Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
midudevReads credentialsSkillmidudev/preguntas-entrevista-react/.agents/skills/best-practices/SKILL.md
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
PurpleAILABSkillPurpleAILAB/Decepticon/skills/decepticon/SKILL.md
Operate the Decepticon security platform through its CLI when the user asks to set up, diagnose, run, resume, or inspect a Decepticon engagement or local Blue Cell. Use for Decepticon operations, not general security advice or standalone scanner commands.
OpenAISkillopenai/plugins/plugins/codex-security/skills/validation/SKILL.md
Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
14 projects use a version of this
OpenAISkillopenai/codex-security/plugins/codex-security/skills/triage-finding/SKILL.md
Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.
Steady6 mentions in 2 weeks
2 projects use a version of this
OpenAISkillopenai/codex-security/plugins/codex-security/skills/vulnerability-writeup/SKILL.md
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained vulnerability reports with clearly supported claims. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.
Steady6 mentions in 2 weeks
1 project uses a version of this
OpenAISkillopenai/codex-security/plugins/codex-security/skills/finding-discovery/SKILL.md
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Steady6 mentions in 2 weeks
1 project uses a version of this
Arize-aiPipes a download into a shellSkillArize-ai/phoenix/.agents/skills/daytona/SKILL.md
Creates and manages isolated cloud sandboxes (secure code execution environments with dedicated runtimes) on the Daytona platform. Use when a task needs an isolated runtime, sandbox, secure compute, or Daytona SDK/API/CLI operations. Covers Python, TypeScript, Java, Go, and Ruby SDKs.
Surging12 mentions in 2 weeks
3 projects use a version of this
BehiSeccReads credentialsSkillBehiSecc/VibeSec-Skill/SKILL.md
This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.
SentrySkillgetsentry/skills/skills/find-bugs/SKILL.md
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
14 projects use a version of this
OpenAISkillopenai/plugins/plugins/codex-security/skills/triage-finding/SKILL.md
Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.
2 projects use a version of this
OpenAISkillopenai/codex-security/plugins/codex-security/skills/attack-path-analysis/SKILL.md
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/verify-fix/SKILL.md
Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.
Steady6 mentions in 2 weeks
4 projects use a version of this
roboflowSkillroboflow/inference/.claude/skills/review-topic-input-boundary-security/SKILL.md
Load when a PR touches SSRF/URL-fetch guards (`_ensure_url_input_allowed`, `_ensure_resource_fqdn_allowed`, `WHITELISTED_DESTINATIONS_FOR_URL_INPUT`/`BLACKLISTED_DESTINATIONS_FOR_URL_INPUT`), local-file image loads (`ALLOW_LOADING_IMAGES_FROM_LOCAL_FILESYSTEM`), model-cache paths from a `model_id` (`cache_path_is_within_root`, `MODEL_CACHE_DIR`), unsafe deserialization (`pickle.loads`, `torch.load`, `weights_only`, `allow_untrusted_packages`), or archive extraction (`tarfile.extractall`, `ZipFile`).
No other project uses it yet
GitHubSkillgithub/awesome-copilot/skills/postgresql-code-review/SKILL.md
PostgreSQL-specific code review assistant focusing on PostgreSQL best practices, anti-patterns, and unique quality standards. Covers JSONB operations, array usage, custom types, schema design, function optimization, and PostgreSQL-exclusive security features like Row Level Security (RLS).
3 projects use a version of this
OpenAISkillopenai/plugins/plugins/codex-security/skills/finding-discovery/SKILL.md
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAISkillopenai/plugins/plugins/codex-security/skills/vulnerability-writeup/SKILL.md
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.
1 project uses a version of this
LeanmcpSkillLeanmcp/superview.sh/skills/vuln-repro/SKILL.md
End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for this CVE", "how do I backport this", or "what's the right fix for this bug class" - even when the user never says the word "reproduce". Reach for it on vague asks like "help me understand this security advisory", "I want to write about this incident", or "can we test whether we were vulnerable" when a disclosed vulnerability is in play. This skill only handles ALREADY-PATCHED, publicly disclosed issues and refuses zero-day discovery, live targets, and weaponization.
zebbernSkillzebbern/claude-code-guide/skills/pentest-checklist/SKILL.md
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
apereoSkillapereo/cas/.claude/skills/cas-actuators/SKILL.md
Review and change CAS actuator endpoints: the security filter chain, access levels and IP access, REST actuator endpoints, exposure vs access, unmasked responses, request-path regexes, auditing and the actuator scenarios. Use when touching actuator endpoints or management security.
spinabotSkillspinabot/brigade/skills/healthcheck/SKILL.md
Host security hardening and risk-tolerance configuration for Brigade deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Brigade cron scheduling for periodic checks, or version status checks on a machine running Brigade (laptop, workstation, Pi, VPS).
Often used withtaskflow-inbox-triagenode-connectdiscord-e2e
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
