Claude skills and agent skills

nirholasSkill

pump-security

nirholas/pump-fun-sdk/skills/pump-security/SKILL.md

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

dithiothreitolSkill

ea-security

dithiothreitol/ea-skills/skills/ea-security/SKILL.md

Work the security architecture in the existing model - classify data, mark exposure and trust zones, find unguarded paths from the public internet, propose threat assessments for trust-boundary crossings, anchor high-rated systems to a control framework (NIST SP 800-53, SP 800-207, CSF), and check SBOMs against security standards. Use for security architecture reviews, threat modelling, attack-surface or "what could an attacker reach" questions, data classification, zero-trust or control-coverage questions, and SEC001-SEC003 or ALN009 findings.

Kin9ZeusSkill

ai-security

Kin9Zeus/senior-engineer-skills/skills/ai-security/SKILL.md

Security for AI-powered software — LLM applications, agents, tool calling, RAG, MCP servers and AI-assisted coding. Covers prompt injection (direct and indirect), excessive agency, output handling, data leakage, vector-store tenant isolation, AI-provider key theft and spend abuse, supply chain for models, plugins and skills, and testing and monitoring of AI features. Use when the user says "prompt injection", "jailbreak", "secure my chatbot", "LLM security", "AI agent security", "MCP security", "tool calling safe", "RAG security", "OWASP LLM", "system prompt leak", "AI API key leaked", "unexpected OpenAI bill", "unexpected Anthropic bill", "agent permissions", "can the agent be tricked", "AI inference provider attack" or "is it safe to give the agent shell access"; when a project calls an LLM API, defines tools or agents, runs an MCP server, or loads third-party skills or plugins; and as a pass in any audit of an AI feature. Defensive security only. By Devleck.

RustNSparksSkill

security-audit

RustNSparks/sockudo/.agents/skills/security-audit/SKILL.md

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

Often used withcreate-stories·community-led-growth·story-done

gocronx-teamSkill

security-check

gocronx-team/gocron/.agents/skills/security-check/SKILL.md

Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities. Use for security reviews, vulnerability remediation, Dependabot security alerts, release hardening, or suspected exposure.

jim60105Skill

api-security

jim60105/copilot-prompt/skills/api-security/SKILL.md

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

Often used withattack-chain·llm-security·pentest-tools

MicrosoftDocsSkill

azure-security

MicrosoftDocs/Agent-Skills/skills/azure-security/SKILL.md

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

decebalsReads credentialsSkill

security-audit

decebals/claude-code-java/skills/security-audit/SKILL.md

Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.

Often used withcreate-stories·community-led-growth·story-done

PostHogReads credentialsSkill

security-audit

PostHog/posthog-foss/.agents/skills/security-audit/SKILL.md

Threat-model-driven security audit of a change. Build a threat model from the diff, PR, commits, and product purpose, then assess the implementation against each threat. Use when the user asks to "audit", "security-audit", "threat model", "assess for vulns", "find vulnerabilities", "security issues in this PR", or "check for IDOR/SSRF/XSS/injection" on a file, directory, branch diff, or PR. Covers access control, injection, auth/secrets, sensitive data, business logic, web boundary, and AI agent/LLM trifecta risks. Produces severity- and confidence-ranked findings with data flow, exploit request, and fix — no theoretical or defense-in-depth nits. Handles the GitHub review follow-up for a PR target and a reproducer test plus fix for a local branch.

Often used withcreate-stories·community-led-growth·story-done

Ray0907Skill

security-scan

Ray0907/security-scan/SKILL.md

Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.

Often used withdjango-security·deployment-patterns·postgres-patterns

thejefflarsonSkill

ipc-security

thejefflarson/soundcheck/.claude/skills/ipc-security/SKILL.md

Detects IPC receivers that accept input without verifying caller identity. Use

thejefflarsonSkill

mcp-security

thejefflarson/soundcheck/.claude/skills/mcp-security/SKILL.md

Detects MCP tool handlers vulnerable to malicious inputs, hardcoded secrets,

thejefflarsonSkill

rag-security

thejefflarson/soundcheck/.claude/skills/rag-security/SKILL.md

Detects RAG pipelines that ingest external documents into LLM context without

alinaqiSkill

security-audit

alinaqi/maggy/skills/security-audit/SKILL.md

Structured, adversarial, multi-phase security audit of a codebase — recon → coverage-led hunting → finder≠validator validation → machine-readable findings → target-neutral report

Often used withcreate-stories·community-led-growth·story-done

hellowind777Reads credentialsSkill

hello-security

hellowind777/helloagents/skills/hello-security/SKILL.md

涉及认证、密码、token、JWT、OAuth、session、cookie、加密、密钥、API key、权限、角色、用户输入验证、文件上传等安全敏感操作时使用。

ThibautBaissacSkill

security-audit

ThibautBaissac/rails_ai_agents/.agents/skills/security-audit/SKILL.md

Audits Rails application security against OWASP Top 10, detects vulnerabilities with Brakeman, and verifies Pundit authorization policies. Use when the user wants a security audit, vulnerability scan, or when user mentions security, OWASP, Brakeman, XSS, SQL injection, or authorization. WHEN NOT: Implementing security fixes (use specialist agents), setting up authentication (use authentication-flow), or writing Pundit policies (use policy-agent).

Often used withcreate-stories·community-led-growth·story-done

ceptlnSkill

security-fix

ceptln/quota-burner/skills/security-fix/SKILL.md

Use to find and fix one batch of concrete security issues: vulnerable dependencies, injection risks, secrets in code, unsafe patterns.

delorenjSkill

aws-security

delorenj/skills/aws-security/SKILL.md

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

ProxiBlueReads credentialsSkill

security-scan

ProxiBlue/claude-skills/security-scan/SKILL.md

Comprehensive Magento 2 security scanning skill that checks for vulnerabilities, misconfigurations, outdated dependencies, security patches, and compliance with security best practices.

Often used withdjango-security·deployment-patterns·postgres-patterns

gmh5225Skill

mobile-security

gmh5225/awesome-game-security/.claude/skills/mobile-security/SKILL.md

Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing. Use when mobile OS or device behavior is central.