Security · For developers

Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses

NeoTheCapt/RedteamAgent

Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or…

PentesterFlow/agent

Troubleshoot and repair Alibaba Cloud ECS Windows instances from inside the GuestOS or remotely via Cloud Assistant.

aliyun/alibabacloud-ecs-troubleshoot-skills

SAP dependency security and MCP executable trust policy with secure upgrades, cooldowns, staged rollout, and supply-chain protection.

secondsky/sap-skills

Applies the AI SAFE2 v3.1 governance framework to designing, building, auditing and testing AI agents, RAG pipelines, MCP and tool integrations and AI infrastructure.

CyberStrategyInstitute/ai-safe2-framework

Provides cryptography attack techniques for CTF challenges. An agent skill from ljagiello/ctf-skills.

ljagiello/ctf-skills

A skill your agent uses when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security.

AratKruglik/claude-laravel

Security audit and code review for Solidity smart contracts.

sablier-labs/evm-monorepo

AI 도구(Claude, ChatGPT, Cursor, Copilot)용 시큐어 코딩 프롬프트와 가이드를 생성합니다.

cdppcorp/KESE-KIT

Detects input validation failures and arithmetic vulnerabilities in smart contracts.

quillai-network/quillshield_skills

A skill your agent uses when the user has concrete failing cases in code or a guardrail/classifier/filter/prompt/API they own — a red-team failure catalogue OR a CI/CD test-failure report (failing…

gaasher/Agent-Loop-Skills

A skill your agent uses for ANY new software project from idea to release — websites, WordPress/WooCommerce plugins, MCP servers, web apps, components, or libraries.

joseconti/declaracion-renta-espana

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation.

wshobson/agents

Root memory dump of DEX from a running Android app: no injection, no ptrace (survives ptrace-blocking anti-debug; invisible to Frida checks), twin tools cross-check each other.

index-login/MobileRE-Skill

Remediate security vulnerabilities found by Grype or pnpm audit.

stacklok/toolhive-studio

Scans container images, filesystems and SBOMs with Grype for known vulnerabilities, ranks them by CVSS, EPSS and CISA KEV, and wires scans into CI/CD thresholds.

AgentSecOps/SecOpsAgentKit

Find bugs, security vulnerabilities, and code quality issues in local branch changes.

getsentry/skills

Runs a parallel security audit with three vulnerability hunters and two proof-of-concept engineers, rating each finding by whether it is actually exploitable.

code-yeongyu/oh-my-openagent

A skill your agent uses for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.

zhaoxuya520/reverse-skill

Review code for security vulnerabilities. An agent skill from kklimuk/docx-cli.

kklimuk/docx-cli

Raise Go modules to caller-supplied minimum fixed versions from CVE/GO findings in any format, per tracked module root, sync go.mod/go.sum and root vendor/, audit the source module graphs, run the…

kubernetes-sigs/cloud-provider-azure

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Diagnose a denied Tenuo call and make the legitimate call work with the smallest change to authority.

tenuo-ai/tenuo

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

affaan-m/ECC

Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency…

affaan-m/ECC

Switches on full safety by combining warnings before destructive commands with a block on edits outside one directory you choose, for work on production or live systems.

garrytan/gstack

Documents how quota-axi keeps its disk cache: location, strict file permissions, no stored secrets, and context-scoped identifiers that stop snapshots crossing accounts.

kunchenguid/quota-axi

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.

BlkLeg/CircuitBreaker

Refreshes the guide's coding-agent and MCP security threat data through AgentSec Triage: research advisories, add tested records and synchronize the public feed.

FlorianBruniaux/claude-code-ultimate-guide

Deep behavioral code analysis agent for Bug Hunter. An agent skill from codexstar69/bug-hunter.

codexstar69/bug-hunter

The Priority Board's three-layer score model (rules BASE, REVIEW by the built-in AI or an MCP agent, a person's DECISION) and who may write which layer.

samugit83/redamon

Capture Mira detection experiments locally, then distill selected evidence into a tracked case only when the user explicitly requests promotion into a report or the knowledge repository.

vw2x/Mira

Keeps truST's architecture simple and well separated, and runs the automated architecture checks.

johannesPettersson80/trust-platform

When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

deonmenezes/mantishack

Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.

iflytek/skillhub

Debug FlyDSL GPU kernels that produce NaN, inf, wrong results, or crash.

ROCm/FlyDSL

当你需要开发/排查 HTTP 抓取、SSRF、Playwright 受控浏览器、本地字体增强截图，或判断 webfetch 与 browser 工作流如何选型时使用。

xrkseek/XRK-AGT

Python 遗留代码审查：bare except、SQL 注入、反序列化、密钥、调试输出. An agent skill from liuyanghejerry/Clausura.

liuyanghejerry/Clausura

Security guidelines for writing secure code. An agent skill from semgrep/skills.

semgrep/skills

Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

ptn1411/skill

Documentation work in this repo — the five places a user-visible change must answer, the page conventions the site build enforces, the tests that pin prose to the registry, and a simplification pass…

guardana/guardana

Generate a complete Semgrep rule bundle (rule.yml + tests.md + README.md) from a CVE description and a bad-code example.

skrun-dev/skrun

Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe.

mistralai/mistral-vibe

Uses Meta's LlamaGuard moderation model to screen prompts and model replies against six safety categories, with vLLM, FastAPI and NeMo Guardrails setups.

Orchestra-Research/AI-Research-SKILLs

This skill should be used when the user asks to "verify code", "run verification", "check quality", "validate changes", or before creating a PR.

Galaxy-Dawn/claude-scholar

Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…

vinayaklatthe/microsoft-security-skills

Read the vendor's breaking changes, deprecations, migration notes and CVEs for every version between the one pinned now and the one being moved to, through the whatsnew MCP server's upgradenotes tool.

getknit/knit