Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
OpenAISkillopenai/plugins/plugins/codex-security/skills/attack-path-analysis/SKILL.md
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
2 projects use a version of this
OpenAISkillopenai/plugins/plugins/codex-security/skills/verify-fix/SKILL.md
Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.
4 projects use a version of this
GitHubSkillgithub/awesome-copilot/skills/supabase-rls-policies/SKILL.md
Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user''s rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.
roboflowReads credentialsSkillroboflow/inference/.claude/skills/review-topic-auth-and-tenant-security/SKILL.md
Load when a PR touches `http_api.py` auth middleware (`check_authorization_serverless` / `check_authorization`), `get_serverless_usage_check_async`, api-key→workspace resolution (`get_roboflow_workspace`), assume-identity (`_add_assume_identity_headers`, `x-assume-identity-*`), the unauthenticated-route allowlist, api-key redaction (`api_key_safe_raise_for_status`, `deduct_api_key`), usage api-key hashing, or new `*_SECRET`/`*_TOKEN`/`API_KEY` env vars in `env.py`.
No other project uses it yet
prowler-cloudSkillprowler-cloud/prowler/skills/prowler-sdk-check/SKILL.md
Creates and updates Prowler SDK security checks (implementation, metadata, fixers, configurable checks). Trigger: When creating or updating a Prowler SDK security check or its metadata.json for any provider (AWS, Azure, GCP, Kubernetes, GitHub, M365, etc.), adding a check fixer, or making a check configurable via audit_config.
Steady14 mentions in 2 weeks
No other project uses it yet
the-open-agentSkillthe-open-agent/openagent/skills/healthcheck/SKILL.md
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).
Often used withtaskflow-inbox-triagenode-connectdiscord-e2e
zebbernSkillzebbern/claude-code-guide/skills/api-fuzzing-bug-bounty/SKILL.md
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
1 project uses a version of this
zebbernSkillzebbern/claude-code-guide/skills/aws-penetration-testing/SKILL.md
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
No other project uses it yet
rackSkillrack/rack/.agents/skills/release/SKILL.md
How Rack patch releases are cut from the stable branches, including moving changelog entries out of Unreleased on main, backporting them, bumping versions, tagging, pushing gems, and publishing the matching security advisories. Use when asked to release, cut a patch version, prepare a release changelog, or publish advisories after a security fix.
Often used withcreate-agent-adapterdocumentation-consistency
GoogleDeletes or force-pushesSkillgoogle/mantis/skills/mantis-patch/SKILL.md
Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them. Use when security findings are successfully reproduced and need patches applied and verified. Don't use for initial vulnerability research or reproduction payload generation.
No other project uses it yet
cartography-cncfSkillcartography-cncf/cartography/.agents/skills/create-rule/SKILL.md
Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under `cartography/rules/data/rules/`. Use when the user asks to add a security check, detection, attack-surface query, compliance control, CIS benchmark rule, or cross-cloud detection.
Often used withreview-bugbotupdate-cli-configsplit-to-prs
OpenOSINTSkillOpenOSINT/OpenOSINT/skills/exposure/SKILL.md
Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or "how exposed is this domain". No API key needed.
zebbernSkillzebbern/claude-code-guide/skills/smtp-penetration-testing/SKILL.md
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
yaklangSkillyaklang/hack-skills/skills/ios-pentesting-tricks/SKILL.md
iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.
GoogleSkillgoogle/mantis/skills/mantis-plan/SKILL.md
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.
No other project uses it yet
GoogleReads credentialsSkillgoogle/skills/skills/cloud/secops-cases/SKILL.md
Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes; updating case priority or description; or linking and grouping security alerts within cases. Supports both remote Google SecOps MCP tools and local fallback tools. Don't use for SIEM UDM searches or detection rule authoring.
Steady+28 stars this week
1 project uses a version of this
GitHubSkillgithub/awesome-copilot/skills/salesforce-apex-quality/SKILL.md
Apex code quality guardrails for Salesforce development. Enforces bulk-safety rules (no SOQL/DML in loops), sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage (Positive / Negative / Bulk), and modern Apex idioms. Use this skill when reviewing or generating Apex classes, trigger handlers, batch jobs, or test classes to catch governor limit risks, security gaps, and quality issues before deployment.
No other project uses it yet
Bitterbot-AISkillBitterbot-AI/bitterbot-desktop/skills/healthcheck/SKILL.md
Host security hardening and risk-tolerance configuration for Bitterbot deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Bitterbot cron scheduling for periodic checks, or version status checks on a machine running Bitterbot (laptop, workstation, Pi, VPS).
Often used withtaskflow-inbox-triagenode-connectdiscord-e2e
gitpod-ioPipes a download into a shellSkillgitpod-io/gitpod/cve-mitigation/SKILL.md
Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to fix vulnerabilities, update dependencies for security, respond to CVE scan failures, or validate that dependency updates resolve known CVEs. Triggers on "fix CVE", "vulnerability scan", "security update", "dependency CVE", "grype scan", "leeway sbom", "CVE remediation", "update vulnerable dependency", "daily scan failure", "critical vulnerability".
electronSkillelectron/electron/.claude/skills/chrome-release-verify/SKILL.md
End-to-end Chrome security backport for an Electron release branch. Given a Chrome Releases blog URL and a branch (e.g. 41-x-y), determines which CVE fixes are missing from the *actual synced source*, writes the cherry-pick patches locally, validates them with `e sync --3` + `lint --patches`, then pushes a single PR. Use when asked to backport a Chrome security release to N-x-y, "is CVE-X already in N-x-y?", or to produce/validate the cherry-pick set for a release branch.
No other project uses it yet
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
