Security · Secrets management

Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

eigent-ai/eigent

Installs or refreshes Iron Proxy and its Iron Control web console for NanoClaw, with a local Docker setup, database, credentials and a human approval bridge.

nanocoai/nanoclaw

Installs or refreshes OneCLI as the gateway provider for NanoClaw, copying the adapter files, registering the provider and running the setup script.

nanocoai/nanoclaw

Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

netdata/netdata

Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling.

ktnyt/cclsp

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

vechain/x-app-template

When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

deonmenezes/mantishack

Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…

vinayaklatthe/microsoft-security-skills

Lets the agent list and read the secrets a user has configured, such as API keys and tokens, through two tai tools instead of hardcoding credentials into code or commands.

YaoApp/yao

Explains how to call external APIs through the OneCLI proxy, which injects stored credentials into outgoing HTTPS requests so the agent never handles keys.

nanocoai/nanoclaw

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets.

zebbern/claude-code-guide

Turns a leaked key, token or password into one tracked rotation task the moment it's spotted, instead of a reminder repeated every session.

avelikiy/great_cto

Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

transilienceai/communitytools

Loads a missing environment variable or API key from the team's Infisical workspace into the current shell, or runs a command with all project secrets injected.

Devin-AXIS/iPolloWork

Audits code and infrastructure for vulnerabilities and produces a severity-rated report with locations and remediation, using SAST, dependency and secrets scans plus manual review.

Jeffallan/claude-skills

Rules for working behind Iron Proxy: connect external accounts without handling raw tokens, treat blocked requests as policy outcomes, and never claim a connection before it works.

nanocoai/nanoclaw

Azure Key Vault Secrets Java SDK for secret management. An agent skill from microsoft/skills.

microsoft/skills

How to monitor and fix security issues in Massing — CodeQL alerts, dependency audits, secret scanning, and ReDoS/XXE fixes.

ibuilder/massing

Azure Key Vault Keys SDK for .NET. An agent skill from microsoft/skills.

microsoft/skills

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…

samugit83/redamon

Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies.

VeryGoodOpenSource/vgv-ai-flutter-plugin

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates.

utkusen/sast-skills

Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection.

arpitg1304/robotics-agent-skills

Python security vulnerability detection using Bandit SAST with CWE and OWASP mapping.

AgentSecOps/SecOpsAgentKit

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

github/awesome-copilot

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory…

unxed/f4

Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access…

mukul975/Anthropic-Cybersecurity-Skills

Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across…

mukul975/Anthropic-Cybersecurity-Skills

RLS validation, security audits, OWASP compliance, and vulnerability scanning.

bybren-llc/safe-agentic-workflow

Audit a pull request diff for common security concerns (input validation, sanitization, authentication and authorization, secrets management, unsafe dependencies, and related risks) and fold…

warpdotdev/oz-for-oss

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft…

mukul975/Anthropic-Cybersecurity-Skills

Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers, SQL, storage, and Key Vault, using Azure Policy for evaluation, Log Analytics for telemetry, Azure Arc for hybrid coverage…

mukul975/Anthropic-Cybersecurity-Skills

Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection.

mukul975/Anthropic-Cybersecurity-Skills

Configures HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates, with automatic generation, lease management, and rotation to eliminate static secrets…

mukul975/Anthropic-Cybersecurity-Skills

Establish a security baseline for a website or web app. An agent skill from rampstackco/claude-skills.

rampstackco/claude-skills

Review Next.js security audit patterns for App Router and Server Actions.

IgorWarzocha/Opencode-Workflows

Run Azure compliance and security audits with azqr plus Key Vault expiration checks.

microsoft/GitHub-Copilot-for-Azure

Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…

mukul975/Anthropic-Cybersecurity-Skills

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

uphiago/recon-skills

Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.

rand/cc-polymath

Audit MCP (Model Context Protocol) server configurations for security issues.

github/awesome-copilot

Review secret detection patterns and scanning workflows. An agent skill from IgorWarzocha/Opencode-Workflows.

IgorWarzocha/Opencode-Workflows

[omh] Security event on the code already shipped -- a CVE in a dependency, a secret committed to the repo, a license question, an advisory: triage reachability and severity, contain in order, and…

rlaope/oh-my-hermes

Azure Key Vault SDK for Python. An agent skill from microsoft/skills.

microsoft/skills

DevSecOps, container, and API operational defensive security reference: CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection, SAST/DAST integration, container image scanning…

modu-ai/moai-adk

Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.

transilienceai/communitytools

A skill your agent uses when the user says 'scan for secrets', 'check for leaked keys', 'secrets scanner', 'hardcoded credentials', 'API key leak', or needs to detect exposed secrets in source code.

cwinvestments/memstack

ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation.

jonathan-vella/apex