Claude skills and agent skills

gmh5225Skill

mobile-security

gmh5225/awesome-game-security/.claude/skills/mobile-security/SKILL.md

Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing. Use when mobile OS or device behavior is central.

samberSkill

golang-security

samber/cc-skills-golang/skills/golang-security/SKILL.md

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

Often used withgolang-swagger·golang-gopls·golang-google-wire

awarexoneSkill

api-security

awarexone/AXguard/api-security/SKILL.md

Analyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).

Often used withattack-chain·llm-security·pentest-tools

awarexoneSkill

jwt-security

awarexone/AXguard/jwt-security/SKILL.md

Analyze JWT implementation flaws — use when reviewing alg confusion, none algorithm, missing verify, weak secrets, or claim validation gaps (A07:2021 / API2:2023 / auth.jwt rules).

awarexonePipes a download into a shellSkill

mcp-security

awarexone/AXguard/mcp-security/SKILL.md

Review Model Context Protocol servers/clients and tool bridges for trust, supply-chain, and over-privileged tool exposure before ship.

AndreyBegmaReads credentialsSkill

cs-security

AndreyBegma/claude-code-plugin/skills/security/SKILL.md

Scan the project for security vulnerabilities, insecure patterns, exposed secrets, and OWASP Top 10 issues

Hussain-ElfalahSkill

ai-security

Hussain-Elfalah/Agentic-Skills/.cursor/skills/ai-security/SKILL.md

name: ai-security description: Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection

jessefmooreSkill

ai-security

jessefmoore/offensive-claude-code/skills/ai-security/SKILL.md

AI/ML security assessment — prompt injection, jailbreak detection, RAG poisoning, model extraction, adversarial examples, supply chain risks in ML pipelines

bex-coSkill

security-audit

bex-co/bex/.claude/skills/security-audit/SKILL.md

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

Often used withcreate-stories·community-led-growth·story-done

GoldenWing-360Reads credentialsSkill

api-security

GoldenWing-360/claude-security-skills/api-security/SKILL.md

Apply the OWASP API Security Top 10 to REST and GraphQL endpoints. Covers broken object-level authorization (BOLA), mass assignment, excessive data exposure, unrestricted resource consumption, SSRF, broken function-level authorization, and GraphQL depth and complexity limits. Invoke when designing a new API, reviewing one before scaling, or after API abuse (scraping, account takeover).

Often used withattack-chain·llm-security·pentest-tools

GoldenWing-360Skill

ios-security

GoldenWing-360/claude-security-skills/ios-security/SKILL.md

Harden iOS and macOS apps against the platform-specific failure modes. Covers Keychain accessibility tiers, App Transport Security, certificate pinning tradeoffs, file protection classes, biometric authentication, jailbreak detection as a signal rather than a defense, and third-party SDK review. Invoke when shipping a native app that holds credentials, before App Store submission, or after a mobile security advisory.

GoldenWing-360Skill

mcp-security

GoldenWing-360/claude-security-skills/mcp-security/SKILL.md

Audit Model Context Protocol server configurations and apply least-privilege scoping. Covers MCP inventory, capability risk-tiering, secret detection in configuration, malicious or compromised package indicators, and the lifecycle from install through rotation to revocation. Invoke before granting an MCP write access to production, after an MCP security advisory, or as periodic audit.

GoldenWing-360Skill

rag-security

GoldenWing-360/claude-security-skills/rag-security/SKILL.md

Secure the trust boundaries RAG adds beyond a plain LLM app. Covers retrieval-time document authorization, tenant isolation in vector databases, indirect injection via retrieved content, ingestion poisoning, citation and embedding leakage, stale-permission drift, and grounding integrity. Invoke when building or reviewing a RAG feature, when indexing access-controlled or multi-tenant corpora, or after a cross-tenant leak or injection incident.

jiten-singh-shahiSkill

security-scan

jiten-singh-shahi/salesforce-claude-code/.cursor/skills/security-scan/SKILL.md

Use when scanning Salesforce org Claude Code configuration for security vulnerabilities, deploy misconfigurations, and injection risks in CLAUDE.md, hooks, and MCP servers. Do NOT use for Apex code review — use sf-security.

Often used withdjango-security·deployment-patterns·postgres-patterns

opensite-aiSkill

aws-security

opensite-ai/opensite-skills/aws-security/SKILL.md

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

proffesor-for-testingSkill

security-watch

proffesor-for-testing/agentic-qe/.claude/skills/security-watch/SKILL.md

Use when working on security-sensitive code to catch secrets, eval(), innerHTML, and other dangerous patterns before they're written. Activate with /security-watch for real-time security scanning.

woxiangyangzhimaoReads credentialsSkill

security-scan

woxiangyangzhimao/skills/security-scan/SKILL.md

配置安全扫描(手动)— npx ecc-agentshield 扫 .claude/ 配置(settings/MCP/hooks)的注入与权限风险。联网外部工具,仅手动 /security-scan。

Often used withdjango-security·deployment-patterns·postgres-patterns

SentrySkill

security-review

getsentry/sentry-python/.agents/skills/security-review/SKILL.md

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

briiirussellSkill

security-comms

briiirussell/cybersecurity-skills/skills/security-comms/SKILL.md

Translate technical security work into the language of non-security audiences — board, executives, engineering, customer success, customers, legal, procurement, sales. Covers incident communication, post-mortem narrative, audit-findings-for-stakeholders, risk justification, security spend justification, and customer-facing breach disclosure. Use when the user mentions 'security comms,' 'communicate this finding,' 'explain to my boss,' 'board update,' 'executive summary,' 'incident communication,' 'breach notification letter,' 'customer disclosure,' 'security memo,' 'post-mortem narrative,' 'why this matters to the business,' 'translate this finding,' 'stakeholder update,' or has technical security work that needs to land with a non-security audience.

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/servers/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or the SDK underneath, accept or reject, fix it in the private fork, release, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix or belongs to an SDK; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.