Security · Git · For developers

Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping)…

pashov/skills

Find latent bugs in a local PostgreSQL source tree (RELxxSTABLE branch or HEAD) the way a core hacker does: build a heavily-poisoned debug instance (cassert + cache-discard + -O0/-ggdb3 + core…

digoal/blog

Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

trailofbits/skills

Security audit for web apps, especially AI-built ("vibe coded") ones.

benavlabs/vibe-check

Reviews code or recent changes for bugs, security issues, performance problems and maintainability, reporting findings by severity with the reason and a fix.

pretend1111/claude-desktop-app

Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.

activepieces/activepieces

Three-axis review of the branch diff — Standards (this repo's documented standards + public API/bridge surface), Spec (the originating Linear/GitHub issue or PR), and Correctness (runtime bugs + the…

getsentry/sentry-react-native

Specialized in reverse-engineering compiled binaries (JARs, DLLs).

HacktronAI/skills

Run the security-focused Skeptic persona on the local working tree's diff against a base branch.

RaoFoundation/subtensor

Diagnoses exception root causes from stack traces, logs, call-chain dumps, and debug output using the CodexQA CLI for structured repo analysis.

openqa-cn/codexqa

Three-axis review of the branch diff — Standards (this repo's documented standards + public API surface), Spec (the originating Linear issue / PR), and Correctness (runtime bugs + the SDK threat…

getsentry/sentry-dart

Workflow for updating gem dependencies and fixing CVEs in the ruby-git project: assess with bundle outdated and audit, edit the gemspec, test, then commit with conventional messages.

ruby-git/ruby-git

Review code for security vulnerabilities. An agent skill from kklimuk/docx-cli.

kklimuk/docx-cli

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe.

mistralai/mistral-vibe

Autonomous, non-interactive run of the whole lifecycle for one development task — size, plan, build, gate, review, fix, commit — without stopping for questions.

guardana/guardana

Reviews staged changes, a branch, a PR or a path for bugs, security gaps and performance issues, then writes an evidence-based report and creates Beads tasks.

maslennikov-ig/claude-code-orchestrator-kit

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills

Scans a whole codebase or a set of changes for security issues, and turns findings into verified patch files that you apply yourself.

anthropics/claude-plugins-official

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets.

zebbern/claude-code-guide

Fix open Dependabot and CodeQL/code-scanning alerts directly on the current branch.

cloudposse/atmos

Compares before and after Trailmark graphs of a branch, pull request or release diff to flag new entry points, tainted paths, removed validation and other structural security regressions.

trailofbits/skills

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

dralgorhythm/claude-agentic-framework

Reviews a pull request, commit or diff for security problems, using git history, caller counts and test coverage, and writes a markdown report.

trailofbits/skills

Parallel read-only multi-agent review of a current git diff or explicit file scope to find behavioral regressions, security or privacy risks, performance or reliability issues, and contract or test…

Dimillian/Skills

Behaviour-preserving restructuring and cleanup — splitting an oversized module, removing dead code, finished scripts, flags or documents, consolidating duplicates, tightening comments.

guardana/guardana

Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and…

mukul975/Anthropic-Cybersecurity-Skills

Personally identifiable information (PII) leak prevention for EverClaw.

profbernardoj/everclaw-community-branches

Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…

mukul975/Anthropic-Cybersecurity-Skills

PR review for DevOps changes — runs the generic /qv-pr-review flow then layers a structured GitHub Actions security audit (action pinning, permissions, OIDC, secrets handling).

tetherto/qvac

Orchestrate end-to-end CVE remediation for the Linux CCM, CNM, and health-probe-proxy images on cloud-provider-azure master or a release-X.Y branch, including builds, repeated Trivy verification…

kubernetes-sigs/cloud-provider-azure

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

uphiago/recon-skills

Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps and low-value tests by running internal reviews and a peer review in…

tobihagemann/turbo

Mass scan for exposed env files, backups, and git configs. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

Verify exact SillyTavern, Tavern Helper / JS-Slash-Runner, STScript, macro, prompt-injection, worldbook, EJS, MVU, and runtime-library capabilities before implementing or reviewing rolecard…

LiarMTTT/TavernWeave

Reviews code for quality, security, correctness. An agent skill from softspark/ai-toolkit.

softspark/ai-toolkit

Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the…

jeremylongshore/tons-of-skills-marketplace

Security review via Codex exec. An agent skill from sd0xdev/sd0x-harness.

sd0xdev/sd0x-harness

Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

aws/agent-toolkit-for-aws

Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation.

aws/agent-toolkit-for-aws

Multi-dimensional LLM council review of an open PR (default) or a local feature branch (§ 8 branch mode, invoked via /gflow:branch-review).

ffroliva/gflow-cli

Build a read-only compromise timeline and evidence bundle from local Git history and public forge/archive records.

alpha-omega-security/scrutineer

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec/AboutSecurity

A skill your agent uses when resolving which GitHub repository to clone for CVE analysis from a container image name in a Jira ticket summary, pscomponent label, or Downstream Component Name field.

openshift-eng/ai-helpers

Focused security audit of code, calibrated to surface real exploitable bugs and suppress theoretical findings.

PostHog/posthog

Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets.

harness/harness-skills

AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.

danielvm-git/bigpowers