Security review

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps.

wshobson/agents

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.

wshobson/agents

Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.

nordstjernen-web/northstar-browser

Runs a phased pre-PR and pre-deploy check on a Django project: environment, linting, migrations, tests with coverage, security scans and settings review.

affaan-m/ECC

Finds security threats in a design with a STRIDE pass per component, rates severity and records fixes, with extra checks for AI agent and tool risks.

dralgorhythm/claude-agentic-framework

Run a Nuclei security scan against the target URL and report findings by severity.

MigoXLab/webqa-agent

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline.

mono/SkiaSharp

Senior ISMS Audit Expert for internal and external information security management system auditing.

davila7/claude-code-templates

Host security hardening and risk-tolerance configuration for OpenClaw deployments.

trpc-group/trpc-agent-go

Applies the AI SAFE2 v3.1 governance framework to designing, building, auditing and testing AI agents, RAG pipelines, MCP and tool integrations and AI infrastructure.

CyberStrategyInstitute/ai-safe2-framework

A skill your agent uses when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security.

AratKruglik/claude-laravel

Security audit and code review for Solidity smart contracts.

sablier-labs/evm-monorepo

Prepare Solidity projects for a security audit — test coverage, test quality, NatSpec docs, code hygiene, dependency health, best-practice enforcement, deployment readiness, and project…

PlamenTSV/plamen

Audit Zhin.js changes for security, performance, lifecycle, and architecture regressions.

zhinjs/zhin

A skill your agent uses for ANY new software project from idea to release — websites, WordPress/WooCommerce plugins, MCP servers, web apps, components, or libraries.

joseconti/declaracion-renta-espana

Expert workflow for reviewing Tauri 2 desktop app security. An agent skill from mukiwu/tempo-term.

mukiwu/tempo-term

Remediate security vulnerabilities found by Grype or pnpm audit.

stacklok/toolhive-studio

Ingest the official MITRE CWE database and generate per-domain security audit taxonomies for PromptKit.

microsoft/PromptKit

Find bugs, security vulnerabilities, and code quality issues in local branch changes.

getsentry/skills

Runs a parallel security audit with three vulnerability hunters and two proof-of-concept engineers, rating each finding by whether it is actually exploitable.

code-yeongyu/oh-my-openagent

Review code for security vulnerabilities. An agent skill from kklimuk/docx-cli.

kklimuk/docx-cli

Single-pass codebase analysis leveraging a 1M-token context window for comprehensive security scanning, architecture review, and dependency auditing.

yonatangross/orchestkit

Run Claude programmatically against collections of files in the codebase.

imbue-ai/sculptor

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

affaan-m/ECC

Run Warden security scans in this repo using Sentry's warden-skills.

UsefulSoftwareCo/executor

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Runs a security scan on a deployed Power Pages site, fetches the latest scan report, and produces a plain-language summary.

microsoft/power-platform-skills

Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.

BlkLeg/CircuitBreaker

Security guidelines for writing secure code. An agent skill from semgrep/skills.

semgrep/skills

Maps the state-changing entry points of a smart contract codebase and sorts them by access level, producing a structured audit report that leaves out read-only functions.

trailofbits/skills

Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.

affaan-m/ECC

Deep security review of a Convex app: authorization model, data access paths per table, HTTP action exposure, rate limiting, file storage access, scheduled function trust, and a written findings…

waynesutton/builder-skills

A skill your agent uses for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.

zhaoxuya520/reverse-skill

This skill should be used when the user asks to "verify code", "run verification", "check quality", "validate changes", or before creating a PR.

Galaxy-Dawn/claude-scholar

One-click deployment Skill for Windows security policies, daily security audits, behavior auditing, file baselines, logging and nightly audit task management

SafeAI-Lab-X/ClawKeeper

Performs a comprehensive Amazon ECS operations review across the 6 review pillars (Resiliency & HA, Observability, Security, Operations, Performance, Additional Analysis) using read-only AWS APIs…

aws/tools-for-devops-agent

Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy.

langfuse/langfuse

Reviews staged changes, a branch, a PR or a path for bugs, security gaps and performance issues, then writes an evidence-based report and creates Beads tasks.

maslennikov-ig/claude-code-orchestrator-kit

Security audit skill. An agent skill from blueberrycongee/termcanvas.

blueberrycongee/termcanvas

Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules…

redis/agent-skills

Code review covering security, performance, quality and maintainability, with a fixed report layout and two analysis scripts; the SKILL.md itself is in Ukrainian.

luongnv89/claude-howto

Finds exploitable application security vulnerabilities in code changes.

getsentry/warden

Ghost Security — combined security report. An agent skill from ghostsecurity/skills.

ghostsecurity/skills

Scans a whole codebase or a set of changes for security issues, and turns findings into verified patch files that you apply yourself.

anthropics/claude-plugins-official

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets.

zebbern/claude-code-guide

Security review of an open-autonomy agent service — cryptographic key handling, dynamic code execution, ABCI authentication and replay, secret exposure, dependency supply chain, and deployment…

valory-xyz/open-autonomy