Claude skills and agent skills

valITinoSkill

api-security

valITino/blhackbox/.claude/skills/api-security/SKILL.md

API security testing covering OWASP API Top 10 with active exploitation. Use when the user wants to test REST APIs, GraphQL endpoints, or API security.

Often used withbinary-diff·pentest-tools·llm-security

vredinSkill

security-scan

vredin/vredin-CC-Harness/.claude/skills/security-scan/SKILL.md

Source-to-sink taint analysis with adversarial mindset for finding real, exploitable vulnerabilities — not theoretical ones. Use before production deploys, when editing auth/session/payment/permission/upload/middleware code, on-demand security audits, or CI/CD pre-merge checks. Pairs with Rex agent for Red/Blue team execution.

Often used withdjango-security·deployment-patterns·postgres-patterns

codeaholicguySkill

security-review

codeaholicguy/ai-devkit/skills/security-review/SKILL.md

AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

enunoSkill

unifi-security

enuno/unifi-mcp-server/skills/unifi-security/SKILL.md

UniFi security operations: traditional firewall rules, firewall groups, zone-based firewall (ZBF), ACL rules, port forwarding, VPN tunnels, site-to-site VPN, and content filtering. Use when the task involves network access control, firewall policies, traffic blocking, or VPN configuration. Zone-based firewall requires UniFi Network 9.0+ and local API mode.

vince-winkintelSkill

glab-security

vince-winkintel/gitlab-cli-skills/glab-security/SKILL.md

Configure GitLab project security scan profiles with glab. Use when enabling or disabling SAST, dependency scanning, secret detection, dependency-scanning auto-remediation, business_logic, skillguard, triage_and_remediation presets, or custom profile IDs; or checking scan-type status, including container_scanning. Triggers on GitLab security config, security scan profile, enable SAST, dependency scanning, secret detection, container scanning status, business logic, SkillGuard, triage and remediation, glab security.

stellaSkill

security-audit

stella/stella/.agents/skills/security-audit/SKILL.md

Audit Stella code, paths, or Git diffs for security defects affecting privileged legal data, tenant isolation, authentication, files, AI, and auditability. Use for security reviews; keep audits read-only unless remediation is explicitly requested.

Often used withcreate-stories·community-led-growth·story-done

openreviewSkill

security-audit

openreview/openreview-py/.github/skills/security-audit/SKILL.md

Perform a targeted privacy and integrity audit of an openreview-py stage, process function, builder, journal flow or helper, tracing the readers, signatures, emails and edges it produces for every venue setting and reproducing findings with an integration test. Use when asked to audit security, check who can see a note or an identity, verify anonymity, review conflict detection or assignment visibility, assess a workflow stage end to end, or when the request mentions threat model, data leak, deanonymization or attack surface for any part of this codebase. For reviewing a pull request diff rather than auditing a whole feature, use the code-review skill instead.

Often used withcreate-stories·community-led-growth·story-done

redpanda-dataSkill

rpk-security

redpanda-data/skills/skills/rpk-security/SKILL.md

Manage Redpanda authentication and authorization from the CLI using the `rpk security` command group (`user`, `acl`, `role`, `secret` subcommands; `rpk acl` is a deprecated alias). Use when creating or deleting SASL/SCRAM users, granting or revoking Kafka ACLs on topics, groups, the cluster, or transactional IDs, creating or assigning RBAC roles (Enterprise), managing secrets for Redpanda Cloud clusters, or configuring SASL/PLAIN, OAUTHBEARER/OIDC, GSSAPI/Kerberos, or mTLS principal mapping. Also covers Enterprise security config keys like Audit Logging, GBAC, Schema ID Validation, and FIPS mode, plus bootstrapping a new cluster with a superuser. For Schema Registry-specific ACL patterns, see /redpanda:rpk-registry; for the Enterprise license itself, see /redpanda:rpk-cluster.

YepAPISkill

api-security

YepAPI/skills/skills/api-security/SKILL.md

API security — strict CORS, rate limiting, payload limits, key rotation.

