Claude skills and agent skills

AnthropicSkill

patch

anthropics/defending-code-reference-harness/.claude/skills/patch/SKILL.md

Generate candidate fixes for verified security findings. Consumes

AnthropicSkill

triage

anthropics/defending-code-reference-harness/.claude/skills/triage/SKILL.md

Triage a batch of raw security findings. Verify each is real,

Often used withwriting-beats·setup-matt-pocock-skills·setup-ts-deep-modules

AWSSkill

aws-cloudformation

aws/agent-toolkit-for-aws/plugins/aws-core/skills/aws-cloudformation/SKILL.md

Authors, validates, and troubleshoots AWS CloudFormation templates. Covers template authoring with secure defaults, local validation with either cfn-lint or cloudformation-validate, cfn-guard security and compliance checks as a recommended default, account-aware CloudFormation service pre-deployment validation, CloudFormation Express mode for faster deployments, and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation. Also covers author-time template intelligence with the CloudFormation Language Server and published cloudformation-validate libraries.

amdSkill

github-issue-response

amd/gaia/.claude/skills/github-issue-response/SKILL.md

Respond to a GitHub issue, PR comment, discussion reply, or review on amd/gaia. Use when writing any reply that will be posted to GitHub — triaging a bug report, answering a usage question, responding to a feature request, replying to a contributor on a PR, or handling a reported security issue. Covers the security-escalation protocol (never discuss exploit details publicly), when to escalate to @kovtcharov-amd, per-response-type length caps, and the doc-link map for pointing users at the right page.

No other project uses it yet

OpenAISkill

stripe-best-practices

openai/plugins/plugins/stripe/skills/stripe-best-practices/SKILL.md

Guides Stripe integration decisions across API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration, including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

Q00Skill

triage

Q00/ouroboros/.claude/skills/triage/SKILL.md

Triage a batch of raw security findings. Verify each is real,

Often used withwriting-beats·setup-matt-pocock-skills·setup-ts-deep-modules

langwatchSkill

mfasim

langwatch/langwatch/.claude/skills/mfasim/SKILL.md

Emulate second factors in a test browser: passkeys, security keys and U2F tokens through Chromium's virtual WebAuthn authenticators, and TOTP (authenticator app) codes typed without the agent ever seeing the secret. `haven browser mfa` on a haven browser lane, `addVirtualAuthenticator` in the Playwright e2e suites. Use when someone says 'haven mfa', 'mfasim', 'test passkeys', 'fake a security key', 'virtual authenticator', 'hardware token', 'YubiKey in a test', 'fail the fingerprint', 'user verification fails', 'list the passkeys the browser holds', 'two-step verification', 'enrol TOTP', 'authenticator app code', 'one-time code', or 'type a wrong 2FA code'.

No other project uses it yet

levy-streetReads credentialsSkill

release-malware-audit

levy-street/world-of-claudecraft/.claude/skills/release-malware-audit/SKILL.md

Release-gate scan for deliberately planted malicious code (crypto miners, data/secret exfiltration, backdoors, RCE/obfuscation, install hooks) across the whole working tree of World of ClaudeCraft. Use before tagging or shipping a release, or whenever you want to confirm the tree is free of malicious code. Runs the deterministic scanner, fans the read-only release-malware-audit agent across categories, and returns a single PASS / BLOCK verdict with confirmed findings and dismissed false positives. Distinct from privacy-security-review, which catches accidental security mistakes.

formbricksSkill

release-notes

formbricks/formbricks/.agents/skills/release-notes/SKILL.md

Draft the GitHub release notes for a Formbricks release from the diff between the previous stable tag and the release branch — in the exact "What's Changed" format past releases already use (grouped by conventional-commit type, one bullet per PR carrying its verbatim title, author handle and full PR URL), with an Overview and a Breaking changes index for minors, a Before upgrading section for patches, and a Security section listing each vulnerability fix with its severity and any reporter credit. Replaces the plain GitHub "auto-generate release notes" button, which dumps a flat list, double-lists every backport, and handles neither breaking changes nor credits. Use for "/release-notes", "generate release notes", "draft the release notes for x.y", Release QA Step 11 (Ship the stable release), or a security patch round.

