Claude skills and agent skills

ddmsolutionsSkill

ai-security

ddmsolutions/claude-skills/ai-security/SKILL.md

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

Marwan-Ahmed-devSkill

vc:security

Marwan-Ahmed-dev/vibecode-pro-max/.agents/skills/vc-security/SKILL.md

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc:autoresearch pattern.

apacheSkill

security-triage

apache/streampipes/.claude/skills/security-triage/SKILL.md

Assess, route and report a suspected security vulnerability in Apache StreamPipes against the project's threat model. Use when a task involves a potential vulnerability, an exploit claim, a security finding from a scanner, or a decision about whether something is in or out of the security model.

jnMetaCodeReads credentialsSkill

security-guide

jnMetaCode/shellward/skills/security-guide/SKILL.md

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

5uck1essSkill

tri-security

5uck1ess/devkit/skills/tri-security/SKILL.md

Three-tier parallel security audit (injection + auth + config, each examined by a different model tier) with severity-ranked consolidation — use when the user asks for tri-security, triple security audit, three-way security review, multi-model vulnerability scan, or parallel security audit of a code change, branch, module, or endpoint. Worth the extra cost when — touching auth/payments/user-uploads/admin surfaces, before prod deploy of security-sensitive code, after a security incident, or when the user is paranoid about a specific attack class. Do NOT use for general code quality review (use tri-review), bug diagnosis (use tri-debug), or approach comparison on greenfield work (use tri-dispatch). Do NOT use for a single-line "is this XSS safe" question, or for running pre-existing scanners like npm audit / gosec / semgrep — those are single-tool tasks, not a tri workflow.

academindSkill

web-security

academind/claude-code-course/.claude/skills/web-security/SKILL.md

Enforce web security and avoid security vulnerabilities

AnyOrgNameSkill

security-jwt

AnyOrgName/php-skills/skills/symfony/security-jwt/SKILL.md

Add stateless JWT authentication to a Symfony API with LexikJWTAuthenticationBundle — firewall wiring in security.yaml, token TTL and refresh, and a custom authenticator when the defaults are not enough. Use when the user must configure a Symfony firewall for JWT — the login entry point, the api firewall, and the token authenticator in security.yaml; the user needs to authenticate a Symfony API statelessly with JWT tokens issued and verified by LexikJWTAuthenticationBundle; the user wants to set the JWT token TTL, add refresh tokens, or build a custom Symfony authenticator for token handling. Keywords: security, auth, authentication, jwt, symfony, firewall, stateless, api.

gwonvibeSkill

security-kit

gwonvibe/gwonvibe-agent-skills/skills/security-kit/SKILL.md

로그인·권한·결제·개인정보·파일 업로드·외부 URL·관리자 기능처럼 민감한 기능의 신뢰 경계를 설계하거나 변경된 흐름을 집중 점검할 때 사용한다.

jaskaranhundalSkill

iac-security

jaskaranhundal/usap-skills/.agents/skills/iac-security/SKILL.md

../../../cloud-infra/iac-security/SKILL.md

kcns008Pipes a download into a shellSkill

k8s-security

kcns008/cluster-skills/.claude/skills/k8s-security/SKILL.md

Kubernetes and OpenShift security assessment, hardening, and compliance. Use this skill when: (1) Auditing cluster or workload security posture (2) Implementing Pod Security Standards/Admission (3) Configuring RBAC roles and permissions (4) Setting up NetworkPolicies for zero-trust (5) Managing Secrets securely (encryption, external secrets) (6) Scanning images for vulnerabilities (7) Implementing OCP SecurityContextConstraints (8) Compliance checking (CIS benchmarks, SOC2, PCI-DSS) (9) Security incident investigation (10) Hardening cluster components

langbyyiSkill

api-security

langbyyi/websec-skills/api-security/SKILL.md

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

Often used withbinary-diff·pentest-tools·llm-security

ldilovSkill

security-scan

ldilov/harness-forge/.agents/skills/security-scan/SKILL.md

Auto-discoverable wrapper for `.hforge/library/skills/security-scan/SKILL.md`.

