Claude skills and agent skills

AndersonAndradSkill

security-log

AndersonAndrad/skills/security-log/SKILL.md

Ensures client-facing API errors expose minimal information while internal logs keep useful, non-sensitive diagnostics. Use when implementing or reviewing changes to error responses, exceptions, validation, authentication, registration, account recovery, authorization, or logging. Applies only to the requested change unless the developer explicitly requests a project-wide review.

cloudsmith-labsSkill

csm-security

cloudsmith-labs/claude-code-skills/skills/csm-security/SKILL.md

Investigate security posture in Cloudsmith — vulnerabilities, quarantine, and audit logs. Use when the user wants to scan an org, repository, or package for CVEs/vulnerabilities, investigate a specific CVE, review or manage quarantined packages, see who changed or deleted something (audit log), review security events, or get a security summary before a release or promotion.

HarambeeAISkill

security-scan

HarambeeAI/bayes-ship/skills/security-scan/SKILL.md

Security scanning against OWASP Top 10, secret detection, input validation, auth hardening. Used by the security reviewer during QA phase. Source: everything-claude-code.

Often used withdjango-security·deployment-patterns·postgres-patterns

johnclawsonSkill

security-qbr

johnclawson/claude-skills/security-qbr/SKILL.md

Generate Quarterly Business Review (QBR) presentations for Information Security teams. Use this skill when creating QBR decks, quarterly security reviews, or executive briefings about security posture for CIO/CTO audiences. Covers content structure (risks, accomplishments, current work, KPIs), writing style, and slide organization. Triggers on requests for security QBRs, quarterly InfoSec reviews, CISO presentations, or security executive briefings.

maridlabsaiSkill

security-scan

maridlabsai/jini/.claude/skills/security-scan/skill.md

Security Scan Use this skill for public Jini security review. ## Procedure 1. Scan changed files for secrets, credentials, private URLs, customer details, pricing strategy, and commercial rollout material

Often used withdjango-security·deployment-patterns·postgres-patterns

morodomiSkill

security-scan

morodomi/dev-crew/skills/security-scan/SKILL.md

セキュリティスキャンを実行。RECON→SCAN→REPORT→LEARNワークフローで脆弱性を検出。「セキュリティスキャン」「security scan」「脆弱性チェック」「セキュリティ診断」「OWASPチェック」で起動。Do NOT use for レポートのみ（→ attack-report）やスキャン+レポート一括（→ security-audit）。

Often used withdjango-security·deployment-patterns·postgres-patterns

nainishshafiSkill

api-security

nainishshafi/developer-productivity-skills/.github/skills/api-security/SKILL.md

Universal, language-independent architectural and security review guidance for API authentication, authorization, and cryptographic boundaries. Covers JWT (RS256/ES256, token rotation, revocation strategies), OAuth 2.1 & OpenID Connect (PKCE, Client Credentials), stateful session tokens (HttpOnly, Secure, SameSite, CSRF defense), API key design (hashing, prefixing), HMAC request signatures, and Mutual TLS (mTLS). Use when designing, reviewing, or auditing API authentication, or when asked to "review api security", "jwt vs oauth", "jwt vs session", "api authentication best practices", "implement pkce", "webhook hmac signature", "secure api keys", or "audit auth architecture".

Often used withbinary-diff·pentest-tools·llm-security

NemesLaszloSkill

security-scan

NemesLaszlo/Agent-Collection/.claude/skills/security-scan/SKILL.md

Security vulnerability scan using the Security Vulnerability Scanner agent workflow. Use when the user says security scan, check for vulnerabilities, security audit, is this secure, OWASP check, or before deploying to production.