Often used withbrainstorm-experiments-existing·pestle-analysis·positioning-ideas

mrgoonieSkill

backend-development

mrgoonie/claudekit-skills/.claude/skills/backend-development/SKILL.md

Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.

Often used withProblem-Solving Techniques

PostHogSkill

qa-frontend

PostHog/posthog/.agents/skills/qa-frontend/SKILL.md

Internal PostHog developer frontend/browser QA skill. Use only when a PostHog developer explicitly asks to run frontend QA, browser-test a PR, verify a UI flow against the local PostHog stack, use qa-frontend, or QA current frontend changes with browser/runtime evidence, or to make a feature reel (see reel mode below). Do not use for generic code review, PR review, "check my changes", CI debugging, or security audit; use qa-team, debugging-ci-failures, or security-audit instead. QA runs in PR mode or local mode, plans adaptive browser and visual checks, drives browser MCP/tooling such as Playwright MCP or Chrome DevTools MCP, captures evidence, and applies only approved/narrow fixes. Reel mode makes a feature reel instead: a short, sharp animated WebP of one UI flow for a PR description. Use it when asked for a reel, GIF, or animated demo, or when writing-pr-descriptions calls for a reel: a new action and its effect that one screenshot cannot show.

elementalsoulsSkill

enterprise-vpn-attack

elementalsouls/Claude-BugHunter/skills/enterprise-vpn-attack/SKILL.md

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.

openclawSkill

healthcheck

openclaw/openclaw/skills/healthcheck/SKILL.md

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

Often used withtaskflow-inbox-triage·node-connect·discord-e2e

TanStackDeletes or force-pushesSkill

pr-sweep

TanStack/ai/.agents/skills/pr-sweep/SKILL.md

Sweep open (or listed) PRs with up to 100 parallel agents: security-scan outside contributors, rebase onto main when behind (push --force-with-lease), approve pending first-time-contributor CI when relevant, optionally rebase in-house PRs, and report who should review. Supports full, changed-only, behind-only, and conflict-only scopes for cheap daily runs. Use when the user runs /pr-sweep (or /pr-inbound-sweep), or asks to "sweep PRs", "sweep inbound PRs", "security-check outside PRs", "rebase outsider PRs", "rebase our PRs", "approve waiting CI on PRs", "daily PR sweep", or "prep external PRs for review".

tursodatabaseReads credentialsSkill

pr-workflow

tursodatabase/turso/.claude/skills/pr-workflow/SKILL.md

General guidelines for Commits, formatting, CI, dependencies, security

ComplianceAsCodeSkill

test-rule

ComplianceAsCode/content/.claude/skills/test-rule/SKILL.md

Run Automatus tests for a security rule

MicrosoftSkill

azure-kubernetes

microsoft/skills/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md

Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations.

SnailSploitSkill

offensive-iot

SnailSploit/Claude-Red/Skills/iot/offensive-iot/SKILL.md

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.

GoogleSkill

google-cloud-storage-bucket-architect

google/skills/skills/cloud/google-cloud-storage-bucket-architect/SKILL.md

Creates Cloud Storage on Google Cloud (also known colloquially as GCS) buckets. Analyzes the workload (sensitive data, media hosting, ingestion, web hosting, archiving, backup, logging, analytics, AI/ML, or general-purpose), validates project-level security settings, and designs a secure-by-default, cost-effective configuration (location, storage class, uniform bucket-level access, public access prevention, soft delete, lifecycle) before creating it. Use whenever a user wants to create, make, set up, provision, or spin up a bucket, or needs object storage for an app, service, pipeline, or dataset — even a "simple" or "default" bucket, or when bucket creation is one step in a larger workflow. Outputs or executes the creation via gcloud, the JSON/REST API, Terraform, or SDK client libraries (C++, Java, Python, Go). Don't use for anything other than creating new buckets — for uploads, downloads, access changes, or reconfiguring existing buckets, use google-cloud-storage-basics.

maziyarpanahiSkill

checking-hipaa-compliance

maziyarpanahi/openmed/skills/checking-hipaa-compliance/SKILL.md

Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysis, compliance review. Pairs adjacent to OpenMed: the checklist shows where openmed.deidentify and signed audit reports satisfy the de-identification and audit-control requirements. The control list lives in references/hipaa-checklist.md. This is a structured self-assessment aid, not legal advice.

No other project uses it yet