Claude skills and agent skills

GoogleSkill

google-cloud-scc-remediation

google/skills/skills/cloud/google-cloud-scc-remediation/SKILL.md

Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic Combinations. Use when asked to fix, remediate, or mitigate a Security Command Center finding or address attack paths. Don't use for general IAM policy querying without a Security Command Center finding. For runtime threat detections, this skill provides containment and investigation guidance rather than automated configuration fixes.

zebbernPipes a download into a shellSkill

cloud-penetration-testing

zebbern/claude-code-guide/skills/cloud-penetration-testing/SKILL.md

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

GoogleSkill

gke-basics

google/skills/skills/cloud/gke-basics/SKILL.md

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

FlorianBruniauxSkill

update-threat-db

FlorianBruniaux/claude-code-ultimate-guide/.agents/skills/update-threat-db/SKILL.md

Update the guide's threat intelligence through AgentSec Triage, research new coding-agent and MCP security advisories or researcher IOC lists (malicious repositories, hashes, campaign gists), and synchronize the security feed. Use for threat database refreshes or mise a jour de la base de menaces, not repository security scans or Claude Code release tracking.

No other project uses it yet

modu-aiSkill

moai-ref-secops

modu-ai/moai-adk/.claude/skills/moai-ref-secops/SKILL.md

DevSecOps, container, and API operational defensive security reference: CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection, SAST/DAST integration, container image scanning, Kubernetes RBAC hardening, container-escape defense, runtime threat detection, OWASP API Top 10 operational defense, WAF rule tuning, and GraphQL/REST depth and rate limiting. Agent-extending skill that amplifies backend, security, and platform-engineering work with production-grade defensive patterns for pipelines, containers, and running APIs. NOT for: offensive techniques (exploit execution, container-escape attack steps, privilege-escalation procedures, attack tooling), dev-time web-app OWASP Top 10 (see moai-ref-owasp-checklist), LLM/AI security (see moai-ref-llm-security), supply-chain provenance and signing (see moai-ref-supply-chain), or general API design (see moai-ref-api-patterns).

AWSSkill

launching-ec2-instance-with-best-practices

aws/agent-toolkit-for-aws/skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices/SKILL.md

Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization.

GoogleSkill

gke-productionize

google/skills/skills/cloud/gke-productionize/SKILL.md

Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).

zebbernSkill

code-vuln-audit

zebbern/claude-code-guide/skills/code-vuln-audit/SKILL.md

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

No other project uses it yet

patriksimekSkill

maintainer

patriksimek/vm2/.claude/skills/maintainer/SKILL.md

The vm2 security-advisory maintainer role. Defines authority, scope, the triage/dedup/credit process, and the reporter correspondence loop for GitHub Security Advisories on the repo. Use when asked to "triage advisories", "work the security queue", "check for duplicates", "take the next vulnerability", "who reported X", or at the start of any session that touches the advisory queue. Delegates the actual patching to /fix-vulnerability and the landing to /merge-fix — this skill governs everything around them.

usestrixSkill

owasp-top-10-testing

usestrix/strix/skills/owasp-top-10-testing/SKILL.md

Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.

catlog22Skill

security-audit

catlog22/Claude-Code-Workflow/.claude/skills/security-audit/SKILL.md

OWASP Top 10 and STRIDE security auditing with supply chain analysis. Triggers on "security audit", "security scan", "cso".

Often used withcreate-stories·community-led-growth·story-done

MicrosoftSkill

azure-compliance

microsoft/skills/.github/plugins/azure-skills/skills/azure-compliance/SKILL.md

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

MicrosoftSkill

azure-security-keyvault-secrets-java

microsoft/skills/.github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md

Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.

TA-LibSkill

sec-check

TA-Lib/ta-lib/.claude/skills/sec-check/SKILL.md

On-demand semantic security review of one PR before merge — reads the diff and judges intent, rather than just pattern-matching. Blocks and asks for human review on any suspicion instead of trying to resolve it. Use when asked to security-check, vet, or judge whether a PR is safe to merge. Triggers on "sec-check", "security check this PR", "vet this PR", "is this PR safe to merge".

MicrosoftSkill

azure-security-keyvault-keys-java

microsoft/skills/.github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md

Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.

JeffallanSkill

code-reviewer

Jeffallan/claude-skills/skills/code-reviewer/SKILL.md

Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.

Often used withgit-doc-updater·git-precommit·memory-updater

colinhacksSkill

triage

colinhacks/zod/.claude/skills/triage/SKILL.md

Investigate a GitHub issue or pull request in colinhacks/zod and write up a durable verdict. Use whenever asked to triage, investigate, review, evaluate, or form an opinion on an issue or PR (by number, URL, or "the open PR queue"), and when sweeping many of them in bulk. For a draft SECURITY ADVISORY (a GHSA id, the Security tab, a private vulnerability report) use the `security-advisory` skill instead — it shares this file's conventions but its workflow lands the fix before drafting any comment. Covers where write-ups live on disk (.triage/issues/NNNN/, .triage/prs/NNNN/), the cheap-disqualifier pass that avoids spinning up a worktree for stale PRs, the worktree checkout procedure for PRs, the results.md format that keeps a 250-PR sweep greppable and resumable, how to report back in chat — the final message is all the user sees, so it leads with a code block showing the problem and a short outline of the fix — and the maintainer-voice comment it drafts whenever the verdict is to close.

Often used withwriting-beats·setup-matt-pocock-skills·setup-ts-deep-modules

yaojingangSkill

yao-doctor-skill

yaojingang/yao-open-skills/skills/yao-doctor-skill/SKILL.md

Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report. Use when Codex needs to security-review one skill or a full skill library before install, enablement, or execution. Do not use for generic cleanup, usage estimation, or app-level security review outside skill packages.

GitHubReads credentialsSkill

github-actions-hardening

github/awesome-copilot/skills/github-actions-hardening/SKILL.md

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN permissions". Covers script injection via ${{ }} interpolation, pull_request_target / workflow_run privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUB_ENV/GITHUB_OUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.

GoogleSkill

sign-in-with-google-web

google/skills/skills/identity/sign-in-with-google-web/SKILL.md

Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS / `https://accounts.google.com/gsi/client`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React/Next.js/Angular/HTML, verifying ID tokens on backend runtimes (Python/Node.js/Go/Java), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https://accounts.google.com/gsi/intermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android/iOS native Credential Manager.

No other project uses it yet