Security · Security review

Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

eigent-ai/eigent

A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

jewbetcha/opentrace

Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

usestrix/strix

Runs deepsec's AI-powered security scan over a repository's uncommitted changes, its diff to main, or the whole codebase, using a regex pass followed by agent investigation.

vercel-labs/deepsec

Professional code security audit skill covering 55+ vulnerability types.

3stoneBrother/code-audit

Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

trailofbits/skills

Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

vercel-labs/deepsec

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

tanweai/wooyun-legacy

Run a Kedro security scan on the full codebase or just a pull request.

kedro-org/kedro

Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

kubeshark/kubeshark

Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

trailofbits/skills

A skill your agent uses when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "fuzz my…

solana-foundation/solana-dev-skill

Screens EVM and Solana meme coins for rug pull signs such as hidden mint, honeypot logic and fee tricks, starting with fast kill signals before any code review.

awarexone/Agentic-Bug-Hunter

Security code review for vulnerabilities. An agent skill from getsentry/skills.

getsentry/skills

Reviews code for security, performance, quality and maintainability, using a checklist, a finding template and two metrics scripts.

luongnv89/claude-howto

Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

mono/SkiaSharp

OWASP compliance, vulnerability scanning, and adversarial red team testing — use for security reviews

nyldn/claude-octopus

Review a change (a PR, the current branch diff, or a set of files) or audit a component or the whole tree for missing or incorrect security hardening.

symfony/symfony

Checklist-driven security review for changes to authentication, authorization, MFA, secrets, input validation and other security-critical code.

ZeroDeng01/sublinkPro

Reviews a verdaccio diff, branch or PR against the repository's review guide, verifies each finding in the code and reports only actionable issues.

verdaccio/verdaccio

Answers AWS architecture, security and service-selection questions by searching AWS documentation through MCP tools first, then adapting advice to your stack and team.

tech-leads-club/agent-skills

Verify that code changes do not introduce OAuth security vulnerabilities.

doorkeeper-gem/doorkeeper

Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

ruvnet/ruflo

Security audit for web apps, especially AI-built ("vibe coded") ones.

benavlabs/vibe-check

Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

jeremylongshore/tons-of-skills-marketplace

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export.

zebbern/claude-code-guide

Apply modern web development best practices for security, compatibility, and code quality.

midudev/100cosas.dev

Operates Flounder, an autonomous white-hat security auditor.

adshao/flounder

Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

trailofbits/skills

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses.

pydantic/monty

Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities.

gocronx-team/gocron

Precision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects.

codexstar69/bug-hunter

Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner.

ParzivalHack/PySpector

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.

EpicenterHQ/epicenter

Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.

Fangcun-AI/SkillWard

Django access control and IDOR security review. An agent skill from getsentry/skills.

getsentry/skills

Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files.

HarnessMD/munder-difflin

Security audit of Solidity code while you develop. An agent skill from Gabson0x/bountyforge.

Gabson0x/bountyforge

Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

TheDecipherist/claude-code-mastery

Run an authorized, local-first application security assessment on the current project using this agent's own reasoning.

stijnswapped/Myrqen

A skill your agent uses when scanning code for security vulnerabilities.

tanviet12/vbsec

Run a pre-deployment security compliance checklist based on KISA guidelines.

cdppcorp/KESE-KIT

Turns a verbose, reporter-submitted obot security advisory into a short, deployer-facing writeup covering impact, affected versions and mitigation.

obot-platform/obot

A skill your agent uses when an agent folder must pass the Agentlas Cloud 2-stage security scan (static rules + BYOK LLM judgment) before private sync or public publish, or when asked to…

agentlas-ai/Agentlas-OS

Parses reports from the humble HTTP security header analyzer and explains each finding with remediation steps for DevOps teams.

rfc-st/humble

Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

karimhabush/cyberowl

Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

tihanyin/REx-skill

Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.

zereight/gitlab-mcp