Security · For devops and sre engineers

Reviews a diff, module or network surface for exploitable defects, mapping trust boundaries and sinks, then reports only findings with a verified reachable path and a fix.

codewhale-hq/Codewhale

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

jd-opensource/JoySafeter

Loads a missing environment variable or API key from the team's Infisical workspace into the current shell, or runs a command with all project secrets injected.

Devin-AXIS/iPolloWork

Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover).

briiirussell/cybersecurity-skills

PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Search for existing cases related to specific indicators or entities.

dandye/ai-runbooks

Security patterns for autonomous trading agents with wallet or transaction authority.

affaan-m/ECC

Hunt for exploitable, bounty-worthy security issues in repositories.

affaan-m/ECC

A skill your agent uses when the user asks to log in or out with a wallet session, fetch a wallet sign-in challenge, verify an externally signed challenge, or troubleshoot AltLLM Portal wallet login…

internet-court/internet-court-skill

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。

zhaoxuya520/reverse-skill

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills

Hunt for vulnerabilities in a running debuggee by analyzing imports/exports, triaging attack surface, and iteratively testing for bugs with PoC generation.

dariushoule/x64dbg-skills

Package and finalize completed work for delivery — use when a feature is done and ready to ship

nyldn/claude-octopus

Author and verify an OpenTaint rule. An agent skill from seqra/opentaint.

seqra/opentaint

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel…

utkusen/sast-skills

Manages the repo's supply-chain soak window (SOAKDAYS) — checks and fixes the derived surfaces, bumps or disables the window, adds dated per-package exclusions, and bumps pinned external tools.

nubjs/nub

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

alpha-omega-security/scrutineer

Runs the installed local Semgrep CLI through a bounded JSON wrapper with two bundled non-secret rules.

KimYx0207/Kim_Service

Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.

putervision/state-memory-mcp

Path traversal / Local File Inclusion detection→file-read→RCE for web apps.

s0ld13rr/pentestcode

Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.

irahardianto/awesome-agv

Secure secrets in Google Cloud Secret Manager. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Use before merging security-relevant Rust changes. An agent skill from Jxck/sptth.

Jxck/sptth

Detecta riscos básicos de segurança em repositórios (segredos expostos, configurações perigosas, padrões inseguros) e gera recomendações com evidências.

glaucia86/repocheckai

生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。

xwtro0tk1t-cloud/harness

Run splint after cppcheck/clang-format/clang-tidy precommit sanity to find memory issues, API misuse, and contract violations in staged C code (tolerates older C parser limitations).

MidnightBSD/src

Expert in threat modeling methodologies, security architecture review, and risk assessment.

davila7/claude-code-templates

A skill your agent uses when adding, updating, or removing CVE/GHSA suppressions in .openvex.json — the OpenVEX document consumed by the weekly image vulnerability scan workflow.

NVIDIA/aicr

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security…

mukul975/Anthropic-Cybersecurity-Skills

Operate Semgrep and source-oriented static analysis as a hypothesis, coverage, and regression system during advanced code audits.

cyberful/cyberful

Review a PR through the CodeReviewSecurityReview persona. An agent skill from eric-tramel/moraine.

eric-tramel/moraine

Azure Key Vault Secrets Java SDK for secret management. An agent skill from microsoft/skills.

microsoft/skills

AWS Identity and Access Management for users, roles, policies, and permissions.

itsmostafa/aws-agent-skills

Intelligent pattern selection for Fabric CLI. An agent skill from ynulihao/AgentSkillOS.

ynulihao/AgentSkillOS

Publishes CycloneDX BOMs to Dependency-Track or a TEA (Transparency Exchange API) server from cdxgen, and runs cdxgen in HTTP server mode to generate BOMs on demand for local paths, Git URLs, or…

cdxgen/cdxgen

How to monitor and fix security issues in Massing — CodeQL alerts, dependency audits, secret scanning, and ReDoS/XXE fixes.

ibuilder/massing

Run a focused STRIDE-based security review using Bug Hunter-native artifacts.

codexstar69/bug-hunter

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk.

seb1n/awesome-ai-agent-skills

PHP Web 源码任意文件读取/路径穿越审计工具。识别文件读取 Sink，追踪路径来源与校验逻辑，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Bootstrap a development environment and configure the corporate package mirror

cisco-ai-defense/skill-scanner

Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

A skill your agent uses for anything about how your MSP runs day-to-day support: setting or questioning a ticket's priority, response and resolution targets, "the client says everything is down"…

RTFM-IT-Services-LLC/msp-claude-skills

Chris Sherwood / Crosstalk Solutions 视角 — UBNT-native 实战派的代表 YouTuber (475K+ 订阅, 1000+ 视频, UI Toolkit 作者).

swaylq/master-skill

Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns.

Factory-AI/factory-plugins

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).

secondsky/claude-skills

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model.

trailofbits/skills-curated

Create an OpenTaint test project with positive/negative samples for verifying a rule or approximation.

seqra/opentaint

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel…

utkusen/sast-skills