Audit and harden a Linux VM (Ubuntu/Debian) over SSH — key-only login as one admin user, no root, fail2ban, ufw, unattended security upgrades, sysctl, journald cap, SSH login alerts — plus a read-only check for signs of compromise (login history, root logins, unknown IPs, shell history, cron/systemd persistence, odd processes, setuid files, modified package files, Docker exposure). Triggers — "secure my server", "harden this VM", "lock down ssh", "check my server for suspicious files", "was my server hacked", "audit this VM", "fail2ban and ufw on".
Use when a security report arrives or needs a reply - a new Bugbop report (VDP or private bug bounty), a GitHub security advisory submission in the "triage" state on fleetdm/fleet, a disclosure in the security inbox, a reporter asking "any update?", or a fix merging for a tracked report. Also use for the daily security report triage ritual.
Steady8 mentions in 2 weeks
24 projects use a version of this
7.2k6d agoReviewMountCreate a free account to mount
Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.
1.2k4mo agoReviewMountCreate a free account to mount
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
Hardens a WordPress build and scans it for vulnerabilities (stage `security`). Applies a hardening checklist via WP-CLI / wp-config (disable file editing, force SSL admin, security headers, limit login attempts, regenerate strong salts, file-permission guidance, hide version, disable XML-RPC if unused, least-privilege users) and runs a vulnerability scan of core/plugins/themes (wp core/plugin/theme check-update plus WPScan/Patchstack known-vuln lookup) and a secrets scan of the theme. Reports findings by severity. Use when hardening WordPress, applying security headers, scanning for vulnerable plugins/themes or leaked secrets, or when the pipeline reaches the `security` stage. Reuses the repo security-scan skill where available. Reads plugins, theme, project; writes security.{hardeningApplied,vulnScan}.
Test authorized REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, input validation, and rate-limiting flaws. Use for API security assessments and JWT/OAuth testing.
Assess authorized LLM applications and AI agents for prompt injection, tool misuse, memory poisoning, and model supply-chain weaknesses. Use for AI application security testing and agent threat analysis.
Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries, classify severity, or add regression tests for security-sensitive analyzer behavior.
94420d agoReviewMountCreate a free account to mount
Verify that code changes do not introduce OAuth security vulnerabilities. Use when modifying token handling, client authentication, scope validation, redirect URI checks, secret comparison, or grant flows in Doorkeeper.
End-to-end process for handling a Rack security report (GitHub Security Advisory) from receipt to backported release. Use when asked to triage, review, accept, describe, fix, merge, or backport a security advisory, or to review a review document for one.
5.1k17d agoReviewMountCreate a free account to mount
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
Work the security architecture in the existing model - classify data, mark exposure and trust zones, find unguarded paths from the public internet, propose threat assessments for trust-boundary crossings, anchor high-rated systems to a control framework (NIST SP 800-53, SP 800-207, CSF), and check SBOMs against security standards. Use for security architecture reviews, threat modelling, attack-surface or "what could an attacker reach" questions, data classification, zero-trust or control-coverage questions, and SEC001-SEC003 or ALN009 findings.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
ghalexPipes a download into a shellSkill
