

Harden Instantly API v2 keys, scopes, tenant boundaries, logs, webhooks, and operational access.

jeremylongshore/tons-of-skills-marketplace

Monitor and log API requests with correlation IDs, performance metrics, and security audit trails.

jeremylongshore/tons-of-skills-marketplace

Threat-model and harden Lucid API, Standard Import, editor extension, and data connector integrations.

jeremylongshore/tons-of-skills-marketplace

Threat-model Mistral credentials, untrusted content, model output, tools, files, and tenant access.

jeremylongshore/tons-of-skills-marketplace

Threat-model a Navan integration across identity, travel, expense, payment, file, and downstream systems.

jeremylongshore/tons-of-skills-marketplace

Pre-production readiness checklist for OCI — backup policies, security audit, key rotation, encryption, and Cloud Guard.

jeremylongshore/tons-of-skills-marketplace

Master OCI IAM policy syntax, common policy patterns, and API key management.

jeremylongshore/tons-of-skills-marketplace

Harden Persona API keys, identity data, inquiry sessions, webhook verification, and destructive redaction.

jeremylongshore/tons-of-skills-marketplace