Security · GitHub · For devops and sre engineers

Cut a new AperiSolve release — bump the version, commit "chore(release): X.Y.Z", tag it, push, and publish a GitHub Release whose notes are computed from the commits since the last tag.

Zeecka/AperiSolve

A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).

asyncapi/generator

Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

netdata/netdata

Handle a security fix end to end for MidnightBSD src - triage a FreeBSD security advisory (FreeBSD-SA-) or CVE against this tree, port the fix to master and both stable branches, add the UPDATING…

MidnightBSD/src

Analyze potential Ankaios security vulnerabilities from pasted reports, local evidence, or advisory URLs.

eclipse-ankaios/ankaios

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

vechain/x-app-template

Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.

trailofbits/skills

A skill your agent uses when a researcher, maintainer, or contributor found or suspects a malicious skill on ClawHub and needs a private reporting workflow: opening a GitHub private vulnerability…

openclaw/clawscan

Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

warpdotdev/warp

A skill your agent uses when fixing compiler warnings, static analyzer findings (clang-tidy, etc.), or runtime errors/crashes in the libYSE codebase.

yvanvds/yse-soundengine

Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe…

openclaw/openclaw

Creates a new Earl HCL template for a specific API, database, or shell command.

mathematic-inc/earl

Triage a CVE / Dependabot alert in a JS/TS project and recommend the least-invasive fix.

getlago/lago-front

Handle confidential GitHub Security Advisory response for Paperclip.

paperclipai/paperclip

Turn a vulnerability report into a publication-ready GitHub Security Advisory.

frappe/skills

Find new skills on GitHub or check a specific skill before installing.

khendzel/skills-janitor

Run snapshot regression tests after changes to OPA rules, scanners, analyzers, or formatters to detect output regressions.

boostsecurityio/poutine

Draft a security-audit scope from GitHub repos or API access, with a protocol narrative and a sizing table.

forefy/.context

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).

secondsky/claude-skills

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation.

alpha-omega-security/scrutineer

Deep audit before GitHub push: removes junk files, dead code, security holes, and optimization issues.

sickn33/agentic-awesome-skills

Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across…

mukul975/Anthropic-Cybersecurity-Skills

Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…

mukul975/Anthropic-Cybersecurity-Skills

Full Go CVE analysis workflow. An agent skill from openshift-eng/ai-helpers.

openshift-eng/ai-helpers

Review secret detection patterns and scanning workflows. An agent skill from IgorWarzocha/Opencode-Workflows.

IgorWarzocha/Opencode-Workflows

High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

uphiago/recon-skills

Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.

tobihagemann/turbo

A skill your agent uses when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring…

yaojingang/yao-open-skills

Scan the ClawHunter agent bounty marketplace for opportunities that genuinely match this agent's real capabilities (code, security research, writing) and surface only real matches — never a raw…

aeonfun/aeon

检测规避/EDR 对抗分析：AMSI/ETW 绕过、无文件、lolbin 链. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

Drive responsible disclosure of a proven finding to a CVE. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

Stage a scanned repository into a private repo in the configured GitHub organisation.

alpha-omega-security/scrutineer

File a finding on the upstream repository through GitHub's private vulnerability reporting, request the temporary private fork, and push the proposed patch to it when available.

alpha-omega-security/scrutineer

Configure Claude Code sandbox network isolation with trusted domains, custom access policies, and environment variables

Microck/ordinary-claude-skills

Master GitHub Agentic Workflows (gh-aw) - AI-powered repository automation with safe outputs, sandboxed execution, and multi-engine support

Hack23/cia

Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.

Mathews-Tom/armory

Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot.

ccplugins/awesome-claude-code-plugins

Ingest a CVE writeup, blog post, advisory, or GitHub repo into the wiki - fetch, dedup via sources:, update the right technique/tool page(s), re-index.

Encod3d-Sec/TORCH

A skill your agent uses when resolving which GitHub repository to clone for CVE analysis from a container image name in a Jira ticket summary, pscomponent label, or Downstream Component Name field.

openshift-eng/ai-helpers

CI/CD pipeline security gate design guide. An agent skill from revfactory/harness-100.

revfactory/harness-100

Find leaked API keys, tokens, and credentials in public GitHub repositories.

uphiago/recon-skills

GitHub 安全研究方法论：搜索 GitHub 上的免杀/Loader/C2 技术仓库，分析代码模式，提取新技术入库。当知识库中没有针对当前检测环境的免杀技术时使用——先搜索 GitHub 高星仓库，分析代码后写入 evasion-techniques-db.json 或 loader-components-db.json 入库

wgpsec/AboutSecurity

A skill your agent uses when opening or updating a GitHub pull request after Phase 5 of /compliance:analyze-cve has applied and verified a CVE fix locally.

openshift-eng/ai-helpers

This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work…

bitwarden/ai-plugins

Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution.

aiskillstore/marketplace