Best web application vulnerabilities skills, page 4

Instruments code to track the flow of untrusted or sensitive data at runtime, enabling detection of injection vulnerabilities, data leaks, and privilege violations.

ArabelaTso/Skills-4-SE

Working on the HTTP capture proxy and its replay/fuzz path: the egress guard that stops the proxy becoming an SSRF pivot, why it checks the resolved IP, and keeping capture off the scan's critical…

samugit83/redamon

Security-focused review for frontend/Web3 code. An agent skill from hyperlane-xyz/hyperlane-explorer.

hyperlane-xyz/hyperlane-explorer

Comprehensive API security review against OWASP API Security Top 10 (2023).

OWASP/secure-agent-playbook

Web vulnerability hunting playbook. An agent skill from PentesterFlow/agent.

PentesterFlow/agent

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations.

affaan-m/ECC

Multi-tenant authz, pre-auth disclosure hardening, and Kali disposition.

bbartling/open-fdd

Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives across sessions and users (distinct from…

elementalsouls/Claude-BugHunter

Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR…

awarexone/Agentic-Bug-Hunter

Squad de 15 agentes de seguranca ofensiva e defensiva (Georgia Weidman, Peter Kim, Jim Manico, Chris Sanders, Omar Santos, Marcus Carey) cobrindo pentest, red team, blue team, AppSec, recon e…

ohmyjahh/xquads-squads

Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection.

AgentSecOps/SecOpsAgentKit

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and…

zebbern/claude-code-guide

Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology

RightNow-AI/openfang

Suede AI findings-only code review with full context: changed files, callers, contracts, and deploy surface.

JasonColapietro/suede-creator-skills

Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across SQL databases (PostgreSQL, SQL Server, Oracle).

totvs/engpro-advpl-tlpp-skills

Laravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥管理、速率限制和安全部署. An agent skill from affaan-m/ECC.

affaan-m/ECC

Kimlik doğrulama eklerken, kullanıcı girdisi işlerken, secret'larla çalışırken, API endpoint'leri oluştururken veya ödeme/hassas özellikler uygularken bu skill'i kullanın.

affaan-m/ECC

Security rules for eserstack in TypeScript and Go: secrets, output hygiene, input validation, authorization, injection, SSRF, error sanitization, httpfx hardening, tokens, passwords, cookies…

eser/stack

API design conventions, namespace coordinate system, RBAC roles, ClawHub compatibility layer, OpenAPI contract sync rules, and CSRF/session handling.

iflytek/skillhub

Security-focused code review mapped to OWASP Top 10 and ASVS.

OWASP/secure-agent-playbook

Review the finished Worker against OWASP Top 10:2025, fix what is exploitable, prove each fix with a test, and report.

receptron/mulmoterminal

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks.

github/awesome-copilot

Quality standards for Salesforce Lightning Web Components (LWC), Aura components, and Visualforce pages.

github/awesome-copilot

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection.

codewithmukesh/dotnet-claude-kit

全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 -…

staruhub/ClaudeSkills

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

sickn33/agentic-awesome-skills

Python security vulnerability detection using Bandit SAST with CWE and OWASP mapping.

AgentSecOps/SecOpsAgentKit

Web server vulnerability scanner for identifying security issues, misconfigurations, and outdated software versions.

AgentSecOps/SecOpsAgentKit

Automated SQL injection detection and exploitation tool for web application security testing.

AgentSecOps/SecOpsAgentKit

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

github/awesome-copilot

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory…

unxed/f4

Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences…

mukul975/Anthropic-Cybersecurity-Skills

Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation…

mukul975/Anthropic-Cybersecurity-Skills

Web vulnerability scanning workflow covering SQLi, XSS, template injection, and generic CVE detection using nuclei, sqlmap, dalfox, nikto, and jaeles

CommonHuman-Lab/nyxstrike

RLS validation, security audits, OWASP compliance, and vulnerability scanning.

bybren-llc/safe-agentic-workflow

Generates a CycloneDX SBOM from source code with OWASP cdxgen, covering project-type selection across 30+ ecosystems, monorepo recursion, lifecycle phases, generation profiles, component filtering…

cdxgen/cdxgen

A skill your agent uses for security reviews of VoxBento code.

fossasia/eventyay-interpretation

A skill your agent uses when the user needs to build, choose the pattern for, or optimize a SQL query against Protheus ERP tables -- covering Workarea (DbSelectArea/DbSeek) vs Embedded SQL vs…

thalysjuvenal/advpl-specialist

检查 SQL 注入、XSS、硬编码密钥

liuyanghejerry/Clausura

Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP…

sickn33/agentic-awesome-skills

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks.

langbyyi/CyberStrikeAI-SRC

Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.

dzhalaevd/Donatello

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.

mukul975/Anthropic-Cybersecurity-Skills

Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or…

mukul975/Anthropic-Cybersecurity-Skills

Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200/401/403 response…

mukul975/Anthropic-Cybersecurity-Skills

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties.

mukul975/Anthropic-Cybersecurity-Skills

Implements API security testing on the 42Crunch platform, combining API Audit for static analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability testing, and API Protect for…

mukul975/Anthropic-Cybersecurity-Skills

Implements API threat protection using Google Apigee reverse-proxy policies, including JSON/XML threat protection, OAuth 2.0 enforcement, SpikeArrest rate limiting, regex-based threat detection, and…

mukul975/Anthropic-Cybersecurity-Skills