Best threat modeling skills for Claude Code, Codex and other agents.

Hardens code against vulnerabilities. An agent skill from penpot/penpot.

penpot/penpot

Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.

fla-org/flash-linear-attention

Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping)…

pashov/skills

Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

ruvnet/ruflo

Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

alexgreensh/repo-forensics

Builds a cited research base on normal system behavior and adversary abuse patterns before a threat hunt hypothesis gets written.

OTRF/ThreatHunter-Playbook

Runs and configures the anomalib tiled-ensemble pipeline, which trains/evaluates one model per image tile and merges results (with optional seam smoothing) for high-resolution anomaly detection.

open-edge-platform/anomalib

Run an ASSERT evaluation against a described risk. An agent skill from responsibleai/ASSERT.

responsibleai/ASSERT

Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.

cartography-cncf/cartography

Three-axis review of the branch diff — Standards (this repo's documented standards + public API/bridge surface), Spec (the originating Linear/GitHub issue or PR), and Correctness (runtime bugs + the…

getsentry/sentry-react-native

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

elementalsouls/Claude-OSINT

Applies a threat-model-first approach to web code that handles untrusted input, authentication, data storage, dependencies or personal data.

addyosmani/agent-skills

Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.

garrytan/gstack

Translates a threat hunt's investigative intent into query-agnostic analytics that describe how adversary behavior should appear in data, grounded in table schemas.

OTRF/ThreatHunter-Playbook

Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must…

samugit83/redamon

Token-efficient smart contract security auditing via Behavioral State Analysis (BSA).

quillai-network/quillshield_skills

Three-axis review of the branch diff — Standards (this repo's documented standards + public API surface), Spec (the originating Linear issue / PR), and Correctness (runtime bugs + the SDK threat…

getsentry/sentry-dart

Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.

codexstar69/bug-hunter

Ultimate AI-powered cybersecurity code review skill. An agent skill from AgriciDaniel/claude-cybersecurity.

AgriciDaniel/claude-cybersecurity

Use before shipping to production. An agent skill from garagon/nanostack.

garagon/nanostack

Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.

trilwu/secskills

A skill your agent uses when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview.

ccashwell/evm-cortex

Builds attack trees that map how an attacker could reach a goal, with AND and OR nodes and cost, time, skill and detection ratings, to find defense gaps.

wshobson/agents

Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.

wshobson/agents

Finds security threats in a design with a STRIDE pass per component, rates severity and records fixes, with extra checks for AI agent and tool risks.

dralgorhythm/claude-agentic-framework

Audit browser-engine changes that process untrusted content or cross native-memory, origin, network, storage, extension, decoder, sandbox, or operating-system boundaries.

nordstjernen-web/northstar-browser

Advanced vulnerability analysis principles. An agent skill from xenitV1/Antigravity-Workflows.

xenitV1/Antigravity-Workflows

A skill your agent uses when stitching kernels into a multi-launch ELF and the AIE compiler rejects the merged module (BD exhaustion, channel routing, herd shape conflict, IR validation error, DMA…

Xilinx/mlir-air

Apply STRIDE methodology to systematically identify threats.

sangrokjung/claude-forge

Design, evaluate, and challenge quantitative investment ideas using an integrated research workflow that covers factor and asset-pricing logic, signal generation, signal validation, backtesting…

monarchjuno/vibe-investing

Runs a parallel security audit with three vulnerability hunters and two proof-of-concept engineers, rating each finding by whether it is actually exploitable.

code-yeongyu/oh-my-openagent

Deep behavioral code analysis agent for Bug Hunter. An agent skill from codexstar69/bug-hunter.

codexstar69/bug-hunter

Builds a code graph of functions, classes and calls across languages, then queries it for call paths, taint, blast radius, entry points and complexity hotspots.

trailofbits/skills

Intelligent pattern selection for Fabric CLI. An agent skill from ynulihao/AgentSkillOS.

ynulihao/AgentSkillOS

Analyse Mitre ATT&CK tactics, techniques and sub-techniques.

tsale/awesome-dfir-skills

Security audit skill. An agent skill from blueberrycongee/termcanvas.

blueberrycongee/termcanvas

A skill your agent uses for PhD-level expertise in data science, statistics, and machine learning: rigorous statistical analysis, experimental design, causal inference, advanced modeling, research…

magnus919/agent-skills

Chief Security Officer mode. An agent skill from no-session/pstack.

no-session/pstack

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing.

davila7/claude-code-templates

Hunt for vulnerabilities in a running debuggee by analyzing imports/exports, triaging attack surface, and iteratively testing for bugs with PoC generation.

dariushoule/x64dbg-skills

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel…

utkusen/sast-skills

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

alpha-omega-security/scrutineer

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

fabricioctelles/skills

Analyzes Solidity contract entry points to map attack surface.

alt-research2/SolidityGuard

MCP threat-model artifact for a scaffolded harness. An agent skill from ruvnet/metaharness.

ruvnet/metaharness

Expert in threat modeling methodologies, security architecture review, and risk assessment.

davila7/claude-code-templates

Run a focused STRIDE-based security review using Bug Hunter-native artifacts.

codexstar69/bug-hunter

Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns.

Factory-AI/factory-plugins