Claude skills and agent skills

ccch1mneyyySkill

vuln-check

ccch1mneyyy/dsh-Go/.agents/skills/vuln-check/SKILL.md

Check resolved dependencies and relevant code paths for security vulnerabilities. Use for security checks or /vuln-check; use audit for a broader correctness and maintainability assessment.

MicrosoftSkill

scan-code

microsoft/power-platform-skills/plugins/power-pages/skills/scan-code/SKILL.md

Scans a Power Pages site project for security issues in source code and dependencies. Runs static analysis and dependency scanning, then surfaces findings by category (code patterns, vulnerable packages, secrets, license issues). Use when the user wants to review code for security problems, check for vulnerable packages, find hard-coded secrets, run a code scan, or asks "is my code safe?", "check my dependencies", "find security issues in my source" — even if they say "audit my code" without mentioning specific tools.

No other project uses it yet

OpenAISkill

twilio-security-compliance-hipaa

openai/plugins/plugins/twilio-developer-kit/skills/twilio-security-compliance-hipaa/SKILL.md

Configure Twilio accounts for HIPAA compliance. Covers BAA requirements, HIPAA Project designation (self-service and support), eligible services list, per-product requirements (Voice, SMS, ConversationRelay, Conversation Intelligence, Flex, Verify), message redaction, and what is NOT eligible. Use this skill when developers are building healthcare workflows on Twilio.

JeffallanSkill

fullstack-guardian

Jeffallan/claude-skills/skills/fullstack-guardian/SKILL.md

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.

ccch1mneyyySkill

audit

ccch1mneyyy/dsh-Go/.agents/skills/audit/SKILL.md

Audit the ccch1mneyyy/dsh-Go repository or a broad subsystem for security, correctness, and maintainability risks. Use for audit requests or /audit; use review for a specific change and vuln-check for a security-only assessment.

Often used withdelight·normalize·level-up

MicrosoftSkill

manage-headers

microsoft/power-platform-skills/plugins/power-pages/skills/manage-headers/SKILL.md

Inspects and configures the security headers a Power Pages site sends to browsers — Content Security Policy, frame and clickjacking protection, cross-origin sharing, cookie behavior, and related site settings. Identifies gaps and walks the user through fixes. Use when the user wants to review headers, fix CSP errors, allow embedding in another site, control cross-origin access, harden cookie settings, or asks "are my browser settings safe?", "fix my CSP", "set up CORS" — even if they only mention a specific header name without saying "security headers".

No other project uses it yet

ccch1mneyyySkill

vuln-check

ccch1mneyyy/dsh-TUI/.agents/skills/vuln-check/SKILL.md

Check resolved dependencies and relevant code paths for security vulnerabilities. Use for security checks or /vuln-check; use audit for a broader correctness and maintainability assessment.

No other project uses it yet

ccxtSkill

binance-tokenized-securities-info

ccxt/ccxt/.agents/skills/binance-tokenized-securities-info/SKILL.md

Query Ondo tokenized US stock data on Binance Web3. Covers: supported stock token list, RWA metadata (company info, attestation reports), market and per-asset trading status (with corporate action codes for earnings, dividends, splits), real-time on-chain data (token price, holders, circulating supply, market cap), US stock fundamentals (P/E, dividend yield, 52-week range), and token K-Line/candlestick charts.

MicrosoftSkill

scan-site

microsoft/power-platform-skills/plugins/power-pages/skills/scan-site/SKILL.md

Runs a security scan on a deployed Power Pages site, fetches the latest scan report, and produces a plain-language summary. Scans the live site's public surface for vulnerabilities and surfaces issues by severity. Use when the user wants to scan, check, test, audit, or assess a published site, find vulnerabilities on production, view the latest scan report, see previous scan results, run a security audit, or asks "how safe is my live site?", "is my site vulnerable?", "audit my production site" — even if they say "find issues" or "check for problems" without mentioning "scan" or "security".

No other project uses it yet

prompt-securityDeletes or force-pushesSkill

clawsec-nanoclaw

prompt-security/clawsec/skills/clawsec-nanoclaw/SKILL.md

Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot

MicrosoftSkill

owasp-agentic

microsoft/hve-core/.github/skills/security/owasp-agentic/SKILL.md

OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks.

samberSkill

golang-how-to

samber/cc-skills-golang/skills/golang-how-to/SKILL.md

Golang skills orchestrator — always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most relevant skills from samber/cc-skills-golang, often multiple at once: writing a gRPC service loads golang-grpc + golang-testing + golang-error-handling; debugging a panic loads golang-troubleshooting + golang-safety; auditing security loads golang-security + golang-lint + golang-safety. Also: disambiguates competing clusters when two skills seem to overlap (performance vs benchmark vs troubleshooting, samber/lo vs mo vs ro, DI cluster, safety vs security), and configures the project's agent-config file (CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, or Copilot instructions) to force-trigger skills in a project (/golang-how-to configure).

ccch1mneyyySkill

audit

ccch1mneyyy/dsh-TUI/.agents/skills/audit/SKILL.md

Audit the repository or a broad subsystem for security, correctness, and maintainability risks. Use for audit requests or /audit; use review for a specific change and vuln-check for a security-only assessment.

Often used withdelight·normalize·level-up

MicrosoftSkill

azure-security-keyvault-keys-dotnet

microsoft/skills/.github/plugins/azure-sdk-dotnet/skills/azure-security-keyvault-keys-dotnet/SKILL.md

Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification. Triggers: "Key Vault keys", "KeyClient", "CryptographyClient", "RSA key", "EC key", "encrypt decrypt .NET", "key rotation", "HSM".

OpenAISkill

track-findings

openai/codex-security/plugins/codex-security/skills/track-findings/SKILL.md

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.

tophant-aiSkill

tophant-clawvault-openclaw-alerts

tophant-ai/ClawVault/skills/tophant-clawvault-openclaw-alerts/SKILL.md

Push high-risk ClawVault security events and daily security reports through OpenClaw agent messaging

NomicFoundationSkill

threat-model-audit

NomicFoundation/hardhat/.claude/skills/threat-model-audit/SKILL.md

Analyze a file or folder under Hardhat's threat model and write one SECURITY_ANALYSIS report containing findings and proposed fixes. Use for security reviews and audits, not for implementing fixes.

OpenAISkill

validation

openai/codex-security/plugins/codex-security/skills/validation/SKILL.md

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

track-findings

openai/plugins/plugins/codex-security/skills/track-findings/SKILL.md

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.

sheeki03Pipes a download into a shellSkill

tirith

sheeki03/tirith/SKILL.md

Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with threat intelligence databases. Also use when the user mentions "tirith", "pipe-to-shell", "homograph", "ANSI injection", "zero-width", "punycode", "terminal security", "shell hook", "cloaking detection", "supply chain attack", "bidi override", "invisible unicode", or "config poisoning". Even if the user does not explicitly name tirith, use this skill when they ask about protecting shell environments, intercepting dangerous commands, or hardening AI agent tool execution.