Claude skills and agent skills

usestrixPipes a download into a shellSkill

ci-security-scanning-with-strix

usestrix/strix/skills/ci-security-scanning-with-strix/SKILL.md

Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.

AWSSkill

diff-scanning-with-aws-security-agent

aws/agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent/SKILL.md

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

No other project uses it yet

MicrosoftSkill

secure-by-design

microsoft/hve-core/.github/skills/security/secure-by-design/SKILL.md

Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.

saleorSkill

saleor-dashboard-security-audit

saleor/saleor-dashboard/.claude/skills/saleor-dashboard-security-audit/SKILL.md

Triage OSV and `pnpm audit` security findings and propose batched, accept-first dependency fixes. Use when asked to run a security audit, fix security vulnerabilities, update vulnerable packages, or analyze dependency audit output.

rosuHSkill

android-intent-security

rosuH/EasyWatermark/.agents/skills/android-intent-security/SKILL.md

Best practices for Android Intent security. Use this skill when auditing

AWSSkill

securing-s3-buckets

aws/agent-toolkit-for-aws/skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

rlaopeSkill

omh-security-safety-review

rlaope/oh-my-hermes/skills/omh-security-safety-review/SKILL.md

[omh] Agent or automation safety risks: review prompt, tool, secret, dependency, destructive-action, and explicit local plugin risks before agent or code execution. Use when the user says: security-safety-review, security safety review, ai coding safety, agent safety review, prompt injection review, tool permission review, secret exposure review, destructive action review.

No other project uses it yet

OpenAIReads credentialsSkill

twilio-security-hardening

openai/plugins/plugins/twilio-developer-kit/skills/twilio-security-hardening/SKILL.md

Secure Twilio applications against common attacks. Covers credential management (API keys vs auth tokens), request validation (webhook signature verification), PCI DSS compliance, HIPAA account requirements, SMS pumping prevention, geo-permissions, and account isolation patterns. Use this skill when developers are building or deploying Twilio apps.

katanemoSkill

plano-deployment-security

katanemo/archgw/skills/plano-deployment-security/SKILL.md

Apply Plano deployment and production security practices. Use for Docker networking, state storage choices, readiness checks, and environment-based secret handling.

SharpAIReads credentialsSkill

Home Security AI Benchmark

SharpAI/DeepCamera/skills/analysis/home-security-benchmark/SKILL.md

LLM & VLM evaluation suite for home security AI applications

FOSSBillingSkill

security-advisory-triage

FOSSBilling/FOSSBilling/.agents/skills/security-advisory-triage/SKILL.md

Verify a reported GitHub Security Advisory (GHSA) against this repo's actual current code, then refine its title/description/CVSS/CWE metadata into this project's house style and apply it to the live advisory. Use this whenever the user gives you a GHSA ID, a security advisory number, a security report to "check", "verify", "triage", or "confirm", or asks whether a vulnerability report is valid/real/still exploitable on main. Also use it when the user wants an advisory's writeup improved, its CVSS score computed or recalculated, its CWEs corrected, or its title/description brought in line with how this repo normally publishes advisories, even if they only ask for one of those pieces (e.g. "recompute the CVSS for GHSA-xxxx") rather than the full workflow. Don't wait for the user to ask for "the process" by name; if they hand you a GHSA id or a raw vulnerability report against this codebase, this skill is almost certainly what they want.

OpenAISkill

propose-security-hardening

openai/codex-security/plugins/codex-security/skills/propose-security-hardening/SKILL.md

Develop evidence-backed structural security hardening proposals from disclosures, findings, source code, or Codex Security scans. Use for systemic improvements, alternatives beyond individual patches, architectural tradeoffs, or implementation planning. Also use when a top-level scan requests final-report hardening guidance.

gmh5225Skill

game-supply-chain-security

gmh5225/awesome-game-security/.claude/skills/game-supply-chain-security/SKILL.md

Assess game build, launcher, update, distribution, mod, plugin, dependency, signing, provenance, and recovery trust. Use when release or content ingestion is the security boundary.

obot-platformSkill

rewrite-security-advisory

obot-platform/obot/.claude/skills/rewrite-security-advisory/SKILL.md

Rewrite an obot GitHub security advisory into Obot's short, user-facing format (Summary / Am I affected? / Details / Impact / Mitigation / Severity / Credits). Use when the user gives a GHSA id or advisory URL and asks to rewrite, simplify, or reformat it. Writes the result to a markdown file in the repo root for the user to paste into the advisory editor.

No other project uses it yet

discord-phpReads credentialsSkill

discord-php-bot-security

discord-php/DiscordPHP/.github/skills/discord-php-bot-security/SKILL.md

Audit checklist for DiscordPHP bots and API libraries — stop the bot token leaking to third-party APIs or logs, keep secrets out of custom_ids and exception messages, use constant-time comparison and crypto-random for auth/CSRF/webhook flows, and don't log OAuth codes / full headers / PII. Use when reviewing an HTTP client, an error handler, an OAuth or webhook endpoint, or before publishing a repo.

No other project uses it yet

kunchenguidSkill

repository-routing-security

kunchenguid/no-mistakes/.agents/skills/repository-routing-security/SKILL.md

Use when changing fork routing, forge-profile identity, provider-plugin host selection, repository URL persistence, credential redaction, the repo-config trust boundary (trusted-default-branch-only fields), gate-agent instruction neutralization, or repository-declared extra gates.

MicrosoftSkill

security-reviewer-formats

microsoft/hve-core/.github/skills/security/security-reviewer-formats/SKILL.md

Format specifications and data contracts for the security reviewer orchestrator and its subagents.

AcademySoftwareFoundationSkill

oiio-input-security-audit

AcademySoftwareFoundation/OpenImageIO/.agents/skills/oiio-input-security-audit/SKILL.md

Audit OpenImageIO file readers (ImageInput plugins and shared metadata decoders like exif/xmp/icc) against malformed or hostile input, fixing findings in small reviewable commits; covers crashes, out-of-bounds and other memory-unsafety, integer overflow, OOM and decompression bombs, and hangs. Use whenever someone asks to audit, harden, or fuzz-fix a format reader (whether or not the original 002-format-security-audit effort is named), or to investigate, triage, or fix any reader bug of those kinds, however reported: a fuzzer crash, security advisory, GitHub issue, or a prompt describing one.

No other project uses it yet

epicenter-mdSkill

better-auth-security-best-practices

epicenter-md/epicenter/.agents/skills/better-auth-security-best-practices/SKILL.md

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging. Use when reviewing auth security, brute-force protection, token handling, or deployment safety.

GoogleSkill

google-cloud-solution-multi-agent-security

google/skills/skills/cloud/google-cloud-solution-multi-agent-security/SKILL.md

Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGENT), or egress (AGENT_TO_ANYWHERE) patterns involving Model Armor, IAP, and Agent Registry. Don't use for general Cloud Load Balancing or basic VPC setup not related to Agent Gateways.