Claude skills and agent skills

botdigit-officialSkill

07-security

botdigit-official/agent-blueprint/skills/07-security/SKILL.md

Security Skill **Version:** 1.0.0 **Compatible:** project_skills >= 1.0 **Requires:** discovery, project-context, business-architecture **Outputs:** security.md, security-findings.md --- ## Purpose Review the project's security posture. Security and data integrity come before

codecharmhqSkill

ai-security

codecharmhq/claude-code-skills/ai-security/SKILL.md

Use when hardening AI-powered features against prompt injection, auditing LLM outputs before production use, or designing AI systems with defense-in-depth against model exploitation

ngothanhtungSkill

ck:security

ngothanhtung/claude-code-skills/.claude/skills/ck-security/SKILL.md

STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern.

Quad4-SoftwareSkill

ci-security

Quad4-Software/skills/.agents/skills/ci-security/SKILL.md

This skill guides CI/CD security with ci-security. Use when you are editing GitHub Actions, hardening Dockerfiles, pinning actions to SHAs, or scanning CI files for security flaws.

TaiMaBenJiSkill

ai-security

TaiMaBenJi/taima-skills/SKILL: AI Pentest/SKILL.md

AI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, LLM-assisted attack automation, and AI system reconnaissance. Use when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors. Trigger phrases: AI security, LLM security, prompt injection, jailbreak, model extraction, training data poisoning, adversarial input, AI red team, ML security, RAG poisoning, AI attack.

FmarzochiDeletes or force-pushesSkill

perl-security

Fmarzochi/EGC/skills/general_part2/perl-security/SKILL.md

Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

xu-xiangReads credentialsSkill

security-review

xu-xiang/everything-claude-code-zh/.agents/skills/security-review/SKILL.md

当涉及添加身份验证（Authentication）、处理用户输入、操作机密（Secrets）、创建 API 终端节点或实现支付/敏感功能时，请使用此技能。提供全面的安全检查清单和模式。

Often used withdependency-cve-sweep·agent-sort·brand-discovery

shenjingnanSkill

security-audit

shenjingnan/xiaozhi-client/.agents/skills/security-audit/SKILL.md

安全审计技能，用于检查和修复依赖安全问题

Often used withcreate-stories·community-led-growth·story-done

nahid-sparktalesSkill

auth-security

nahid-sparktales/agent-dispatcher/skills/security/auth-security/SKILL.md

Attack and harden an existing auth surface — session fixation and rotation, token verification, horizontal and vertical privilege escalation, password reset and account recovery, MFA bypass. Use when reviewing login, session, token, reset, invite, impersonation or role-elevation code, when someone reports seeing another user's data or an account takeover, or when auth changes are about to ship. Not for designing the login mechanism or permission model in the first place (authentication, authorization), not for infrastructure IAM, and never run against a system you have not been told you may test.

OpenAEV-PlatformReads credentialsSkill

review-security

OpenAEV-Platform/openaev/.claude/skills/review-security/SKILL.md

Security review checklist for OpenAEV code: RBAC, tenant isolation, data exposure, authentication. Use when reviewing PRs or auditing security of a feature.

Often used withreview-bugbot·split-to-prs·create-rule

fjrevoredoSkill

security-stance

fjrevoredo/mini-diarium/.agents/skills/security-stance/SKILL.md

Mini Diarium's opinionated security, encryption, and privacy stance. Load when touching crypto (crates/mini-diarium-crypto/src/crypto/), auth (crates/mini-diarium-core/src/auth/, commands/auth/), IPC boundaries (src/lib/errors.ts, tauri.ts), auto-lock (screen_lock.rs, App.tsx idle timer), database schema/migrations (db/schema.rs), backups (backup.rs), config.json / JournalConfig, import/export, plugin sandbox (Rhai), search (intentionally stubbed), debug dump, Tauri capabilities (src-tauri/capabilities/) or CSP (tauri.conf.json), E2E isolation env vars, or anything involving passwords, keys, nonces, zeroization, or entry persistence. Also load when reviewing or proposing new features to judge against the six PHILOSOPHY.md principles and five non-negotiables.

ZeroDeng01Skill

security-review

ZeroDeng01/sublinkPro/.agents/skills/security-review/SKILL.md

Security review checklist for authentication, authorization, and sensitive data handling. Use when changing auth, MFA, secrets, input validation, or security-critical features. Not for general code review.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

FaisalAlqarniSkill

security-scan

FaisalAlqarni/sp-ecc/skills/security-scan/SKILL.md

Scan Claude Code configuration for security vulnerabilities using AgentShield. Use before committing config changes or during periodic security checks.

Often used withdjango-security·deployment-patterns·postgres-patterns

jnotsknabPipes a download into a shellSkill

security-scan

jnotsknab/mux-swarm/Skills/bundled/security-scan/SKILL.md

Run real SAST and secret-scanning tools locally (semgrep, bandit, gitleaks, trivy). Use when auditing a codebase for vulnerabilities, exposed secrets, or vulnerable dependencies before shipping or on demand.

Often used withdjango-security·deployment-patterns·postgres-patterns

vredinSkill

security-scan

vredin/vredin-CC-Harness/.claude/skills/security-scan/SKILL.md

Source-to-sink taint analysis with adversarial mindset for finding real, exploitable vulnerabilities — not theoretical ones. Use before production deploys, when editing auth/session/payment/permission/upload/middleware code, on-demand security audits, or CI/CD pre-merge checks. Pairs with Rex agent for Red/Blue team execution.

Often used withdjango-security·deployment-patterns·postgres-patterns

codeaholicguySkill

security-review

codeaholicguy/ai-devkit/skills/security-review/SKILL.md

AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

enunoSkill

unifi-security

enuno/unifi-mcp-server/skills/unifi-security/SKILL.md

UniFi security operations: traditional firewall rules, firewall groups, zone-based firewall (ZBF), ACL rules, port forwarding, VPN tunnels, site-to-site VPN, and content filtering. Use when the task involves network access control, firewall policies, traffic blocking, or VPN configuration. Zone-based firewall requires UniFi Network 9.0+ and local API mode.

hoodiniReads credentialsSkill

owasp-security

hoodini/ai-agents-skills/skills/owasp-security/SKILL.md

Implement secure coding practices following OWASP Top 10. Use when preventing security vulnerabilities, implementing authentication, securing APIs, or conducting security reviews. Triggers on OWASP, security, XSS, SQL injection, CSRF, authentication security, secure coding, vulnerability.

akitaonrailsReads credentialsSkill

security-audit

akitaonrails/my-skills/security-audit/SKILL.md

Threat-model and audit a codebase, commit range, or pull request for exploitable vulnerabilities, prompt and data injection, authentication or authorization bypass, tenant-data exposure, privilege escalation, malicious code/backdoors, unsafe execution, secrets leakage, supply-chain and CI compromise, insecure persistence, and denial of service. Use for dedicated security reviews, release gates, suspicious contributions, or requests to verify that a project protects users and their data.

Often used withcreate-stories·community-led-growth·story-done

vince-winkintelSkill

glab-security

vince-winkintel/gitlab-cli-skills/glab-security/SKILL.md

Configure GitLab project security scan profiles with glab. Use when enabling or disabling SAST, dependency scanning, secret detection, dependency-scanning auto-remediation, business_logic, skillguard, triage_and_remediation presets, or custom profile IDs; or checking scan-type status, including container_scanning. Triggers on GitLab security config, security scan profile, enable SAST, dependency scanning, secret detection, container scanning status, business logic, SkillGuard, triage and remediation, glab security.