Web application vulnerabilities

使用 xray 进行 Web 漏洞自动化扫描。当需要对 Web 应用进行全面漏洞扫描（XSS/SQLi/命令注入/SSRF/XXE/路径穿越/文件上传/弱口令等）时使用。xray 是长亭科技出品的综合性 Web 安全评估工具，支持主动扫描、被动代理扫描、基础爬虫扫描三种模式，内置丰富的检测插件和社区 POC。任何涉及 xray 漏洞扫描、Web 安全评估、被动代理扫描的场景都应使用此技能

wgpsec/AboutSecurity

Audit codebase for security vulnerabilities, insecure patterns, and compliance gaps.

EmeaAppGbb/spec2cloud

基于 OWASP Top 10 (2021) 标准提供代码安全审查，逐项检查 SQL 注入、XSS、SSRF、访问控制、加密失败等常见漏洞，并给出具体的漏洞代码示例与修复方案。当用户需要代码安全审查、安全加固、渗透测试辅助，或提及 OWASP、安全检查、SQL 注入、XSS、代码审计、安全清单等关键词时触发此技能。

rongxinzy/RongxinAI

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the…

davila7/claude-code-templates

Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment.

rsmdt/the-startup

AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.

danielvm-git/bigpowers

安全测试助手 - 专业的应用安全测试与防护专家。适用场景： (1) Web应用安全测试（OWASP Top 10漏洞检测） (2) API安全测试（认证/授权/数据泄露） (3) 安全测试用例设计与评审 (4) 渗透测试方案制定与执行指导 (5) 安全漏洞分析与风险评估 (6) 安全加固建议与最佳实践 (7) 安全合规检查（GDPR/等保） (8) 安全测试报告编写…

chendongqi/OPB-Skills

Security auditing and vulnerability assessment specialist. An agent skill from aiskillstore/marketplace.

aiskillstore/marketplace

Assess vulnerabilities and audit for security compliance using OWASP and STRIDE methodology — a user-invoked Security Auditor workflow.

dralgorhythm/claude-agentic-framework

Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications.

SpecterOps/skills

Hunting skill for ssrf vulnerabilities.

sickn33/agentic-awesome-skills

CORS (Cross-Origin Resource Sharing) misconfiguration auditor.

LeoYeAI/openclaw-master-skills

HTTP security header auditor that fetches response headers from any URL and grades them against OWASP, Mozilla Observatory, and Google standards.

LeoYeAI/openclaw-master-skills

Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Java 源码前端安全类漏洞审计。当在 Java 白盒审计中需要检测前端安全漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Java 源码注入类漏洞审计。当在 Java 白盒审计中需要检测注入类漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

PHP 源码认证、配置与逻辑类漏洞审计。当在 PHP 白盒审计中需要检测认证绕过、 权限控制、安全配置、密码学误用或业务逻辑漏洞时触发。

wgpsec/AboutSecurity

PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、 需要检查框架特有安全机制和常见配置缺陷时触发。

wgpsec/AboutSecurity

PHP 源码前端交互类漏洞审计。当在 PHP 白盒审计中需要检测前端安全相关漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

PHP 源码注入类漏洞审计。当在 PHP 白盒审计中需要检测注入类漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Insecure direct object reference testing for broken access control

NeoTheCapt/RedteamAgent

覆盖工具 allow/ask/deny、四种 permission mode、审批持久化、Workspace/Hook Trust、敏感文件以及 Hook/Browser 网络边界。

echoVic/blade-code

Harden Angular apps against XSS, CSP violations, and unauthorized access.

HoangNguyen0403/agent-skills-standard

OWASP LLM Top 10 (2025) audit checklist for AI applications, agent tools, RAG pipelines, and prompt construction.

HoangNguyen0403/agent-skills-standard

OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024).

HoangNguyen0403/agent-skills-standard

Secure Go backend services against common vulnerabilities. An agent skill from HoangNguyen0403/agent-skills-standard.

HoangNguyen0403/agent-skills-standard

Prevent XSS, secure auth flows, and harden React client-side applications.

HoangNguyen0403/agent-skills-standard

Secure server-side TypeScript input, auth tokens, and injection boundaries.

HoangNguyen0403/agent-skills-standard

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table.

elementalsouls/Claude-BugHunter

Guidance for Azure Web Application Firewall — deployed on Azure Front Door (global, edge-tier) or Azure Application Gateway (regional, integrated with backend pools).

vinayaklatthe/microsoft-security-skills

MASTER SECURITY: OWASP Top 10, SAST/DAST, PenTest. An agent skill from Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI.

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI

浏览器交互式挖洞:登录态操作、双账号越权对比、SPA渲染取证、DOM XSS确认、验证码登录、前端隐藏功能绕过. An agent skill from langbyyi/CyberStrikeAI-SRC.

langbyyi/CyberStrikeAI-SRC