Claude skills and agent skills

z91772524-aiSkill

llm-security

z91772524-ai/pojia-next-mac/skills/llm-security/SKILL.md

LLM/agent security testing: prompt injection, tool abuse, data exfil paths, guardrail bypass research, and evaluation harnesses.

Often used withattack-chain·pentest-tools·binary-diff

chaenmasahiro0425Reads credentialsSkill

security-scan

chaenmasahiro0425/claude-security-scan/SKILL.md

開発者のPC・手元のgitリポジトリ・GitHub・Vercelと公開サイト・クラウド（AWS / Google Cloud / Azure / Cloudflare / Supabase）・Gmailを読み取り専用で横断スキャンし、重要度別のHTMLレポートと前回からの差分を出すスキル。「セキュリティチェックして」「セキュリティスキャン」「脆弱性ないか見て」「APIキー漏れてない？」「乗っ取られてないか確認」「新しく出たリスクだけ教えて」「毎週スキャンを設定して」等で使う。設定の変更・送信・削除はしない。直すときは1件ずつ利用者の承認を取る。

Often used withdjango-security·deployment-patterns·postgres-patterns

PydanticSkill

review-security

pydantic/monty/.agents/skills/review-security/SKILL.md

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses. Use when reviewing changes for security risk, or before merging anything touching the heap/ module, path_security.rs, the wire protocol or the pool.

Often used withreview-bugbot·split-to-prs·create-rule

xrplevmSkill

security-audit

xrplevm/node/.claude/skills/security-audit/SKILL.md

Run a full security audit across all focus areas in parallel, reporting findings to peersyst/security

Often used withcreate-stories·community-led-growth·story-done

xrplevmSkill

security-issue

xrplevm/node/.claude/skills/security-issue/SKILL.md

Create a security finding in the private peersyst/security repo with proper labels and format. Use when reporting a security vulnerability, concern, or observation found during audits or ad-hoc review.

ghalexPipes a download into a shellSkill

vm-security

ghalex/skills/vm-security/SKILL.md

Audit and harden a Linux VM (Ubuntu/Debian) over SSH — key-only login as one admin user, no root, fail2ban, ufw, unattended security upgrades, sysctl, journald cap, SSH login alerts — plus a read-only check for signs of compromise (login history, root logins, unknown IPs, shell history, cron/systemd persistence, odd processes, setuid files, modified package files, Docker exposure). Triggers — "secure my server", "harden this VM", "lock down ssh", "check my server for suspicious files", "was my server hacked", "audit this VM", "fail2ban and ufw on".

KbWenSkill

auth-security

KbWen/agentic-os/.agents/skills/auth-security/SKILL.md

Secure authentication and authorization when credentials, sessions, roles, or permissions change.

engineering-osSkill

eos-security

engineering-os/engineering-os/.agents/skills/eos-security/SKILL.md

Run adversarial Engineering OS security scanning, auditing, dependency checks, threat modeling, or compliance checks.

muyenSkill

security-scan

muyen/vibe-to-prod/.claude/skills/security-scan/SKILL.md

Proactive security scanning. Triggers when modifying auth, API endpoints, user data, or sensitive operations.

Often used withdjango-security·deployment-patterns·postgres-patterns

joe-bellSkill

security-review

joe-bell/cva/.agents/skills/security-review/SKILL.md

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

bienhoangSkill

wp-security

bienhoang/wp-pro-max/skills/wp-security/SKILL.md

Hardens a WordPress build and scans it for vulnerabilities (stage `security`). Applies a hardening checklist via WP-CLI / wp-config (disable file editing, force SSL admin, security headers, limit login attempts, regenerate strong salts, file-permission guidance, hide version, disable XML-RPC if unused, least-privilege users) and runs a vulnerability scan of core/plugins/themes (wp core/plugin/theme check-update plus WPScan/Patchstack known-vuln lookup) and a secrets scan of the theme. Reports findings by severity. Use when hardening WordPress, applying security headers, scanning for vulnerable plugins/themes or leaked secrets, or when the pipeline reaches the `security` stage. Reuses the repo security-scan skill where available. Reads plugins, theme, project; writes security.{hardeningApplied,vulnScan}.

romangalaxys10-specSkill

qa-security

romangalaxys10-spec/fable/skills/qa-security/SKILL.md

name: qa-security title: Automated Security Testing & OWASP Hardening category: Security author: Principal QA Architect & Systems Staff Engineer --- # qa-security — Security Testing & OWASP Hardening Scans for security vulnerabilities including OWASP

thejordanleopoldSkill

ai-security

thejordanleopold/claude-code-skills-distilled/ai-security/SKILL.md

Use when auditing AI/LLM systems for security vulnerabilities, reviewing prompt injection risks, auditing MCP server tool integrations, assessing AI agent behavioral drift, reviewing credential scoping for agents, or designing safe agentic systems. Triggers: \"AI security\", \"LLM security\", \"prompt injection\", \"tool abuse\", \"MCP security\", \"agent security\", \"behavioral drift\", \"AI agent audit\", \"insecure plugin\", \"agentic threat\", \"LLM threat\", \"indirect injection\", \"credential exposure\", \"excessive agency\".

SentrySkill

security-model

getsentry/skills/skills/security-model/SKILL.md

Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.

2233adminSkill

api-security

2233admin/reverse-skill-evolver/skills/api-security/SKILL.md

Test authorized REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, input validation, and rate-limiting flaws. Use for API security assessments and JWT/OAuth testing.

Often used withattack-chain·llm-security·pentest-tools

2233adminDeletes or force-pushesSkill

llm-security

2233admin/reverse-skill-evolver/skills/llm-security/SKILL.md

Assess authorized LLM applications and AI agents for prompt injection, tool misuse, memory poisoning, and model supply-chain weaknesses. Use for AI application security testing and agent threat analysis.

Often used withattack-chain·pentest-tools·binary-diff

doorkeeper-gemSkill

security-review

doorkeeper-gem/doorkeeper/.agents/skills/security-review/SKILL.md

Verify that code changes do not introduce OAuth security vulnerabilities. Use when modifying token handling, client authentication, scope validation, redirect URI checks, secret comparison, or grant flows in Doorkeeper.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

laolaoshirenSkill

security-audit

laolaoshiren/claude-code-skills-zh/skills/security-audit/SKILL.md

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

Often used withcreate-stories·community-led-growth·story-done

duriantacoSkill

skylos-security

duriantaco/skylos/.agents/skills/skylos-security/SKILL.md

Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries, classify severity, or add regression tests for security-sensitive analyzer behavior.

5throckReads credentialsSkill

security-scan

5throck/ai-workspace-standards/.agents/skills/security-scan/SKILL.md

Runs static analysis, secret detection (via gitleaks), and dependency vulnerability auditing (via bun audit) across the workspace.

Often used withdjango-security·deployment-patterns·postgres-patterns