Often used withbinary-diff·pentest-tools·llm-security

zhaoxuya520Skill

database-security

zhaoxuya520/reverse-skill/skills/database-security/SKILL.md

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

zhaoxuya520Skill

hardware-security

zhaoxuya520/reverse-skill/skills/hardware-security/SKILL.md

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

colinhacksSkill

security-advisory

colinhacks/zod/.claude/skills/security-advisory/SKILL.md

Triage a draft security advisory in colinhacks/zod — a private vulnerability report from the Security tab, named by GHSA id (GHSA-xxxx-xxxx-xxxx) or reached from "the draft advisories", "the security reports", "the vulnerability queue". Use instead of the `triage` skill whenever the ticket is an advisory rather than a public issue or PR, because the workflow is different: the report is private, the burden of proof is on the reporter, the fix must be LANDED before any comment is drafted, and the publish-or-decline call has its own calculus. Covers reproducing a PoC against main, the schema-vs-input test, deduplicating a cluster of reports into distinct defects, landing the fix first, the publish-vs-decline framework, per-reporter privacy rules that make a GHSA id unlinkable, and the results.md format under .triage/advisories/GHSA-xxxx-xxxx-xxxx/.

wpultimatesecuritySkill

ajax-security

wpultimatesecurity/WordPress-Security-Skills/skills/ajax-security/SKILL.md

Use when registering or handling WordPress AJAX over admin-ajax.php - wp_ajax_{action} / wp_ajax_nopriv_{action} hooks, JavaScript that posts to admin_url('admin-ajax.php'), or wp.apiFetch / fetch calls to custom actions. Verifies the nonce with check_ajax_referer, gates the action with current_user_can, unslashes and sanitizes every field, and replies with wp_send_json_success / wp_send_json_error. Prevents CSRF, broken access control, and injection on the AJAX surface.

bseneSkill

security-scan

bsene/skills/security-scan/SKILL.md

Security review of a repo or diff using Trivy (vulnerabilities, secrets, misconfigurations, licenses) and ggshield (GitGuardian secret scanning).

Often used withdjango-security·deployment-patterns·postgres-patterns

zcaceresSkill

security-snyk

zcaceres/skills/skills/security-snyk/SKILL.md

Set up Snyk on a repo. The integration is a GitHub App plus a Snyk-side "import this repo as a project" step, not a checked-in config, so most of the skill is walking the user through the three browser steps (Snyk login → GitHub App install → Add project) and then verifying via the GitHub API that the App actually landed on the right account. Pre-flips "Automatic fix PRs" off so the install doesn't dump a backlog of fix PRs into the repo. Optionally scaffolds a pinned CI workflow that runs `snyk code test` (SAST), which isn't covered by the App's free tier dependency-CVE scanning. User-triggered only — activate when the user invokes `/security-snyk`.

OpenBMBSkill

security-triage

OpenBMB/EdgeClaw/.agents/skills/security-triage/SKILL.md

Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.

SentrySkill

security-review

getsentry/skills/skills/security-review/SKILL.md

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

MicrosoftSkill

security-review

microsoft/power-platform-skills/plugins/power-pages/skills/security-review/SKILL.md

Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report covering source code and dependencies, the live site, browser headers, firewall, authentication, and role-based permissions. Use when the user wants a full security review, a release-readiness check before publishing, a code-and-config check during development, live site monitoring, or asks open-ended questions like "review my site security", "is my site safe to ship", "do a security check", "monitor my site" — even if they do not name the individual checks.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

KimYx0207Skill

code-security

KimYx0207/SkillSemgrep/SKILL.md

Runs Semgrep security scans on the current project to detect vulnerabilities, secrets leakage, and OWASP Top 10 issues. Use when the user asks for security scanning, vulnerability detection, code auditing, secrets checking, or says things like 安全扫描, 代码扫描, 扫漏洞, 安全检查, 漏洞检测, 扫一下安全.

altafinoSkill

kit-security

altafino/FableClaudeMDForOpus/.claude/skills/kit-security/SKILL.md

Security guardrails pack — injection, secrets, path traversal, auth defaults, deserialization, untrusted-content discipline. Use when asked for a security pass or when code touches user input, secrets, or auth.