Static analysis and SAST

A skill your agent uses when you have a Foundry or Hardhat repository of Solidity or Vyper contracts and want the end-to-end EVM review workflow on native CLIs — a slither static pass, semgrep taint…

mtarcure/claude-vibe-squad

Mobile (Android + iOS) application penetration testing methodology.

SnailSploit/Claude-Red

当需要对嵌入式 C/C++ 代码运行 cppcheck、clang-tidy 或 GCC analyzer 静态分析，或进行 MISRA-C 合规检查时使用。

LeoKemp223/embed-ai-tool

Use the open-source CodeQL ecosystem for .NET security analysis.

managedcode/dotnet-skills

Scan any agent skill for security risks before you install or use it.

LeoYeAI/openclaw-master-skills

Verter codebase architecture: high-level module map, TypeScript packages, plugin system, CSS analysis, MCP server, static analysis types

pikax/verter

Enforce output quality, evidence verification, and quality gates across security audits.

github/awesome-copilot

Connect the shared untrusted-data source group to new reusable OpenTaint sink groups.

seqra/opentaint

Run semgrep's p/security-audit and p/secrets rulesets and map hits into the findings shape.

alpha-omega-security/scrutineer

Complete workflow for static structural analysis. An agent skill from Cai-aa/CAE-Agent-Hub.

Cai-aa/CAE-Agent-Hub

Define analysis steps and procedures. An agent skill from Cai-aa/CAE-Agent-Hub.

Cai-aa/CAE-Agent-Hub

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel…

utkusen/sast-skills

Validate Snyk SAST / Code findings against repo evidence; emits per-finding verdicts (CONFIRMED / FALSEPOSITIVE / NEEDSREVIEW / DUPLICATE / NOTAPPLICABLE).

epam/ai-dial-chat

Expert security auditor for AI Skills and Bundles. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Pull REAL Snyk SAST findings from EPAM Jira (Data Center) via the search-export API using a Personal Access Token, and emit them as a stage-output.json artifact for a downstream triage stage.

epam/ai-dial-chat

Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime…

mukul975/Anthropic-Cybersecurity-Skills

DevSecOps, container, and API operational defensive security reference: CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection, SAST/DAST integration, container image scanning…

modu-ai/moai-adk

A skill your agent uses when conducting a frontend security review — static analysis (risky HTML patterns, env var exposure), authentication/authorization audit (token storage, route guards…

mizchi/skills

Deep code property graph analysis with Joern CPG (AST+CFG+PDG) and CodeQL for control flow, data flow, taint analysis, and security auditing

alinaqi/maggy

Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped.

seqra/opentaint

Run an OpenTaint scan on project and produces the SARIF report.

seqra/opentaint

Mark which of a project's dependency libraries could introduce taint sources.

seqra/opentaint

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests…

petrkindlmann/qa-skills

Run an ApexGuru performance scan on a Salesforce Apex project via the ApexGuru SFAP Scan API.

forcedotcom/sf-skills

Review a Lightning Web Component for mobile offline compatibility — the Komaci offline static analyzer that pre-primes the data graph for Salesforce Mobile App Plus and Field Service Mobile App.

forcedotcom/sf-skills

Drive static-analysis code quality in pi-agent-dashboard with Biome (analyze → fix → test), in changed-files or whole-repo mode.

BlackBeltTechnology/pi-agent-dashboard

Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3…

utkusen/sast-skills

Use the open-source CodeQL ecosystem for .NET security analysis.

managedcode/Storage

Use the open-source free Roslynator analyzer packages and optional CLI for .NET.

managedcode/Storage

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and…

mukul975/Anthropic-Cybersecurity-Skills

Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube.

BagelHole/DevOps-Security-Agent-Skills

A skill your agent uses when you need to add or evaluate Maven dependencies that improve code quality or domain modeling — including nullness annotations (JSpecify), static analysis (Error Prone +…

jabrena/plinth

Run a CI-like pipeline locally (format, lint, vet, static-analysis, tests) and summarize per-step results with remediation guidance.

pilinux/gorest

Conventions for authoring or editing analyzers in the glint/ Go static-analysis package — Speakeasy's custom golangci-lint plugin built on go/analysis.

speakeasy-api/gram

Run Salesforce Code Analyzer to scan code for security, performance, best practice, and code style violations.

forcedotcom/sf-skills

Ghost Security - SAST code scanner. An agent skill from aAAaqwq/AGI-Super-Team.

aAAaqwq/AGI-Super-Team

Write a self-contained OpenTaint engine-issue report from an analysis diagnosis or a full-scan failure.

seqra/opentaint

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel…

utkusen/sast-skills

Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user…

utkusen/sast-skills

Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3…

utkusen/sast-skills

Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to…

utkusen/sast-skills

Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

pilinux/gorest

Use the open-source free Roslynator analyzer packages and optional CLI for .NET.

managedcode/dotnet-skills

Decide whether a finding's suggested fix is a breaking change for top dependents.

alpha-omega-security/scrutineer

Draft operational mitigations for a finding consumers can apply before a fix ships.

alpha-omega-security/scrutineer

分析 Android 项目源码，用 LLM 从多维度生成 AI 自动化测试所需的先验知识文档，打包上报测试平台。核心价值：让 AI 测试 Agent 在运行前就知道「测什么、怎么断言、有哪些陷阱」。触发词：「分析我的 Android 项目」「生成测试画像」「理解这个 App 的业务」「提取测试先验知识」「帮我分析 Android 源码」

LeoYeAI/openclaw-master-skills

Comprehensive code security audit with AI-powered vulnerability detection.

LeoYeAI/openclaw-master-skills

Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it.

cbrock84/headcount