Security · Python · For developers

Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

eigent-ai/eigent

Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.

trailofbits/skills

Guides building Flowsint enrichers and types: where definitions live, how the base class and vault work, and when a new type is warranted.

reconurge/flowsint

Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

trailofbits/skills

Run a Kedro security scan on the full codebase or just a pull request.

kedro-org/kedro

Polymarket integration for prediction market trading on Polygon.

Polymarket/agent-skills

A skill your agent uses when modifying, testing, documenting, or reviewing the Vulners Python SDK.

vulnersCom/api

Adding a Community Agent Skill: a Markdown attack-workflow file that users import from the catalog, which then competes in the Intent Router and is injected into the agent's system prompt.

samugit83/redamon

Reviews code for security, performance, quality and maintainability, using a checklist, a finding template and two metrics scripts.

luongnv89/claude-howto

Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.

duriantaco/skylos

Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.

fengshao1227/ccg-workflow

Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。

aliyun/alibabacloud-ecs-troubleshoot-skills

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses.

pydantic/monty

Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner.

ParzivalHack/PySpector

Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.

waybarrios/opencode-power-pack

Django access control and IDOR security review. An agent skill from getsentry/skills.

getsentry/skills

Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.

duriantaco/skylos

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery

Runs Slither and Mythril against Solidity contracts to find reentrancy, overflow and access-control bugs before mainnet deployment, then triages and reports findings.

tradecatlabs/vibe-coding-cn

Combine multiple individual single-signal DBC files into one combined DBC at the application level.

CSS-Electronics/can-bus-reverse-engineering-skills

Write, run, test and package Edge Python programs with the edge CLI.

dylan-sutton-chavez/edge-python

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

OrbitCurve/firmware-reverse-engineering

Installs, tunes and enforces Sponsio contracts that block unsafe tool calls in LLM agents, covering setup, auditing, observe mode and flipping to enforce.

SponsioLabs/Sponsio

Maximum-fidelity Python source reconstruction from Nuitka .nbc / NBC/2 files produced by nuitkadecompiler.py.

DimaReverse/nuitka-static-unpacker

KISA 가이드라인 기반 배포 전 보안 컴플라이언스 체크리스트를 실행합니다. An agent skill from cdppcorp/KESE-KIT.

cdppcorp/KESE-KIT

Shows how to replace unsafe hasattr and setattr loops over user-controlled kwargs with an explicit allowlist when configuring ONNX Runtime option objects.

microsoft/onnxruntime

Security-focused code review checklist and automated scanning patterns.

nicepkg/auto-company

Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.

Hainrixz/cyber-neo

End-to-end Stellar development playbook. An agent skill from VelaPayments/vela-payments.

VelaPayments/vela-payments

Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

ptn1411/skill

Format and pretty-print Hak5 WiFi Pineapple recon JSON scan files for readability.

sneakerhax/Arsenal

Create or delegate Tenuo warrants from natural-language authority requirements.

tenuo-ai/tenuo

Covers recovering and verifying the VC7 C runtime, compiler-runtime and D3DX library functions in the TH08 decompilation, with hash-pinned evidence.

N0zoM1z0/th08

Reference for building payment systems that meet PCI DSS: the 12 requirements, merchant levels, data that must never be stored, tokenization and encryption.

wshobson/agents

Debug and emulate specific code fragments or functions using the Unicorn engine.

index-login/MobileRE-Skill

Display Hak5 WiFi Pineapple recon scan data as a formatted table.

sneakerhax/Arsenal

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.

trailofbits/skills

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells.

Eyadkelleh/awesome-skills-security

Audit, explain, or compare existing Tenuo warrants and delegation chains.

tenuo-ai/tenuo

Public-records OSINT investigation framework — SEC EDGAR filings, USAspending contracts, Senate lobbying, OFAC sanctions, ICIJ offshore leaks, NYC property records (ACRIS), OpenCorporates…

johnson7788/MultiUserClaw

Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or…

PentesterFlow/agent

AI 도구(Claude, ChatGPT, Cursor, Copilot)용 시큐어 코딩 프롬프트와 가이드를 생성합니다.

cdppcorp/KESE-KIT

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Diagnose a denied Tenuo call and make the legitimate call work with the smallest change to authority.

tenuo-ai/tenuo

When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

deonmenezes/mantishack

Python 遗留代码审查：bare except、SQL 注入、反序列化、密钥、调试输出. An agent skill from liuyanghejerry/Clausura.

liuyanghejerry/Clausura

Changing or adding a project setting / default value in RedAmon.

samugit83/redamon

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.

luongnv89/skills