Claude skills and agent skills

SupabaseSkill

pg-security-release-analysis

supabase/postgres/.claude/skills/pg-security-release-analysis/SKILL.md

Generate a CVE catalog + Supabase impact analysis for a PostgreSQL security release. Use when reviewing a new upstream PG quarterly security release to decide what to ship and how to communicate. Inputs are the version ranges (e.g. REL_15_14..REL_15_18 + REL_17_6..REL_17_10); output is a draft catalog markdown ready to post on the breaking-change-analysis Linear ticket.

gmh5225Skill

awesome-game-security-overview

gmh5225/awesome-game-security/.claude/skills/overview/SKILL.md

Find, select, classify, or maintain resources in awesome-game-security. Use for repository navigation, category placement, duplicate review, generated descriptions, wiki coverage, or choosing a domain skill.

The-Art-of-HackingSkill

codeguard

The-Art-of-Hacking/h4cker/.github/skills/codeguard/SKILL.md

A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

modu-aiSkill

moai-ref-owasp-checklist

modu-ai/moai-adk/.claude/skills/moai-ref-owasp-checklist/SKILL.md

OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference. Agent-extending skill that amplifies backend-implementation and security-audit workflows with production-grade security patterns. NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy.

Significant-GravitasSkill

process-vulnerability-report

Significant-Gravitas/AutoGPT/.claude/skills/process-vulnerability-report/SKILL.md

Take one reported vulnerability from the triage queue to a published GitHub security advisory — triage, verify, fix, author the advisory body, hand to a maintainer to publish. TRIGGER when the user asks to process a security report, work the advisory backlog, triage a GHSA, or write/publish a security advisory.

ruvnetSkill

claims

ruvnet/claude-flow/.agents/skills/claims/SKILL.md

Claims-based authorization for agents and operations. Grant, revoke, and verify permissions for secure multi-agent coordination. Use when: permission management, access control, secure operations, authorization checks. Skip when: open access, no security requirements, single-agent local work.

ccxtSkill

query-token-audit

ccxt/ccxt/.agents/skills/query-token-audit/SKILL.md

Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.

NeptuneHubReads credentialsSkill

sec-review

NeptuneHub/AudioMuse-AI/.github/skills/sec-review/SKILL.md

Security review of this codebase - reasons about the code like a security researcher, tracing untrusted input from entry point to sink rather than pattern-matching. Scans the whole tree at HEAD for hardcoded secrets (anything beyond the empty defaults config.py declares), then checks what the current change introduces against the head of remote main. Uses the OWASP Top Ten as the primary risk source, reports severity plus confidence in a markdown table, and proposes fixes without ever applying them. Use when asked whether the code is secure, to audit for vulnerabilities, to check for injection, auth, secrets, or dependency risk, or to review a change for security regressions.

samberReads credentialsSkill

golang-continuous-integration

samber/cc-skills-golang/skills/golang-continuous-integration/SKILL.md

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).

Often used withgolang-pkg-go-dev·golang-google-wire·golang-refactoring

TencentSkill

edgeone-clawscan

Tencent/AI-Infra-Guard/skills/edgeone-clawscan/SKILL.md

The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills, scans skills before installation, and performs a full OpenClaw security health check to prevent data leaks and privacy risks. Backed by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). Use when the user asks to start a security health check or security scan for the current OpenClaw environment, such as `开始安全体检`, `做一次安全体检`, `开始安全扫描`, `全面安全检查`, or `检查 OpenClaw 安全`; also use when the user asks to audit a specific skill before installation, review installed skills for supply chain risk, or investigate whether a skill is safe. Do not trigger for general OpenClaw usage, project debugging, environment setup, or normal development requests. Optional cloud mode: set AIG_CLOUD_LOOKUP=off for zero outbound HTTPS; when enabled, only skill_name, source label, and OpenClaw version are sent to A.I.G (never skill bodies, chats, or workspace files).

