Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/skills/security-assistant/SKILL.md
Guide security review and vulnerability assessment following OWASP standards. Use when: security audit, vulnerability check, secure coding review, threat modeling. Not for: automated dependency, CVE, and secret scanning — use /scan; handling a breach in progress — use /incident. Keywords: security, OWASP, vulnerability, authentication, authorization.
Often used withcost-reduceralbert-dmscalability
rust-off-railsSkillrust-off-rails/rustoffrails/skills/security/SKILL.md
Deep security review of a Rust off Rails app or change: threat model, the full security checklist, scanners (cargo-deny, secret scan, ZAP baseline), header/CSP verification and WebSocket checks. Use before shipping, after auth/payments/uploads/realtime/API changes, or when the user asks about security, hardening or a pentest-style review.
Often used withcost-reduceralbert-dmscalability
flavien-iaReads credentialsSkillflavien-ia/hypervibe-craft/skills/security/SKILL.md
Audit the security of a Next.js/T3 project. Checks for exposed secrets, unprotected routes, input validation, dependency vulnerabilities, headers, CORS, and common web security issues. Use when the user wants to verify their app is safe before going live.
Often used withcost-reduceralbert-dmscalability
korchard333Skillkorchard333/claude-power-platform-community/.claude/skills/security/SKILL.md
Dataverse Security Model. Use when: designing security roles, column-level security, business units, teams (owner/access/AAD group), record sharing, hierarchy security, minimum viable privileges, security role management via Web API.
Often used withcost-reduceralbert-dmscalability
DGouronReads credentialsSkillDGouron/review-flow/.claude/skills/security/SKILL.md
Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data.
Often used withcost-reduceralbert-dmscalability
krzysztofsurdySkillkrzysztofsurdy/code-virtuoso/skills/knowledge/security/SKILL.md
Application security principles and OWASP Top 10. Use to review code for vulnerabilities, implement authentication or authorization, handle secrets, configure security headers, prevent injection (SQL, XSS, CSRF), or prepare for an audit.
Often used withcost-reduceralbert-dmscalability
galandoSkillgalando/piv-speckit/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withcost-reduceralbert-dmscalability
kcns008Reads credentialsSkillkcns008/cluster-agent-swarm-skills/skills/security/SKILL.md
Security Agent (Shield) — handles Pod Security Standards, RBAC audits, NetworkPolicy enforcement, secrets management (Vault), image scanning (Trivy), policy enforcement (Kyverno/OPA), CIS benchmarks, and compliance for Kubernetes and OpenShift clusters.
Often used withcost-reduceralbert-dmscalability
nirholasSkillnirholas/AuditKit/.agents/skills/security/SKILL.md
Security Skill — AuditKit This skill is auto-included in the generated ZIP when the Security pillar score is below 90. ## HTTP Security Headers Add all of these to every response
Often used withcost-reduceralbert-dmscalability
LazyIsEfficientSkillLazyIsEfficient/agentic-os/.claude/skills/security/SKILL.md
Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.
Often used withcost-reduceralbert-dmscalability
manu14357Skillmanu14357/Zelaxy/.agents/skills/security/SKILL.md
Maintain and improve security across the Zelaxy platform. Use for: secret encryption boundaries, auth modes (session/API key/internal JWT/cron), CSP and middleware hardening, webhook verification, tenant isolation, and security test coverage.
Often used withcost-reduceralbert-dmscalability
darknecrocitiesReads credentialsSkilldarknecrocities/SkillBuilder/skills/security/SKILL.md
Security hardening and vulnerability defense skill. Enforces OWASP Top 10 mitigations, zero hardcoded secrets, input sanitization, and SQL parameterization.
Often used withcost-reduceralbert-dmscalability
kpbraySkillkpbray/power-bi-agent-skills/.github/skills/security/SKILL.md
Implements Row-Level Security (RLS) and Object-Level Security (OLS) for Power BI models. Use for data access control, dynamic security, and multi-tenant scenarios.
Often used withcost-reduceralbert-dmscalability
prangishviliAbeSkillprangishviliAbe/agent-skills/security/SKILL.md
Audit, threat-model, and harden application or AI-agent trust boundaries. Use for security reviews, authorization flaws, injection, SSRF, sessions, sensitive data, cryptography, webhooks, race conditions, dependency risks, or agent tool permissions. Trace actual exploit paths, prioritize evidence, and verify scoped fixes without running unauthorized probes or treating a checklist as proof of security.
Often used withcost-reduceralbert-dmscalability
cognitedataReads credentialsSkillcognitedata/builder-skills/skills/security/SKILL.md
MUST be used whenever fixing security issues in a Flows app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report them. Do NOT skip this when the user asks for a security fix, security hardening, or vulnerability remediation — run every step in order. Triggers: security, security fix, security hardening, vulnerability, XSS, injection, credentials, secrets, auth, authentication, authorization, token, sensitive data, input validation, CORS, CSP, dependency audit.
Often used withcost-reduceralbert-dmscalability
muon-m2Reads credentialsSkillmuon-m2/magento2-tools/skills/security/SKILL.md
Site-wide and per-module security audit for Magento 2. Use for a security review, pre-release security check, dependency CVE or secret-leakage audit, or Marketplace EQP scan. Produces severity-ranked findings (Markdown, JSON, SARIF) from a live composer audit, Adobe patch-state verdicts, secret scanning, EQP static rules, and cross-module patterns. Cross-module, dependency-level, repo-wide depth; for per-module security findings within a general quality review use magento2-tools:review.
Often used withcost-reduceralbert-dmscalability
0xSeroSkill0xSero/claude-skill-dir/security/SKILL.md
Security Analysis & Protection Expert Expert in security analysis, reverse engineering, intrusion detection, and system hardening. Specializes in using tools like Ghidra, forensics utilities, and security monitoring to ensure system safety
Often used withcost-reduceralbert-dmscalability
AbdurRafay2004SkillAbdurRafay2004/handoff/skills/security/SKILL.md
Use for a full security audit — T3 verify gate (money, auth, user data, migrations), pre-launch check, or when the user asks to audit the codebase for vulnerabilities. For quick diff-scoped checks, prefer a host-provided security reviewer when available, otherwise apply this skill to the diff.
Often used withcost-reduceralbert-dmscalability
AhmedAbdelfattah0Reads credentialsSkillAhmedAbdelfattah0/AI-Skills/skills/security/SKILL.md
Secure-by-default coding practices that stop fast-moving work from shipping a vulnerability — apply them by default, even when unasked.
Often used withcost-reduceralbert-dmscalability
daianepepes-labSkilldaianepepes-lab/claude-skills/security/SKILL.md
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Often used withcost-reduceralbert-dmscalability
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
