Security · For devops and sre engineers

Record a vetted Hex package version in hexvet.exs after a security review — manages the audit ledger, not the scanner.

oliver-kriska/claude-elixir-phoenix

S3 resiliency, security, and data protection review. An agent skill from aws/tools-for-devops-agent.

aws/tools-for-devops-agent

Query token security audit to detect scams, honeypots, and malicious contracts before trading.

npc-live/clawfirm

Tool to get the caller of a function in the codebase. An agent skill from opensage-agent/opensage-adk.

opensage-agent/opensage-adk

For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the…

lyonzin/knowledge-rag

A skill your agent uses when performing deep analysis of specific findings or high-risk areas during a security audit.

ccashwell/evm-cortex

[omh] Attack paths into an operated system: turn a system's components and data flows into assets, trust boundaries, attack scenarios, controls, and the security test that proves each control holds.

rlaope/oh-my-hermes

Security review: (1) vet an untrusted SKILL.md or .mcp.json BEFORE installing it — the injection/exfiltration scanner; CRITICAL blocks the install; (2) audit code on an untrusted-input path (a…

redhat-et/ripwire

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup.

briiirussell/cybersecurity-skills

PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Transform AI agents from task-followers into proactive partners.

LeoYeAI/openclaw-master-skills

A skill your agent uses when invalid data causes failures deep in execution - validates at every layer data passes through to make bugs structurally impossible rather than temporarily fixed

ed3dai/ed3d-plugins

Audits an external (third-party) Claude Code plugin pinned in this marketplace for security risk before it is vendored, and writes the report to a file for downstream posting.

bitwarden/ai-plugins

Hunt for a specific APT/threat actor in your environment. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Perform a comprehensive security audit of all project files in the current working directory.

LaravelDaily/AI-Workflows-For-Laravel

Hunts for the other instances of a bug already found — the variants of one root cause across a codebase.

trailofbits/skills

Review Express.js security audit patterns for middleware and routes.

IgorWarzocha/Opencode-Workflows

Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated…

tobihagemann/turbo

Autonomously deep-scan entire codebase line-by-line, understand architecture and patterns, then systematically transform it to production-grade, corporate-level professional quality with optimizations

davila7/claude-code-templates

Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…

hardw00t/ai-security-arsenal

Verify supply chain integrity for AI agent plugins, tools, and dependencies.

github/awesome-copilot

Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection.

arpitg1304/robotics-agent-skills

Reproduce a true-positive finding against the running application.

seqra/opentaint

Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing…

utkusen/sast-skills

Run a large sharded measurement sweep over npm packages (the build-jail catalog probe, or any harness that installs thousands of package-versions and records a verdict per run).

nubjs/nub

Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification.

AgentSecOps/SecOpsAgentKit

Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

AgentSecOps/SecOpsAgentKit

Assess game build, launcher, update, distribution, mod, plugin, dependency, signing, provenance, and recovery trust.

gmh5225/awesome-game-security

Expert guidance for proactive threat hunting in Google SecOps.

google/skills

Expert guidance for security alert triage in Google SecOps. An agent skill from google/skills.

google/skills

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants.

SnailSploit/Claude-Red

Generic detection rule creation and management using Sigma, the universal SIEM rule format.

AgentSecOps/SecOpsAgentKit

Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives.

AgentSecOps/SecOpsAgentKit

A skill your agent uses when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE…

davila7/claude-code-templates

Deep audit before GitHub push: removes junk files, dead code, security holes, and optimization issues.

sickn33/agentic-awesome-skills

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

sickn33/agentic-awesome-skills

Generates professional security audit reports from findings.

alt-research2/SolidityGuard

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems.

github/awesome-copilot

Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts.

codexstar69/bug-hunter

Admin account register: system, main and backup admin, seats, plan, 2FA, shared logins and access-review dates, as CSV, SQL, JSON Schema or Notion on request.

sickn33/agentic-awesome-skills

Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, technical advisories for IT teams…

mukul975/Anthropic-Cybersecurity-Skills

Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notification procedures for security incidents, using context-driven criteria that…

mukul975/Anthropic-Cybersecurity-Skills

Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g.

mukul975/Anthropic-Cybersecurity-Skills

Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD…

mukul975/Anthropic-Cybersecurity-Skills

Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL…

mukul975/Anthropic-Cybersecurity-Skills

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations.

mukul975/Anthropic-Cybersecurity-Skills

Configures Hardware Security Modules for cryptographic key storage using the PKCS11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2…

mukul975/Anthropic-Cybersecurity-Skills

Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context…

mukul975/Anthropic-Cybersecurity-Skills