Often used withdjango-security·deployment-patterns·postgres-patterns

lxsmnsycSkill

security-fix

lxsmnsyc/agent-skills/skills/security-fix/SKILL.md

Fix a security vulnerability without leaking it before the release. Work happens on a local-only branch that is never pushed, then merges straight into the branch the release workflow publishes from. The fix becomes public at the same moment CI publishes the release, so the package keeps npm provenance. Use this skill whenever the user asks to fix a security issue, vulnerability, advisory, CVE or GHSA, or when other work finds one, even if they do not say "security-fix".

MBrekhofSkill

xaf-security

MBrekhof/xafskills/skills/xaf-security/SKILL.md

Configure DevExpress XAF security: roles, permissions, users, and background job authentication. Use when setting up role permissions in Updater.cs, implementing object-level security, exporting/importing roles, creating background job security contexts, or troubleshooting permission issues. Covers type-level vs object-level permissions, CurrentUserIdOperator, PermissionsReloadMode, and the role update caveat.

MusserLabReads credentialsSkill

security-setup

MusserLab/lab-claude-skills/skills/security-setup/SKILL.md

Configure and manage Claude Code security protections for sensitive files, credentials, and data. Use when the user invokes /security-setup to set up or modify protections against unauthorized file access, credential exposure, or sensitive data leaks.

ryankoleanReads credentialsSkill

site-security

ryankolean/summit-claude-skills/skills/site-security/SKILL.md

Security scanning, evaluation, audit, resolution and monitoring for Summit websites and apps. Runs secrets, dependency, static-analysis, CI-workflow, header/TLS and live-site checks; normalizes every result into one findings file; gates production deploys; then triages findings and fixes them one atomic PR at a time. Activates on "security scan", "security audit", "is this site secure", "check for secrets", "vulnerability scan", "harden this site", "fix security findings", "security gate", "pre-launch security check", or as the security part of the framework's audit, launch gate (SUMMIT-252) and monitor modes.

secureIO-GmbHReads credentialsSkill

security-scan

secureIO-GmbH/security-skills/skills/security-scan/SKILL.md

Use this skill to run a security scan combining SAST analysis, secret/credential detection, dependency vulnerability scanning (SCA), and container/IaC misconfiguration checks on staged code or the full codebase. Invoke as `/security-scan` to scan only git-staged files (fast, pre-commit use), or `/security-scan full` to scan the entire codebase. Uses semgrep or opengrep for SAST, trufflehog for secrets, and trivy (preferred) or grype for SCA and container/IaC scanning. Validates and deduplicates findings, generates a structured markdown report with severity ratings, and offers to auto-remediate fixable issues. Trigger this skill whenever the user wants to: run a security scan, check for secrets or credentials in code, scan dependencies for CVEs, check container or IaC configuration, do a SAST scan before committing, scan for vulnerabilities, run semgrep, trufflehog, trivy, or grype, or get a security report on their code.

Often used withdjango-security·deployment-patterns·postgres-patterns

SVerITGReads credentialsSkill

security-scan

SVerITG/Metis/.agents/skills/security-scan/skill.md

Audit the current session for security and data-safety issues

Often used withdjango-security·deployment-patterns·postgres-patterns

WishmakingfairySkill

security-scan

Wishmakingfairy/vibecheck/skills/security-scan/SKILL.md

This skill should be used when the user asks to \"run a security scan\", \"check for vulnerabilities\", \"security audit\", \"ship secure\", \"vibecheck scan\", or \"pre-deploy security check\". Runs 156 automated security checks across 15 categories and produces a categorized vulnerability report.

Often used withdjango-security·deployment-patterns·postgres-patterns

borgbaseDeletes or force-pushesSkill

security-review

borgbase/vykar/.agents/skills/security-review/SKILL.md

Security review skill for the vykar backup tool (Rust). Use when reviewing code for security issues, auditing cryptographic implementations, checking for credential leaks, reviewing unsafe code, or validating the security model of the backup tool. Covers encryption, key management, repository integrity, hook execution, config parsing, dependency auditing, and backup-specific attack surfaces.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example