No other project uses it yet

GitHubSkill

audit-integrity

github/awesome-copilot/skills/audit-integrity/SKILL.md

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

No other project uses it yet

GoogleSkill

api-gateway-backend-security-and-rate-limiting

google/skills/skills/cloud/api-gateway-backend-security-and-rate-limiting/SKILL.md

Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configuring API key or JWT authentication, locking down Cloud Run or Cloud Run functions backends with a gateway service account, reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom domain setup, or LLM model routing.

No other project uses it yet

zebbernSkill

scanning-tools

zebbern/claude-code-guide/skills/scanning-tools/SKILL.md

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.

NVIDIASkill

doca-argus

NVIDIA/skills/skills/doca-argus/SKILL.md

Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-positive flood in Splunk", or "runtime security on a fleet of BlueField-3s". Refuse and route elsewhere for installing DOCA, SIEM-side ingest stanzas, pre-baked detection-rule packs, and metrics observability (DOCA Telemetry). Argus is NVIDIA's currently- promoted runtime-security framework, superseding the older App Shield library; name it first for new runtime-security work.

GoogleSkill

google-cloud-recipe-foundation-builder

google/skills/skills/cloud/google-cloud-recipe-foundation-builder/SKILL.md

Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture. Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation.

medusajsSkill

diagnosing-dependabot-alerts

medusajs/medusa/.claude/skills/diagnosing-dependabot-alerts/SKILL.md

Diagnoses GitHub Dependabot / security alerts in the Medusa monorepo and finds the least-invasive fix. Use when investigating a Dependabot alert, security advisory (GHSA/CVE), vulnerable dependency, "npm audit" finding, or a security update PR. Traces the vulnerable package to the exact affected workspace package(s) under packages/, assesses real impact, and prefers a fix scoped to the affected package over a root package.json / yarn.lock resolutions override (which is a last resort).

No other project uses it yet

GoogleSkill

google-cloud-scc-query

google/skills/skills/cloud/google-cloud-scc-query/SKILL.md

Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google Cloud. Use when retrieving details for a security finding by its name, validating finding scope (e.g., verifying findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or THREAT), or fetching finding details for triage. Don't use to draft remediations, apply patches, or execute configurations.

projenSkill

projen-workflow-security-review

projen/projen/skills/projen-review/projen-workflow-security-review/SKILL.md

projen workflow security reviewer. Use on any projen pull request that changes what projen generates for GitHub Actions (`src/github/**`, `src/release/**`, `src/build/**`, `src/javascript/upgrade-dependencies.ts`, any `GithubWorkflow` / `addJob` / `JobStep` / `JobPermission` usage, `.github/workflows/*.yml` snapshots) or how task steps execute (`exec` vs `execArgs`). Covers expression injection in `run:` and the env-var fix, `pull_request_target` checking out PR code, privileged workflows triggered more widely, widened job permissions, mixed or exposed credentials, long-lived tokens as defaults, and actions not pinned through `ActionRefs`.

No other project uses it yet

modu-aiSkill

moai-ref-supply-chain

modu-ai/moai-adk/.claude/skills/moai-ref-supply-chain/SKILL.md

Software supply-chain defensive security reference: SBOM generation and verification (SPDX / CycloneDX), dependency-confusion defense, malicious-package triage playbook, SLSA provenance levels, Sigstore / cosign signing and verification, package-registry hardening, typosquatting defense, and transitive-dependency auditing. Agent-extending skill that amplifies backend, security, and release-engineering work with production-grade defensive patterns for the software supply chain. NOT for: offensive techniques (dependency-confusion attack execution, malicious package authoring, registry exploitation), LLM/AI-specific security (see moai-ref-llm-security), web-app OWASP Top 10 (see moai-ref-owasp-checklist), or general API design (see moai-ref-api-patterns).

CloudflareSkill

workerd-api-review

cloudflare/workerd/.opencode/skills/workerd-api-review/SKILL.md

Performance optimization, API design & compatibility, security vulnerabilities, and standards spec compliance for workerd code review. Covers tcmalloc-aware perf analysis, compat flags, autogates, web standards adherence, and security patterns. Load this skill when reviewing API changes, performance-sensitive code, security-relevant code, or standards implementations.