Security · For developers

Constructs catalog products (standard or limited), catalog orders, and account-credit enrollment, including product-then-credit scenes.

openqa-cn/codexqa

Reviews a diff, module or network surface for exploitable defects, mapping trust boundaries and sinks, then reports only findings with a verified reachable path and a fix.

codewhale-hq/Codewhale

Loads a missing environment variable or API key from the team's Infisical workspace into the current shell, or runs a command with all project secrets injected.

Devin-AXIS/iPolloWork

Plans and builds full-stack features with frontend, backend and security handled together, including a written design and a security checklist before any code.

Jeffallan/claude-skills

Guides secure implementation of authentication, authorization, input validation and security headers, with password hashing, parameterized queries and OWASP Top 10 checks.

Jeffallan/claude-skills

Audits code and infrastructure for vulnerabilities and produces a severity-rated report with locations and remediation, using SAST, dependency and secrets scans plus manual review.

Jeffallan/claude-skills

Maintain a Mira detection topic after user confirmation. An agent skill from vw2x/Mira.

vw2x/Mira

Check reburp's Montoya API coverage and detect when a Burp/Montoya upgrade added or changed APIs.

forefy/reburp

Update the embedded build platform vulnerability database from the CVE Project's cvelistV5 repository.

boostsecurityio/poutine

A skill your agent uses when the user asks to create a NOWPayments crypto payment link, poll payment status, or execute a supported direct wallet payment through the AltLLM Portal CLI.

internet-court/internet-court-skill

Turn a captured HTTP request/response into a bounded, redacted evidence pack with a stable request-ref using the mantishttpaudit MCP server, instead of pasting raw traffic into a finding

deonmenezes/mantishack

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that…

tinyfish-io/tinyfish-cookbook

Ghost Security - Software Composition Analysis (SCA) scanner.

ghostsecurity/skills

Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste.

microsoft/haste

Run this project's verification — the full local CI mirror (ruff, mypy, import contract, pytest with PostgreSQL, coverage floors, dogfood, generated docs and site, the isolated example suites, the…

guardana/guardana

Django 安全最佳实践、认证、授权、CSRF 防护、SQL 注入预防、XSS 预防和安全部署配置. An agent skill from affaan-m/ECC.

affaan-m/ECC

在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。

affaan-m/ECC

Java Spring Boot 服务中认证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全性的 Spring Security 最佳实践。

affaan-m/ECC

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Reference for aster.yaml, covering review models, analyzers, focus areas, include/exclude globs, minconfidence, and the permissions block that gates edits.

Zfinix/aster

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

alpha-omega-security/scrutineer

Rules for working behind Iron Proxy: connect external accounts without handling raw tokens, treat blocked requests as policy outcomes, and never claim a connection before it works.

nanocoai/nanoclaw

Reviews code for security, performance, quality and maintainability, then reports findings in a fixed template with a rating, severity levels and suggested fixes.

luongnv89/claude-howto

Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.

putervision/state-memory-mcp

Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.

irahardianto/awesome-agv

Secure secrets in Google Cloud Secret Manager. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Detecta riscos básicos de segurança em repositórios (segredos expostos, configurações perigosas, padrões inseguros) e gera recomendações com evidências.

glaucia86/repocheckai

生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。

xwtro0tk1t-cloud/harness

Audit Entra ID app registration and service principal security posture.

SCStelz/security-investigator

Analyzes Solidity contract entry points to map attack surface.

alt-research2/SolidityGuard

Dependency audit and cleanup workflow for maintaining healthy project dependencies.

bobmatnyc/claude-mpm

Performs security-focused differential review of code changes (PRs, commits, diffs).

waybarrios/opencode-power-pack

MCP threat-model artifact for a scaffolded harness. An agent skill from ruvnet/metaharness.

ruvnet/metaharness

Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.

trailofbits/skills

Turns a cryptographic protocol's source code, RFC, paper or ProVerif or Tamarin model into a Mermaid sequence diagram annotated with each cryptographic operation.

trailofbits/skills

Annotates a codebase with unit, dimension and decimal-scaling comments to expose mismatches and formula bugs in DeFi, financial and scientific arithmetic.

trailofbits/skills

Triages survived mutants and unnecessary test statements using Trailmark call-graph data, sorting them into false positives, missing unit tests and fuzzing targets.

trailofbits/skills

Converts a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model file ready for checking secrecy, authentication and forward secrecy.

trailofbits/skills

Compares before and after Trailmark graphs of a branch, pull request or release diff to flag new entry points, tainted paths, removed validation and other structural security regressions.

trailofbits/skills

Uses mutation testing on cryptographic implementations to find coverage gaps, then writes new test vectors for the uncovered paths and compares kill rates to show they help.

trailofbits/skills

Audit GitHub issues before implementation, including skeptical claim verification, safe reproduction, prompt-injection resistance, malicious-link and attachment handling, root-cause analysis…

akitaonrails/my-skills

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security…

mukul975/Anthropic-Cybersecurity-Skills

Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys).

microsoft/skills

Azure Key Vault Keys Java SDK for cryptographic key management.

microsoft/skills

Azure Key Vault Secrets Java SDK for secret management. An agent skill from microsoft/skills.

microsoft/skills

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent.

MuWinds/BUUCTF_Agent

Get a path in the call graph from a source function to a specified destination function in the codebase.

opensage-agent/opensage-adk