Security Audit
staruhub/ClaudeSkills
全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 -…
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。
Install Secknowledge Skill
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skill --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
Claude Code skills documentation · loads skills from .claude/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .claude/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skill --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .agents/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skill --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .cursor/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skill --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .gemini/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skillInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .github/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Pa55w0rd/secknowledge-skill secknowledge-skill --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "secknowledge-skill" agent skill from https://github.com/Pa55w0rd/secknowledge-skill/tree/main into .opencode/skills/secknowledge-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secknowledge-skill", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
secknowledge-skill- GitHub stars
- 424
- Token cost
- ~2.7k tokens
- SKILL.md length
- 878 words
- Files
- 51 (incl. references)
- Skills in repo
- 1
- Repo updated
- First seen
- Licence
- None found
At a glance
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。
- Works in 3 steps: 用户意图是执行安全测试（渗透/挖洞/利用/审计） — 非讨论/学习 → 提供了具体目标：URL、接口、代码片段、模型/Agent 架构、MCP 配置 —… → 任务涉及以下领域之一
- 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是测试/审计/挖漏洞/利用
- SKILL.md covers 触发条件, 行为准则（整个会话有效，不因对话长度放松）, 幻觉防护与来源引用 and 输出约束, plus 5 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Secknowledge Skill is an agent skill from Pa55w0rd/secknowledge-skill. Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是"测试/审计/挖漏洞/利用"。 DO NOT trigger: - 安全概念讨论（"什么是 XSS"、"SQL 注入原理是什么"）→ 普通问答 - 非安全性质的 code review / debug / 性能优化 → code-audit-skill 或其他 - 修复语法错误 / 业务逻辑 bug → 普通编程协助 - 纯 Web 白盒代码审计（完整项目目录 / Source-Sink 污点分析）→ code-audit-skill - 仅引用 CVE 编号查文档 → WebSearch - Mira 内置 handbook /…
Its SKILL.md is about 2.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 51 other files, including reference files (for example `README.md`, `README_EN.md` and `references/ai-app-agent-cot-1.md`).
It sits in Security, covering Web application vulnerabilities, LLM wikis and Vulnerability scanning. It works with Model Context Protocol and SQL. The repository describes itself as: SecKnowledge - Web与AI安全测试知识技能.
When your agent uses it
- 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是测试/审计/挖漏洞/利用
- Tasks that involve Web application vulnerabilities
- Tasks that involve LLM wikis
Example prompts
- “测试/审计/挖漏洞/利用”
- “什么是 XSS”
- “SQL 注入原理是什么”
- “/secknowledge-skill”
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- 用户意图是执行安全测试（渗透/挖洞/利用/审计） — 非讨论/学习
- 提供了具体目标：URL、接口、代码片段、模型/Agent 架构、MCP 配置 — 非抽象问题
- 任务涉及以下领域之一
What it can do on your machine
Read from SKILL.md and the folder at commit 078de3b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Secknowledge Skill loads about 2.7k tokens when it runs, and up to ~125k if it reads all its reference files. Until then it costs about 198 tokens; SKILL.md has 878 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 878 words (~2,708 tokens).
“路由优先级：现象信号 > 意图+关键词 > 歧义澄清。用户常描述的是问题现象（"agent 又乱调工具了"），而非任务类型（"做个渗透测试"）。先匹配现象信号，命中则进入对应安全测试路径；未命中再走下方意图+关键词的 AND 组合判断。”
- name
- secknowledge-skill
- metadata.version
- 2.2.0
Files
SKILL.md and 50 other files (references) in the repository root of Pa55w0rd/secknowledge-skill.
- SKILL.md
- README.md
- README_EN.md
- references/ai-app-agent-cot-1.md
- references/ai-app-agent-cot-2.md
- references/ai-app-deploy.md
- references/ai-app-frontier.md
- references/ai-app-mcp.md
- references/ai-app-prompt-1.md
- references/ai-app-prompt-2.md
- references/ai-app-train.md
- references/ai-baseline-app.md
- references/ai-baseline-deploy-1.md
- references/ai-baseline-deploy-2.md
- references/ai-baseline-escape.md
- references/ai-baseline-train.md
- references/ai-data-app-1.md
- references/ai-data-app-2.md
- references/ai-data-deploy.md
- references/ai-data-train-1.md
- … and 31 more
Open the folder on GitHubat commit 078de3b
Compare with similar skills
Secknowledge Skill next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Secknowledge Skill this skillPa55w0rd/secknowledge-skill | 424 | — | ~2.7k | Automated safety check: Pass | None | |
| Security Auditstaruhub/ClaudeSkills | 727 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Golang Securityunxed/f4 | 241 | 2 repos | ~3.6k | Automated safety check: Pass | MIT | |
| Sast Sqliutkusen/sast-skills | 1.3k | — | ~6k | Automated safety check: Pass | MIT | |
| Security Verification Gatefengshao1227/ccg-workflow | 5.9k | — | ~621 | Automated safety check: Notes | MIT | |
| SecskillsArenbai/SecSkills | 251 | — | ~1.8k | Automated safety check: Notes | MIT |
Similar skills
Golang Security
unxed/f4
Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory…
Sast Sqli
utkusen/sast-skills
Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3…
Security Verification Gate
fengshao1227/ccg-workflow
Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.
Secskills
Arenbai/SecSkills
渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。
Cyber Neo
Hainrixz/cyber-neo
Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.
Related
Works with
Categories
Questions about Secknowledge Skill
What does Secknowledge Skill do?
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。. Secknowledge Skill is an agent skill from Pa55w0rd/secknowledge-skill.
When should I use Secknowledge Skill?
Secknowledge Skill fits situations like: 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是测试/审计/挖漏洞/利用; tasks that involve Web application vulnerabilities; tasks that involve LLM wikis.
How do I install Secknowledge Skill in Claude Code?
Run `npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a claude-code`. Or copy the skill folder (the Pa55w0rd/secknowledge-skill repository) into .claude/skills/secknowledge-skill in your project. Claude Code loads it when a task matches its description.
How do I install Secknowledge Skill in Codex?
Run `npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a codex`. Or copy the skill folder (the Pa55w0rd/secknowledge-skill repository) into .agents/skills/secknowledge-skill in your project. Codex loads it when a task matches its description.
Can I use Secknowledge Skill in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Pa55w0rd/secknowledge-skill --skill secknowledge-skill -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/secknowledge-skill, .gemini/skills/secknowledge-skill, .github/skills/secknowledge-skill and .opencode/skills/secknowledge-skill in your project.
What does Secknowledge Skill need to run?
SKILL.md names no scripts, command-line tools or credentials: Secknowledge Skill is instructions for the agent only.
Does Secknowledge Skill access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Secknowledge Skill safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Secknowledge Skill use?
No licence was found for Secknowledge Skill or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Secknowledge Skill use?
About 2.7k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 122k tokens, read only when the agent opens those files.
What are the alternatives to Secknowledge Skill?
Skills that share tags, products or a category with Secknowledge Skill: Security Audit (staruhub/ClaudeSkills, 727 stars), Golang Security (unxed/f4, 241 stars), Sast Sqli (utkusen/sast-skills, 1.3k stars) and Security Verification Gate (fengshao1227/ccg-workflow, 5.9k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Secknowledge Skill?
Pa55w0rd (a GitHub user) maintains it in Pa55w0rd/secknowledge-skill, which has 424 GitHub stars. The repository was last updated on June 17, 2026.
Source: Pa55w0rd/secknowledge-skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.