Work the security architecture in the existing model - classify data, mark exposure and trust zones, find unguarded paths from the public internet, propose threat assessments for trust-boundary crossings, anchor high-rated systems to a control framework (NIST SP 800-53, SP 800-207, CSF), and check SBOMs against security standards. Use for security architecture reviews, threat modelling, attack-surface or "what could an attacker reach" questions, data classification, zero-trust or control-coverage questions, and SEC001-SEC003 or ALN009 findings.
Security for AI-powered software — LLM applications, agents, tool calling, RAG, MCP servers and AI-assisted coding. Covers prompt injection (direct and indirect), excessive agency, output handling, data leakage, vector-store tenant isolation, AI-provider key theft and spend abuse, supply chain for models, plugins and skills, and testing and monitoring of AI features. Use when the user says "prompt injection", "jailbreak", "secure my chatbot", "LLM security", "AI agent security", "MCP security", "tool calling safe", "RAG security", "OWASP LLM", "system prompt leak", "AI API key leaked", "unexpected OpenAI bill", "unexpected Anthropic bill", "agent permissions", "can the agent be tricked", "AI inference provider attack" or "is it safe to give the agent shell access"; when a project calls an LLM API, defines tools or agents, runs an MCP server, or loads third-party skills or plugins; and as a pass in any audit of an AI feature. Defensive security only. By Devleck.
Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).
8085mo agoReviewMountCreate a free account to mount
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.
Audits Rails application security against OWASP Top 10, detects vulnerabilities with Brakeman, and verifies Pundit authorization policies. Use when the user wants a security audit, vulnerability scan, or when user mentions security, OWASP, Brakeman, XSS, SQL injection, or authorization. WHEN NOT: Implementing security fixes (use specialist agents), setting up authentication (use authentication-flow), or writing Pundit policies (use policy-agent).
Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).
Run a deep security audit of Argos — or of one area of it — that ends in verified findings, a fix with a guard test for each contained one, and a private report of the rest. Covers GraphQL and REST authorization, multi-tenant isolation, authentication (sessions, SAML, SCIM, OAuth, passkeys, CLI login, CI tokens), webhooks and outgoing requests, uploads and deployments, and client-side redirects and XSS. Use whenever someone asks for a security audit, pentest, vulnerability hunt or threat-model review, asks to "find security holes" or "check for breaches", wants to know whether tenants or roles are properly isolated, or asks to review an area (SAML, the REST API, webhooks…) for vulnerabilities. For a review of only the pending diff on a branch, the lighter built-in security review fits better.
Comprehensive Magento 2 security scanning skill that checks for vulnerabilities, misconfigurations, outdated dependencies, security patches, and compliance with security best practices.
Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing. Use when mobile OS or device behavior is central.
3.7k51d agoReviewMountCreate a free account to mount
Analyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
dithiothreitolSkill
