Security · npm

A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).

asyncapi/generator

Reviews a verdaccio diff, branch or PR against the repository's review guide, verifies each finding in the code and reports only actionable issues.

verdaccio/verdaccio

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery

Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.

activepieces/activepieces

Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.

zereight/gitlab-mcp

Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…

cdxgen/cdxgen

Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.

bodadotsh/npm-security-best-practices

Author CycloneDX-VEX or OpenVEX documents that import cleanly into ReARM.

relizaio/rearm

Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm).

SmilyOrg/photofield

Installs hooks that check each agent action against security policies before it runs, blocking destructive commands and logging every decision.

pegasi-ai/reins

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection.

zebbern/claude-code-guide

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

Use HOL Guard to preview and protect AI-agent package installs, Cursor surfaces, CI, and automation workflows.

hashgraph-online/hol-guard

The Massing release discipline — how to ship a verified, CI-green version-numbered release direct to main.

ibuilder/massing

Remediate security vulnerabilities found by Grype or pnpm audit.

stacklok/toolhive-studio

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Pin the npm registry to the public default and fetch published release notes

cisco-ai-defense/skill-scanner

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that…

tinyfish-io/tinyfish-cookbook

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

dralgorhythm/claude-agentic-framework

Respond to blocked package installs and manage the Interlinked supply-chain allowlist.

QuentinCody/interlinked-cli

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices.

alirezarezvani/claude-skills

Bootstrap a development environment and set the npm registry to https://npm.artifacts-mirror.internal-corp.dev

cisco-ai-defense/skill-scanner

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes.

bagofwords1/bagofwords

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart).

softspark/ai-toolkit

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

cobusgreyling/loop-engineering

Run a large sharded measurement sweep over npm packages (the build-jail catalog probe, or any harness that installs thousands of package-versions and records a verdict per run).

nubjs/nub

Audit and manage dependencies across multi-language projects.

alirezarezvani/claude-skills

Pre-production audit, hardening, and go-live checklists for FrontMCP servers.

agentfront/frontmcp

Automate browsers (Playwright) and Windows desktop applications (UI automation) for reverse-engineering evidence collection, UI-driven workflows, and network observation during analysis.

sickn33/agentic-awesome-skills

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns.

briiirussell/cybersecurity-skills

Inkline's platform & trust surface — the styleframe license boundary, supply-chain and secrets hygiene, npm distribution integrity, and the future Studio/commercial direction.

inkline/inkline

Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages.

Varnan-Tech/opendirectory

Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, filesystem IOCs, C2…

davila7/claude-code-templates

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with…

mukul975/Anthropic-Cybersecurity-Skills

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to…

mukul975/Anthropic-Cybersecurity-Skills

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit

Audit MCP (Model Context Protocol) server configurations for security issues.

github/awesome-copilot

Scan project dependencies for known vulnerabilities and CVEs.

ruvnet/ruflo

Proactive supply-chain watch for this repo. An agent skill from epam/ai-dial-chat.

epam/ai-dial-chat

A skill your agent uses when the user says 'dependency audit', 'npm audit', 'pip audit', 'cargo audit', 'security vulnerabilities', 'outdated packages', 'supply chain', or needs to scan project…

cwinvestments/memstack

Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.

tobihagemann/turbo

Handle CVE/vulnerability reports from security linters (trivy, osv-scanner, etc.).

hardisgroupcom/sfdx-hardis

Dependabot-aware dependency updates with security audit, real-CI validation, and a unified PR.

joshukraine/dotfiles

Execute this skill enables comprehensive vulnerability scanning using the vulnerability-scanner plugin.

jeremylongshore/tons-of-skills-marketplace

Software Composition Analysis: find vulnerable dependencies, correlate CVE/GHSA/OSV across ecosystems, generate CycloneDX/SPDX SBOMs, assess license compliance, and run reachability-aware triage to…

hardw00t/ai-security-arsenal