Web application vulnerabilities

Essential fuzzing payloads: SQL injection, command injection, special characters.

Ch1nfo/RiftX

Ghost Security - SAST code scanner. An agent skill from aAAaqwq/AGI-Super-Team.

aAAaqwq/AGI-Super-Team

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel…

utkusen/sast-skills

Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3…

utkusen/sast-skills

Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC…

transilienceai/communitytools

Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

transilienceai/communitytools

Defensive security engineering judgment, distilled from a stronger model - invoke when THREAT MODELING a system or feature; making security-relevant design decisions (auth, crypto, trust boundaries…

telagod/code-abyss

Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (.js, .ts, .html, .css, .js-meta.xml) — the canonical LWS/Product-Security review for…

forcedotcom/sf-skills

Activate an Enhanced MessagingChannel (WhatsApp/Apple/Facebook/SMS/RCS) by PATCHing MessagingChannelUsage.DeploymentStatus from Disabled to Provisioning via the REST sobject endpoint.

forcedotcom/sf-skills

A skill your agent uses when writing code that processes user input, manages authentication or authorization, constructs database queries, handles file operations, interacts with external data…

NoobyGains/godmode

对前端代码进行安全审计，检测 XSS、CSRF 等漏洞。当用户请求代码审查或询问代码安全性时使用. An agent skill from TencentBlueKing/bk-bcs.

TencentBlueKing/bk-bcs

Application security covering input validation, auth, headers, secrets management, and dependency auditing

rohitg00/awesome-claude-code-toolkit

WordPress security code review and vulnerability detection. An agent skill from jorgerosal/wordpress-skills.

jorgerosal/wordpress-skills

A skill your agent uses when closing a patch cycle with rigorous stress LAST on the Railway hub, bensbench x86 fieldbus → MQTTS, CSV/synth59/Creekside/gate 19, B100 Railway-only, light OWASP ZAP…

bbartling/open-fdd

Cloudflare Workers security with authentication, CORS, rate limiting, input validation.

secondsky/claude-skills

Web application security testing workflow and checklist generation.

SpecterOps/skills

Hunting skill for csrf vulnerabilities.

sickn33/agentic-awesome-skills

Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and…

mukul975/Anthropic-Cybersecurity-Skills

Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.

mukul975/Anthropic-Cybersecurity-Skills

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

mukul975/Anthropic-Cybersecurity-Skills

Comprehensive code security audit with AI-powered vulnerability detection.

LeoYeAI/openclaw-master-skills

Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash…

trilwu/secskills

Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.

ccplugins/awesome-claude-code-plugins

Build and harden Phoenix auth and security — OAuth login, password hashing, sessions, RBAC, rate limiting, CSRF, XSS, SQL injection, secrets.

oliver-kriska/claude-elixir-phoenix

Security audit workflow - vulnerability scan → verification. An agent skill from parcadei/Continuous-Claude-v3.

parcadei/Continuous-Claude-v3

SecOps for application security, vulnerability management, compliance, and secure development.

borghei/Claude-Skills

扫描代码安全漏洞，检测依赖漏洞、密钥泄露和OWASP安全模式。当用户提到安全扫描、漏洞检测、依赖审计、密钥泄露、API key、OWASP、npm audit、pip-audit或SQL注入/XSS等关键词时触发。

rongxinzy/RongxinAI

Entry P1 category router for injection testing. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Entry P1 category router for authentication and authorization.

yaklang/hack-skills

Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage.

Dynatrace/dynatrace-for-ai

Chief Security Officer mode. An agent skill from mr-daedalium/ostack-saas.

mr-daedalium/ostack-saas

A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…

ericrisco/rsc-harness

AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 1 漏洞类别

wgpsec/AboutSecurity

Detect and exploit SQL injection vulnerabilities in web application parameters

NeoTheCapt/RedteamAgent

Detect and exploit server-side request forgery to access internal resources and cloud metadata

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

NeoTheCapt/RedteamAgent

XML external entity injection for file read, SSRF, and DoS. An agent skill from NeoTheCapt/RedteamAgent.

NeoTheCapt/RedteamAgent

Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure.

giuseppe-trisciuoglio/developer-kit

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable…

Goldziher/ai-rulez

当未授权/零身份测试但路径不在主站 JS、禁止依赖登录 Network 截图、独立 H5/旧域名 NXDOMAIN/品牌迁域、兄弟域或同 IP Host 漏路径、网关 405 或 data 空数组、getRsaKey/JSEncrypt/前端加密被当成鉴权时调用。负责零身份公开面还原路径与密钥、响应指纹分流、加密证伪、迁域复查。JS 拆包见 recon-js-analysis；角色/IDOR…

zhaji2333/CkSKILLS

当payload被拦截、请求被WAF/过滤/403拒绝、连续多次payload失败、需要绕过黑名单/白名单/正则/语义分析防御时调用。负责编码/变形/逻辑/协议层绕过、换入口、组合利用与时间维度攻击的完整升级路径。

zhaji2333/CkSKILLS

当目标存在评论/昵称/富文本/私信/工单/搜索反射/Markdown解析/AI输出渲染/前端DOM操作/postMessage/跨域配置等功能时调用。负责反射型/存储型/DOM XSS、AI/Markdown 渲染型存储 XSS、CSRF、CORS错误配置、Clickjacking 的深度挖掘与绕过。命中跳转页/开放重定向/target 参数驱动 location 跳转时优先测试跳转型…

zhaji2333/CkSKILLS

Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

transilienceai/communitytools

On-demand security and code quality audit. An agent skill from MadAppGang/claude-code.

MadAppGang/claude-code

Sonnet Amplified fullstack engine. An agent skill from davepoon/buildwithclaude.

davepoon/buildwithclaude

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning.

davepoon/buildwithclaude

Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.

HoangNguyen0403/agent-skills-standard

Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS.

HoangNguyen0403/agent-skills-standard