Security · npm · For devops and sre engineers

A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).

asyncapi/generator

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery

Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.

zereight/gitlab-mcp

Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…

cdxgen/cdxgen

Author CycloneDX-VEX or OpenVEX documents that import cleanly into ReARM.

relizaio/rearm

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Run a large sharded measurement sweep over npm packages (the build-jail catalog probe, or any harness that installs thousands of package-versions and records a verdict per run).

nubjs/nub

Pre-production audit, hardening, and go-live checklists for FrontMCP servers.

agentfront/frontmcp

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns.

briiirussell/cybersecurity-skills

Inkline's platform & trust surface — the styleframe license boundary, supply-chain and secrets hygiene, npm distribution integrity, and the future Studio/commercial direction.

inkline/inkline

Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, filesystem IOCs, C2…

davila7/claude-code-templates

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to…

mukul975/Anthropic-Cybersecurity-Skills

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit

Scan project dependencies for known vulnerabilities and CVEs.

ruvnet/ruflo

Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.

tobihagemann/turbo

Execute this skill enables comprehensive vulnerability scanning using the vulnerability-scanner plugin.

jeremylongshore/tons-of-skills-marketplace

Usar antes de aceptar una dependencia nueva. An agent skill from 686f6c61/alfred-dev.

686f6c61/alfred-dev

Apply rigorous supply chain security hygiene to software projects — audit dependencies, detect risks, minimize attack surface.

LearnPrompt/andrej-karpathy-skills

Audit npm dependencies for security vulnerabilities, outdated packages, and unused dependencies.

OneWave-AI/claude-skills

TencentOS Server 全栈运维诊断，根据用户的自然语言描述，自动识别需要的能力接口，查询能力实现，使用具体能力解决客户问题。覆盖磁盘空间/分区/文件系统/LVM/健康检测、网络连通性/丢包/延迟排查、CPU火焰图/系统调用热点/调度延迟/中断均衡/文件IO延迟/进程IO追踪分析、内存泄漏/OOM诊断、系统日志/服务管理/时间同步/软件包/软件源管理、kdump配置与故障排查、等保三级…

infometa/workbuddyskills