Secure coding

Automated code review and security linting integration for CI/CD pipelines using reviewdog.

AgentSecOps/SecOpsAgentKit

Execute safe read-only SQL queries against PostgreSQL databases with multi-connection support and defense-in-depth write protection.

sickn33/agentic-awesome-skills

Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.

dzhalaevd/Donatello

Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop…

mukul975/Anthropic-Cybersecurity-Skills

Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles.

ancoleman/ai-design-components

Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding.

decebals/claude-code-java

Establish a security baseline for a website or web app. An agent skill from rampstackco/claude-skills.

rampstackco/claude-skills

A skill your agent uses when settling the contract of an API you expose, before implementation: resources/URLs, REST vs GraphQL, versioning, one RFC 9457 error envelope, pagination, idempotency —…

ericrisco/rsc-harness

Review Next.js security audit patterns for App Router and Server Actions.

IgorWarzocha/Opencode-Workflows

Expert in secure backend coding practices specializing in input validation, authentication, and API security.

aiskillstore/marketplace

A skill your agent uses when reviewing HTTP response headers for defense-in-depth security hardening on any web application.

thedaviddias/Front-End-Checklist

Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.

rand/cc-polymath

Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts.

ancoleman/ai-design-components

Run an enterprise security review of a system design or existing code before it ships.

ooiyeefei/ccc

Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001).

ancoleman/ai-design-components

HTTP security header audit (A+ to F) with fix recommendations

taracodlabs/aiden

A skill your agent uses when the user says 'audit API', 'check API security', 'API routes security', 'endpoint audit', 'check my routes', or needs to verify API route protection.

cwinvestments/memstack

A skill your agent uses when the user says 'CSP', 'Content-Security-Policy', 'security headers', 'HSTS', 'X-Frame-Options', 'clickjacking', 'unsafe-inline', 'unsafe-eval', or needs to audit…

cwinvestments/memstack

Security patterns and OWASP guidelines. An agent skill from aiskillstore/marketplace.

aiskillstore/marketplace

OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference.

modu-ai/moai-adk

Search-visibility and crawlability reference for web output: canonical URL discipline, per-page title and meta description uniqueness, robots.txt and sitemap.xml as host-derived artifacts, JSON-LD…

modu-ai/moai-adk

Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations.

jeremylongshore/tons-of-skills-marketplace

A skill your agent uses when reviewing, designing, or modifying Java enterprise products, services, libraries, agents, plugins, connected components, or platform modules that may qualify as products…

jabrena/plinth

Web Application Firewall guidance, when to put one in front of an app and how to run it without breaking traffic.

TheDecipherist/claude-code-mastery-project-starter-kit

Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin trio (COOP, COEP, CORP).

jeremylongshore/tons-of-skills-marketplace

A skill your agent uses when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing…

jabrena/plinth

A skill your agent uses when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics…

jabrena/plinth

Secure coding practices for agent-native apps: input validation, SQL injection, XSS, secrets, data scoping, and auth.

BuilderIO/agent-native

Apply security-conscious thinking when generating or modifying code.

techygarg/lattice

Full execution protocol for MODE: LOOP — the compound-engineering loop: brainstorm → plan → build → review → improve, iterating under defense-in-depth stop conditions with generator/critic…

ZaxbyHub/opencode-swarm

Security-posture and third-party SaaS identification — security headers, CSP, HSTS, email auth, security.txt, plus payments/analytics/auth/CRM/support integrations.

transilienceai/communitytools

Application security covering input validation, auth, headers, secrets management, and dependency auditing

rohitg00/awesome-claude-code-toolkit

Cloudflare Workers security with authentication, CORS, rate limiting, input validation.

secondsky/claude-skills

Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.

ccplugins/awesome-claude-code-plugins

Configure and audit security review capabilities as one layer in a defense-in-depth pull-request program.

jeremylongshore/tons-of-skills-marketplace

Apply Vercel security best practices for secrets, headers, and access control.

jeremylongshore/tons-of-skills-marketplace

Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it.

cbrock84/headcount

STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design.

borghei/Claude-Skills

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency…

nirholas/pump-fun-sdk

Security-first development guidance based on OWASP ASVS (Application Security Verification Standard).

OWASP/secure-agent-playbook

AI-enabled security excellence through transparent ISMS implementation, defense-in-depth, and strategic planning aligned with Hack23 business model

Hack23/cia

Secure SDLC phases, security requirements, secure coding practices, and security testing integration for the CIA platform

Hack23/cia

Threat modeling before coding, STRIDE methodology, defense in depth, security controls in SDLC

Hack23/cia

A skill your agent uses when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or…

ericrisco/rsc-harness

A skill your agent uses when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or…

ericrisco/rsc-harness

A skill your agent uses when authoring or auditing a Dockerfile, shrinking a bloated image, hardening a container that runs as root, picking a base image, or wiring a Compose dev loop with hot reload.

ericrisco/rsc-harness

A skill your agent uses when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog…

ericrisco/rsc-harness

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness