Security

Security hardening toolkit for OpenClaw. An agent skill from adversa-ai/secureclaw.

adversa-ai/secureclaw

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references,"…

zebbern/claude-code-guide

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware"…

zebbern/claude-code-guide

This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network…

zebbern/claude-code-guide

PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。

0xShe/PHP-Code-Audit-Skill

Adding an LLM provider to RedAmon: the credential boundary (keys must never reach scan containers), prefix-routed model ids, and the provider registry.

samugit83/redamon

Interact with Microsoft Teams — send and read messages, search conversations, look up people, check calendar, get meeting transcripts, and manage chats.

sigcli/sigcli

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding…

ADScanPro/Claude-AD

Maps the attack surface of a web domain you are authorized to test: confirms scope, lists subdomains from public sources, probes live hosts and fingerprints technology.

PentesterFlow/agent

Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

seqra/opentaint

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

A skill your agent uses when auditing Simple IoT for security issues, reviewing a change that touches authentication, authorization, enrollment, sync, or a network-facing parser, or checking whether…

simpleiot/simpleiot

Distills repeated workflows into new skills, improves existing ones and promotes them through local, project and community tiers after a default-deny safety scan.

telagod/code-abyss

A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…

zhaoxuya520/reverse-skill

A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

zhaoxuya520/reverse-skill

Decomposes goals into team blueprints using evidence-based scaling laws, topology selection, and role design.

jdforsythe/forge

Run Mira environment risk collection. An agent skill from vw2x/Mira.

vw2x/Mira

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

warpdotdev/warp

A skill your agent uses when fixing compiler warnings, static analyzer findings (clang-tidy, etc.), or runtime errors/crashes in the libYSE codebase.

yvanvds/yse-soundengine

HackenProof bug bounty triage workflow for Claude Code plugin marketplace operations.

Gabson0x/bountyforge

Standards-compliant lifecycle tool for agent knowledge and capabilities: author in .ai-rulez/, generate for 52 harnesses (Claude Code, Cursor, Codex, Copilot, Gemini CLI, OpenCode, Devin, and more)…

Goldziher/ai-rulez

Debug and emulate specific code fragments or functions using the Unicorn engine.

index-login/MobileRE-Skill

Run Semgrep static analysis scans and create custom detection rules.

semgrep/skills

Host security hardening and risk-tolerance guidance for Understudy deployments.

understudy-ai/understudy

Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout.

secondsky/sap-skills

Ultimate AI-powered cybersecurity code review skill. An agent skill from AgriciDaniel/claude-cybersecurity.

AgriciDaniel/claude-cybersecurity

Security review for Scalus/Cardano smart contracts. An agent skill from scalus3/scalus.

scalus3/scalus

보안 취약점 자동 수정 및 하드닝 스크립트를 생성합니다. An agent skill from cdppcorp/KESE-KIT.

cdppcorp/KESE-KIT

Status-first routing, bounded evidence collection, and safety guidance for issue-graph.

vercel-labs/issue-graph

Scans package manifests and lockfiles for outdated packages and known CVEs, then classifies each possible update as patch, minor, major or escalate-human for a dependency sweeper loop.

cobusgreyling/loop-engineering

Add an EAP authentication method (e.g. An agent skill from talkincode/toughradius.

talkincode/toughradius

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications.

BrownFineSecurity/iothackbot

Diagnose and repair OpenASE CLI access in local bootstrap mode.

PacificStudio/openase

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns.

wshobson/agents

Watch a Gradle instrumented-test run to a verdict without hand-writing greps.

parawanderer/OpenTagViewer

Plans and runs material repository changes with the AI SAFE2 method: classify delivery shape and risk, isolate the work, collect test evidence and finish with a completion receipt.

CyberStrategyInstitute/ai-safe2-framework

Workflow for updating gem dependencies and fixing CVEs in the ruby-git project: assess with bundle outdated and audit, edit the gemspec, test, then commit with conventional messages.

ruby-git/ruby-git

结构化代码审查工作流，适用于显式 quick/full/security review；不负责普通实现或 bug 修复流程。

doccker/cc-use-exp

Perform codebase analysis and architecture mapping as the first phase of a security assessment.

utkusen/sast-skills

Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf- skill.

ljagiello/ctf-skills

Upgrade CodeNarc and the bundled Java dependencies (jackson, logback, slf4j, janino, GMetrics, Groovy libs) that ship inside lib/java/, rebuild the deterministic CodeNarcServer.jar, and verify…

nvuillam/npm-groovy-lint

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project.

NVIDIA/OpenShell

Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

AgentSecOps/SecOpsAgentKit

Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis.

s0ld13rr/pentestcode

Automated Dynamic Application Security Testing (DAST) using Playwright MCP plus standard OS pentest tooling.

hardw00t/ai-security-arsenal

A skill your agent uses when the user wants to build, create, or develop anything — websites, apps, APIs, services, platforms.

nagisanzenin/production-grade

Run a spec-driven agent loop where coding tasks live as markdown specs that move through inbox → active → archive, get implemented by Claude Code or Codex, and pass a review gate before they count…

JuliusBrussee/skills