Claude skills and agent skills

GitHubSkill

dependabot

github/awesome-copilot/skills/dependabot/SKILL.md

Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.

usestrixSkill

fix-security-vulnerabilities-with-strix

usestrix/strix/skills/fix-security-vulnerabilities-with-strix/SKILL.md

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.

yaojingangSkill

yao-websecurity-skill

yaojingang/yao-open-skills/skills/yao-websecurity-skill/SKILL.md

Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic review, active validation, or Chinese security reports.

apacheSkill

triaging-security-reports

apache/struts/.claude/skills/triaging-security-reports/SKILL.md

Use when a vulnerability or security report arrives for triage, when assessing a CVE/RCE/OGNL/injection claim against the code, when deciding whether a finding is the framework's fault or the application's, when drafting a reply to a security researcher, or when a claim that is already public (a Full Disclosure post, a blog, a scanner advisory) needs the project's position stated for users and scanner vendors — to research the claim from source without trusting the reporter and without fabricating your own facts.

NVIDIASkill

nemoclaw-maintainer-security-code-review

NVIDIA/NemoClaw/.agents/skills/nemoclaw-maintainer-security-code-review/SKILL.md

Perform a requested security review of a NemoClaw PR or a PR linked to an issue. Use for vulnerability or trust-boundary assessment.

No other project uses it yet

GitHubSkill

security-advisory-compat-enforcer

github/gh-aw/.github/skills/security-advisory-compat-enforcer/SKILL.md

Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.

nekomangaorgSkill

security-cleanup-inspector

nekomangaorg/Neko/.agents/skills/inspector/SKILL.md

Removes app bloat, secures data, and ensures failures are visible. Use this skill to safely eliminate dead code or unused resources, secure vulnerabilities like hardcoded API keys, fix silent exceptions (empty catch blocks), convert heavy assets to WebP, and ensure logs do not contain PII.

MicrosoftSkill

python-kwargs-setattr-security

microsoft/onnxruntime/.github/skills/python-kwargs-setattr-security/SKILL.md

When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access.

zebbernSkill

top-web-vulnerabilities

zebbern/claude-code-guide/skills/top-web-vulnerabilities/SKILL.md

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

hook0Skill

webhook-security-signatures

hook0/hook0/skills/webhook-security-signatures/SKILL.md

Sign outgoing webhooks and verify incoming ones correctly: HMAC-SHA256 signatures, timestamp/replay protection, constant-time comparison, secret rotation, and raw-body handling. Use this when a codebase needs to "verify webhook signature", "validate webhook", "HMAC webhook", "secure webhook endpoint", "prevent replay attacks", "check X-Hook0-Signature / webhook- signature", or harden a receiver against spoofing. Includes ready-to-run verifiers and notes on Standard Webhooks compatibility.

apacheSkill

creating-security-bulletins

apache/struts/.claude/skills/creating-security-bulletins/SKILL.md

Use when drafting, updating, or reviewing an S2-XXX security bulletin on the Struts cwiki, when preparing bulletin text ahead of a CVE request, when filling a CVE record in the ASF CVE tool (cveprocess.apache.org / Vulnogram), when deciding when to publish, when publishing a bulletin and announcing it to the ASF lists, when wrapping up after the advisory mails, or when deciding how much detail about a fixed vulnerability is safe to publish.

gmh5225Skill

game-security-research-rigor

gmh5225/awesome-game-security/.claude/skills/research-rigor/SKILL.md

Verify consequential or disputed game-security claims with primary sources, reproducible evidence, explicit trust boundaries, and calibrated uncertainty. Use alongside a domain skill when evidence quality affects the conclusion.

prompt-securityDeletes or force-pushesSkill

picoclaw-security-guardian

prompt-security/clawsec/skills/picoclaw-security-guardian/SKILL.md

Picoclaw security posture skill with advisory awareness, configuration drift detection, and supply-chain verification guidance.

LUC4N3XSkill

levyra-android-intent-security

LUC4N3X/Levyra-deepsound/.agents/skills/levyra-android-intent-security/SKILL.md

Automatically use for Levyra Android Intent, deep-link, PendingIntent, exported component, receiver, service, provider, URI-grant, FileProvider, caller-verification, or onNewIntent security work. Pair it with levyra-security-review and the affected Android domain skill.

zebbernReads credentialsSkill

secure-code-review

zebbern/claude-code-guide/skills/secure-code-review/SKILL.md

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist.

AWSSkill

pentesting-with-aws-security-agent

aws/agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/pentesting-with-aws-security-agent/SKILL.md

Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtime findings. Use when the user asks to pentest, run a penetration test, test their app's attack surface, find runtime vulnerabilities, register or verify a target domain, or check pentest status / findings.

No other project uses it yet

MicrosoftSkill

codegen-literal-security-scan

microsoft/kiota/.github/skills/codegen-literal-security-scan/SKILL.md

Detect and remediate code-generation literal injection risks in Kiota writer code (wire names, serialization names, URL templates, base URLs, defaults, and path parameter keys).

roboflowSkill

review-topic-secure-gateway-url-wrapping

roboflow/inference/.claude/skills/review-topic-secure-gateway-url-wrapping/SKILL.md

Load when a PR adds or modifies an outbound HTTP call (requests.*, aiohttp, httpx, urllib), constructs a URL from API_BASE_URL / METRICS_COLLECTOR_BASE_URL / HOSTED_*_URL / any *.roboflow.com host, adds an env var or setting that holds an endpoint URL, builds an InferenceHTTPClient, or touches wrap_url / roboflow_secure_gateway_proxy_url_builder / SECURE_GATEWAY handling.

No other project uses it yet

open-gsdSkill

gsd-secure-phase

open-gsd/gsd-core/skills/gsd-secure-phase/SKILL.md

Retroactively verify threat mitigations for a completed phase

rosuHSkill

android-permissions-security

rosuH/EasyWatermark/.agents/skills/android-permissions-security/SKILL.md

Audits, detects gaps, and remediates Android permissions and IPC component