Often used withdjango-security·deployment-patterns·postgres-patterns

NinjaSln-labsSkill

security-scan

NinjaSln-labs/agent-skills/security-scan/SKILL.md

Security scan: one comprehensive pass over a whole codebase — OWASP Top 10 detection (access control, crypto, injection, SSRF, logging), hardcoded secrets, insecure configuration, with severity ranking and remediation guidance. Use when you need a full security review before a release or PR, want to triage which security problems matter most, or ask to "scan this project for security issues". Detection is pattern-based: no SAST data-flow engine or CVE advisory database is bundled, so dependency CVEs and taint paths need external tooling. NOT for: a single-category deep dive (secrets only, config/Docker/IaC only, dependency CVEs only — use the dedicated scanner for that one category) or applying fixes without explicit approval. USER-INVOKED ONLY: run only when the user asks for a security scan; never auto-trigger from any code-writing task.

Often used withdjango-security·deployment-patterns·postgres-patterns

novatsinghSkill

security-scan

novatsingh/agentkick/.claude/skills/security-scan/SKILL.md

security scan workflow for disciplined AI coding agents.

Often used withdjango-security·deployment-patterns·postgres-patterns

shivae372Skill

security-scan

shivae372/claude-bootstrap/.claude/skills/security-scan/SKILL.md

Security audit skill. Invoke before deploying, after adding auth code, or when reviewing for vulnerabilities. Auto-activates on "security check", "check for vulnerabilities", "pre-deploy audit", "scan for secrets", "is this auth secure". Routes to security-scanner sub-agent.

Often used withdjango-security·deployment-patterns·postgres-patterns

vhmarquezSkill

security-scan

vhmarquez/argo/skills/security-scan/SKILL.md

Run PMD with the Apex security ruleset against the project's Apex source. Surfaces SOQL injection vectors, missing CRUD/FLS checks, hardcoded credentials, sharing violations, and other Apex-specific security issues. CI mode emits SARIF for GitHub Code Scanning.

Often used withdjango-security·deployment-patterns·postgres-patterns

ZeroTokenClawSkill

security-scan

ZeroTokenClaw/agents-skills/security-scan/SKILL.md

对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。

Often used withdjango-security·deployment-patterns·postgres-patterns

zhao-wuyanSkill

security-audit

zhao-wuyan/ccw-command-explorer/.claude/skills/security-audit/SKILL.md

OWASP Top 10 and STRIDE security auditing with supply chain analysis. Triggers on "security audit", "security scan", "cso".

Often used withcreate-stories·community-led-growth·story-done

trezorSkill

security-headers

trezor/trezor-suite/skills/security-headers/SKILL.md

Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.

devfragaSkill

security-audit

devfraga/skills-sujeito-programador/security-audit/SKILL.md

Auditoria de segurança multi-projeto para Next.js e React — usa versões instaladas (package.json + lockfile), npm audit, Auth.js, Prisma, Stripe quando presentes. Anti-falso-positivo. Use em "auditar segurança", XSS, IDOR, Server Actions, ou "/security-audit [path]".

Often used withcreate-stories·community-led-growth·story-done

quocldSkill

security-pass

quocld/hephaestus-agent-skills/skills/security-pass/SKILL.md

Use when a diff meets the security triggers (auth, tenant data, privileged clients, raw HTML, SQL, storage, env vars), when fresh-review sets security_pass_needed, before a client handover audit, and when the user says "check security", "security review", "check RLS", "review bảo mật", "kiểm tra bảo mật", "check phân quyền", "có lộ data tenant khác không".

YepAPISkill

auth-security

YepAPI/skills/skills/auth-security/SKILL.md

Authentication security — bcrypt/argon2 hashing, brute force protection, secure password resets.

hushh-labsSkill

security-audit

hushh-labs/hushh-research/.agents/skills/security-audit/SKILL.md

Use when the request is about IAM, consent, trust, ordinary vault encryption, failures decrypting PKM entries, PKM storage or persistence, encrypted PKM records, plaintext localStorage leaks, streaming safety, verification, or security audit workflows and no narrower specialist owns the change.

Often used withcreate-stories·community-led-growth·story-done

sd0xdevSkill

security-review

sd0xdev/sd0x-dev-flow/skills/security-review/SKILL.md

Security review via Codex exec. Use when: OWASP Top 10:2025 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example