Claude skills and agent skills

appsec-foundrySkill

security-score

appsec-foundry/appsec-advisor/skills/security-score/SKILL.md

Deterministic quick Security Score (0-100) for a repository, computed from the scanner layer alone — no agents, no LLM, no threat model, nothing written into the target repository. Reports the score together with how many rules applied, the finding tally, and the weakest control domains. Use for a fast indication or a per-commit trend; it is not a risk rating and does not replace /appsec-advisor:appsec-analyzer.

Hassaan146Skill

senior-security

Hassaan146/claude-skills/senior-security/SKILL.md

Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.

kanfu-pandaSkill

pdlc-security

kanfu-panda/pdlc-skills/skills/pdlc-security/SKILL.md

安全审计——先跑依赖漏洞与密钥扫描工具并记录退出码，再人工审阅鉴权、注入、敏感数据等

SHAdd0WTAkaSkill

security-review

SHAdd0WTAka/Zen-Ai-Pentest/skills/security-review/SKILL.md

Security Review & Audit Skill Workflows für PR-Review, Security-Audit, Log-Analyse, Testing, Compliance. ## PR Security Review ### Automatisierte Checks ```bash # Dependency Scan trivy fs --severity CRITICAL,HIGH --exit-code

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

JeffallanSkill

security-reviewer

Jeffallan/claude-skills/skills/security-reviewer/SKILL.md

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

MicrosoftSkill

ghaw-pr-security

microsoft/intelligent-terminal/.github/skills/ghaw-pr-security/SKILL.md

Review Intelligent Terminal pull requests for C++/WinRT, COM, WTA, ACP, session MCP, hooks, terminal mutation, path, diagnostic, packaging, and GitHub Actions security regressions. Use for evidence-based immutable-diff review and structured HIGH/medium/low findings.

SentrySkill

security-review

getsentry/warden/packages/warden/src/builtin-skills/security-review/SKILL.md

Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

axisroboSkill

arch-security

axisrobo/ea-harness/.agents/skills/arch-security/SKILL.md

Deep-dive security audit of a technical architecture diagram. Focused exclusively on authentication, authorization, credential protection, network boundaries, and data classification. Does NOT score overall quality — produces a prioritized security finding list. Use after arch-validate when you want a security specialist's deep cut.

superagent-aiSkill

authz-security

superagent-ai/skills/skills/authz-security/SKILL.md

Review application source code for broken authorization — IDOR / Broken Object Level Authorization (OWASP API1), Broken Function Level Authorization (API5), mass assignment (API3), multi-tenant isolation gaps, and privilege escalation. Reads routes, controllers, resolvers, and data models offline and reports the missing ownership/role check at file:line with a framework-correct fix. No running app, no credentials, no tools. Trigger when reviewing endpoints/handlers, auditing a PR diff that adds or changes routes, hardening a multi-tenant SaaS, or when the user asks "is this endpoint authorized?", "can a user access another user's data?", "IDOR", "BOLA", or "broken access control".

1398281322-a11ySkill

api-security

1398281322-a11y/java-backend-guardrails/skills/java-backend-guardrails/api-security/SKILL.md

Use when hardening APIs: HTTPS, HMAC 签名, timestamp+nonce 防重放, CORS, 脱敏, JWT none 算法, 密钥不进 URL. For SQL injection and resource 越权 WHERE, use backend-safe-check.

Often used withbinary-diff·pentest-tools·llm-security

alex-voloshin-devSkill

security-scan

alex-voloshin-dev/ai-skills/.agents/skills/security-scan/SKILL.md

Security scan workflow — dependency audit, OWASP checklist, secrets scan, vulnerability report. Applies software-engineer role with security focus. Use standalone or as part of code review.

Often used withdjango-security·deployment-patterns·postgres-patterns

CodeWithBehnamSkill

security-scan

CodeWithBehnam/cc-docs/skills/security-scan/SKILL.md

Scan the codebase for security vulnerabilities based on the OWASP Top 10. Use when the user asks to audit security, find vulnerabilities, check for security issues, or says "security scan", "audit this", "find security bugs".

Often used withdjango-security·deployment-patterns·postgres-patterns

DorianGalloSkill

api-security

DorianGallo/reverse-skill/skills/api-security/SKILL.md

# API 安全测试 > 覆盖 REST / GraphQL / WebSocket / SOAP 全协议 > 10 阶段方法论，从发现到 CI/CD 集成 ## 适用场景

Often used withpentest-tools·llm-security

DorianGalloSkill

llm-security

DorianGallo/reverse-skill/skills/llm-security/SKILL.md

# LLM / AI 安全测试 > 覆盖 OWASP LLM Top 10 v2.0 + OWASP Agentic AI Top 10

Often used withpentest-tools

ffsshhttiikkSkill

app-security

ffsshhttiikk/opencode-agents-skills/app-security/SKILL.md

Expert-level knowledge and advanced techniques for App Security

INERATESkill

security-law

INERATE/atelier/skills/security-law/SKILL.md

The Atelier Security Law — OWASP-grade defense for every request path (injection, XSS, CSRF, tenant isolation, rate limiting, transport). Load before writing ANY endpoint, form, or data-processing code — not just auth. Auth token/session mechanics live in [[auth-law]]; this is everything else.

juninmdSkill

security-ops

juninmd/skills/.agents/skills/security-ops/SKILL.md

Audit dependencies, code, secrets, privacy, and access. Use for CVE scans, registry publication age and provenance, vulnerability audits, pen tests, Gitleaks, least privilege, threat modeling, LGPD/GDPR, and plugin/MCP vetting (prompt injection, unpinned npx). Trigger on 'is this secure', 'run a security audit', 'we leaked a key', 'are we LGPD compliant', 'can I trust this plugin'.

JustineDevsSkill

llm-security

JustineDevs/premortem/.cursor/skills/llm-security/SKILL.md

LLM and AI agent security testing for prompt injection, RAG poisoning, MCP injection, and guardrail evaluation. Authorization required.

Often used withattack-chain·pentest-tools·binary-diff

kenhuangusSkill

security-scan

kenhuangus/defense-factory-skills/skills/security-scan/SKILL.md

Runs authorized defensive discovery across inventoried assets and writes finding candidates for the Defense Factory Discovery phase. Use for baseline or periodic scans, not for unauthorized offensive testing.

Often used withdjango-security·deployment-patterns·postgres-patterns

Rootx202Skill

api-security

Rootx202/appsec-skills/api-security/SKILL.md

Focused API security auditor for REST, GraphQL, and webhook endpoints in any stack. Use when the user is building or reviewing an API layer, mentions rate limiting, API keys, webhooks, CORS, or specifically wants "API security" checked — as opposed to a full-project audit.

Often used withbinary-diff·pentest-tools·llm-security