Best web application vulnerabilities skills, page 7

A skill your agent uses when debugging or preventing errors in Frappe Client Scripts.

Impertio-Studio/Frappe_Claude_Skill_Package

A skill your agent uses when handling database errors in Frappe/ERPNext.

Impertio-Studio/Frappe_Claude_Skill_Package

A skill your agent uses when debugging or preventing errors in Frappe Server Scripts.

Impertio-Studio/Frappe_Claude_Skill_Package

A skill your agent uses when building database queries with frappe.qb in Frappe v14-v16.

Impertio-Studio/Frappe_Claude_Skill_Package

Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md

ruvnet/ruflo

Hunting skill for cache poison vulnerabilities. An agent skill from elementalsouls/Claude-BugHunter.

elementalsouls/Claude-BugHunter

A skill your agent uses when code touches user input, tokens, redirects, raw SQL, or logging — injection, XSS, atom exhaustion, timing attacks, audit tooling.

j-morgan6/elixir-phoenix-guide

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests…

petrkindlmann/qa-skills

API hardening for Express, FastAPI, and serverless. An agent skill from jamditis/claude-skills-journalism.

jamditis/claude-skills-journalism

Secure authentication patterns (OWASP, NIST). An agent skill from jamditis/claude-skills-journalism.

jamditis/claude-skills-journalism

Pre-deployment security audit organized by OWASP Top 10. An agent skill from jamditis/claude-skills-journalism.

jamditis/claude-skills-journalism

Authorized testing of access-control and business-logic flaws that pattern scanners cannot find — IDOR/BOLA, broken function-level authorization, mass assignment, business-logic abuse, and race…

ptn1411/skill

Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3…

utkusen/sast-skills

Authorized security assessment of LLM applications and AI agents: prompt injection, tool abuse, RAG exposure, memory poisoning, system-prompt extraction, and agent-compliance engineering per OWASP…

sickn33/agentic-awesome-skills

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table.

sickn33/agentic-awesome-skills

Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like confused and OWASP…

mukul975/Anthropic-Cybersecurity-Skills

Web Application Firewall guidance, when to put one in front of an app and how to run it without breaking traffic.

TheDecipherist/claude-code-mastery-project-starter-kit

Security rule for timing-safe secret comparison. An agent skill from paralleldrive/aidd.

paralleldrive/aidd

Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title…

jeremylongshore/tons-of-skills-marketplace

Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods…

jeremylongshore/tons-of-skills-marketplace

Compose an exec-readable summary from a unified findings JSONL plus the OWASP coverage report.

jeremylongshore/tons-of-skills-marketplace

Annotate every pentest finding with its OWASP Top 10 (2021) category by applying a deterministic rule table keyed on source skill, finding category, detail keywords, and CWE identifier when present.

jeremylongshore/tons-of-skills-marketplace

A skill your agent uses when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing…

jabrena/plinth

A skill your agent uses when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics…

jabrena/plinth

A skill your agent uses when you need to write or review programmatic JDBC with Spring — including JdbcClient (Spring Framework 7+) as the default API, JdbcTemplate only where batch/streaming APIs…

jabrena/plinth

A skill your agent uses when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules…

jabrena/plinth

Secure coding practices for agent-native apps: input validation, SQL injection, XSS, secrets, data scoping, and auth.

BuilderIO/agent-native

Security review via Codex exec. An agent skill from sd0xdev/sd0x-harness.

sd0xdev/sd0x-harness

Comprehensive security development guide for Mobazha decentralized marketplace covering XSS prevention, Web3 transaction safety, key management, and input validation.

mobazha/mobazha-unified

CORS misconfiguration testing playbook. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Advanced Content Security Policy bypass techniques. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Dangling markup injection playbook. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Hunt CORS Misconfiguration

sickn33/agentic-awesome-skills

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces.

SnailSploit/Claude-Red

Penetration test and red team report writing methodology. An agent skill from SnailSploit/Claude-Red.

SnailSploit/Claude-Red

Apply security-conscious thinking when generating or modifying code.

techygarg/lattice

Perform an evidence-based Levyra security review and Codex Security workflow covering threat modeling, attack paths, validation, remediation, revalidation, secrets, provider URLs, redirects, SSRF…

LUC4N3X/Levyra-deepsound

Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP…

LeoYeAI/openclaw-master-skills

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable…

Goldziher/ai-rulez

Run security audit — dependency vulnerabilities, secret scanning, OWASP pattern detection, HTTP headers.

Houseofmvps/ultraship

API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse.

Encod3d-Sec/TORCH

OAuth and SAML attack hunting - redirecturi bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection.

Encod3d-Sec/TORCH

GraphQL IDOR/auth-bypass, XXE file-read/SSRF (SVG/DOCX/SAML), SSTI detection and RCE.

Encod3d-Sec/TORCH

LLM / AI application attack hunting - prompt injection (direct + indirect), excessive agency, insecure output handling, system-prompt + data leakage.

Encod3d-Sec/TORCH

SSRF hunting - OOB-mandatory methodology. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

File upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS.

Encod3d-Sec/TORCH

XSS hunting - reflected, stored, DOM-based. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

Scan project dependencies for known vulnerabilities (CVEs). An agent skill from OWASP/secure-agent-playbook.

OWASP/secure-agent-playbook