Static analysis and SAST

Audit trending repos for real exploitable vulnerabilities and disclose responsibly — Private Vulnerability Reporting for code flaws and verified secrets, public PRs only for already-disclosed…

BankrBot/skills

A skill your agent uses when running Slither static analysis on Solidity contracts.

ccashwell/evm-cortex

This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work.

aiskillstore/marketplace

Run semgrep via the mantissemgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle

deonmenezes/mantishack

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness

Hack23 secure development policy enforcement, SAST/DAST integration, dependency scanning, and code signing practices

Hack23/cia

Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot.

ccplugins/awesome-claude-code-plugins

Validate API consistency between two versions of Java libraries.

ArabelaTso/Skills-4-SE

Validate API consistency between two versions of Python libraries.

ArabelaTso/Skills-4-SE

Trace and test untrusted data through SQL, NoSQL, LDAP, XPath, XML, shell, process, template, expression-language, code-evaluation, log, spreadsheet, mail, header, and browser interpreters.

cyberful/cyberful

MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file…

LeoYeAI/openclaw-master-skills

Automated vulnerability scanner for agent platforms. An agent skill from LeoYeAI/openclaw-master-skills.

LeoYeAI/openclaw-master-skills

Static ReDoS (Regular Expression Denial of Service) vulnerability scanner and regex quality auditor for codebases.

LeoYeAI/openclaw-master-skills

CI/CD pipeline security gate design guide. An agent skill from revfactory/harness-100.

revfactory/harness-100

Automated SAST + dependency vulnerability scan. An agent skill from jeremylongshore/tons-of-skills-marketplace.

jeremylongshore/tons-of-skills-marketplace

Static analysis skill for C/C++ codebases. An agent skill from mohitmishra786/low-level-dev-skills.

mohitmishra786/low-level-dev-skills

Guide for resolving NullAway static analysis errors. An agent skill from nwjs/chromium.src.

nwjs/chromium.src

Generate abstract Control Flow Graph (CFG) representations of programs showing loops, branches, and function calls for static analysis or verification.

ArabelaTso/Skills-4-SE

Analyze source code statically to detect potential functional bugs including null dereferences, incorrect condition checks, unreachable code, inconsistent state updates, logic errors, resource…

ArabelaTso/Skills-4-SE

Applies abstract interpretation using different abstract domains (intervals, octagons, polyhedra, sign, congruence) to statically analyze program variables and infer invariants, value ranges, and…

ArabelaTso/Skills-4-SE

Performs abstract interpretation over source code to infer possible program states, variable ranges, and data properties without executing the program.

ArabelaTso/Skills-4-SE

Explain why counterexamples violate specifications by analyzing formal specifications (temporal logic, invariants, pre/postconditions, code contracts), informal requirements (user stories…

ArabelaTso/Skills-4-SE

Subagent for figma-from-code Phase 0b. An agent skill from bitovi/ai-enablement-prompts.

bitovi/ai-enablement-prompts

Security vulnerability scanner and OWASP compliance auditor for codebases.

curiositech/some_claude_skills

Maintainer workflow for the pre-PR secure loop: code, build/test, SAST/CodeQL, dynamic sanitizer checks, fixes, and concise handoff.

InternationalColorConsortium/iccDEV

Reverse-engineer any website's, repo's, or local project's design system into a Claude-ready skill via the SkillUI CLI.

CraftOS-dev/CraftBot

Conduct comprehensive security code reviews using OWASP Top 10, SAST/DAST patterns, and Hack23 ISMS secure development policy

Hack23/cia

Identify performance bottlenecks, inefficient patterns, and optimization opportunities through static analysis.

EmeaAppGbb/spec2cloud

Configure PHP ecosystem tooling, dependency management, and static analysis.

HoangNguyen0403/agent-skills-standard

Tool to get the program slice for a given function using Joern.

opensage-agent/opensage-adk

Tool to search for a function in the codebase. An agent skill from opensage-agent/opensage-adk.

opensage-agent/opensage-adk

Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or…

sundial-org/awesome-openclaw-skills

For a batch of findings from a non-security audit tool (<audit-tool — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against <upstream…

apache/magpie

A skill your agent uses to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now…

OneWave-AI/claude-skills

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations.

seb1n/awesome-ai-agent-skills

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines.

seb1n/awesome-ai-agent-skills

This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work…

bitwarden/ai-plugins

A skill your agent uses when auditing an Anchor or bare-Rust Solana program end to end; because Solana ships no static analyzers, the coverage strategy is compiler-warning triage, manual source…

mtarcure/claude-vibe-squad

MASTER SECURITY: OWASP Top 10, SAST/DAST, PenTest. An agent skill from Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI.

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI

DevSecOps, secure software development lifecycle (SSDLC), and application security (AppSec) practices covering secret handling, input validation, dependency hygiene, authentication/authorization…

Mindrally/skills

安全自动化顶级专业技能：DevSecOps全流程集成、CI/CD安全管道、SAST/DAST/SCA/容器/IaC自动化扫描编排、安全工具链集成实战、攻防双视角自动化（红队打点/蓝队检测响应）、SOAR深度编排、Agentic AI安全自动化（LLM Agent编排扫描与响应）、大模型安全运营（AI告警降噪/剧本生成）、误报治理与质量保障、合规自动化（证据收集/报告）

langbyyi/CyberStrikeAI-SRC

Run code quality tools: PHP-CS-Fixer for style, PHPStan for static analysis, and type safety checks

dev-toolings/superpowers-symfony