Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/.agents/skills/security-assistant/SKILL.md
引導安全審查與弱點評估，遵循 OWASP 標準。 Use when: 安全稽核、弱點檢查、安全程式碼審查、威脅建模。 Not for: 自動化的相依套件、CVE 與機密掃描——請用 /scan；處理正在發生的資安事件——請用 /incident。 Keywords: security, OWASP, vulnerability, authentication, authorization, 資訊安全, 弱點, 認證, 授權, 威脅建模.
Often used withcost-reducerscalabilitytrigger-dev
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/skills/security-assistant/SKILL.md
Guide security review and vulnerability assessment following OWASP standards. Use when: security audit, vulnerability check, secure coding review, threat modeling. Not for: automated dependency, CVE, and secret scanning — use /scan; handling a breach in progress — use /incident. Keywords: security, OWASP, vulnerability, authentication, authorization.
Often used withcost-reducerscalabilitytrigger-dev
rust-off-railsSkillrust-off-rails/rustoffrails/skills/security/SKILL.md
Deep security review of a Rust off Rails app or change: threat model, the full security checklist, scanners (cargo-deny, secret scan, ZAP baseline), header/CSP verification and WebSocket checks. Use before shipping, after auth/payments/uploads/realtime/API changes, or when the user asks about security, hardening or a pentest-style review.
Often used withcost-reducerscalabilitytrigger-dev
flavien-iaReads credentialsSkillflavien-ia/hypervibe-craft/skills/security/SKILL.md
Audit the security of a Next.js/T3 project. Checks for exposed secrets, unprotected routes, input validation, dependency vulnerabilities, headers, CORS, and common web security issues. Use when the user wants to verify their app is safe before going live.
Often used withcost-reducerscalabilitytrigger-dev
korchard333Skillkorchard333/claude-power-platform-community/.claude/skills/security/SKILL.md
Dataverse Security Model. Use when: designing security roles, column-level security, business units, teams (owner/access/AAD group), record sharing, hierarchy security, minimum viable privileges, security role management via Web API.
Often used withcost-reducerscalabilitytrigger-dev
DGouronReads credentialsSkillDGouron/review-flow/.claude/skills/security/SKILL.md
Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data.
Often used withcost-reducerscalabilitytrigger-dev
krzysztofsurdySkillkrzysztofsurdy/code-virtuoso/skills/knowledge/security/SKILL.md
Application security principles and OWASP Top 10. Use to review code for vulnerabilities, implement authentication or authorization, handle secrets, configure security headers, prevent injection (SQL, XSS, CSRF), or prepare for an audit.
Often used withcost-reducerscalabilitytrigger-dev
galandoSkillgalando/piv-speckit/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withcost-reducerscalabilitytrigger-dev
kcns008Reads credentialsSkillkcns008/cluster-agent-swarm-skills/skills/security/SKILL.md
Security Agent (Shield) — handles Pod Security Standards, RBAC audits, NetworkPolicy enforcement, secrets management (Vault), image scanning (Trivy), policy enforcement (Kyverno/OPA), CIS benchmarks, and compliance for Kubernetes and OpenShift clusters.
Often used withcost-reducerscalabilitytrigger-dev
nirholasSkillnirholas/AuditKit/.agents/skills/security/SKILL.md
Security Skill — AuditKit This skill is auto-included in the generated ZIP when the Security pillar score is below 90. ## HTTP Security Headers Add all of these to every response
Often used withcost-reducerscalabilitytrigger-dev
LazyIsEfficientSkillLazyIsEfficient/agentic-os/.claude/skills/security/SKILL.md
Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.
Often used withcost-reducerscalabilitytrigger-dev
manu14357Skillmanu14357/Zelaxy/.agents/skills/security/SKILL.md
Maintain and improve security across the Zelaxy platform. Use for: secret encryption boundaries, auth modes (session/API key/internal JWT/cron), CSP and middleware hardening, webhook verification, tenant isolation, and security test coverage.
Often used withcost-reducerscalabilitytrigger-dev
darknecrocitiesReads credentialsSkilldarknecrocities/SkillBuilder/skills/security/SKILL.md
Security hardening and vulnerability defense skill. Enforces OWASP Top 10 mitigations, zero hardcoded secrets, input sanitization, and SQL parameterization.
Often used withcost-reducerscalabilitytrigger-dev
kpbraySkillkpbray/power-bi-agent-skills/.github/skills/security/SKILL.md
Implements Row-Level Security (RLS) and Object-Level Security (OLS) for Power BI models. Use for data access control, dynamic security, and multi-tenant scenarios.
Often used withcost-reducerscalabilitytrigger-dev
prangishviliAbeSkillprangishviliAbe/agent-skills/security/SKILL.md
Audit, threat-model, and harden application or AI-agent trust boundaries. Use for security reviews, authorization flaws, injection, SSRF, sessions, sensitive data, cryptography, webhooks, race conditions, dependency risks, or agent tool permissions. Trace actual exploit paths, prioritize evidence, and verify scoped fixes without running unauthorized probes or treating a checklist as proof of security.
Often used withcost-reducerscalabilitytrigger-dev
alo-expReads credentialsSkillalo-exp/silver-bullet/skills/security/SKILL.md
This skill should be used when designing, planning, implementing, or reviewing any non-trivial change, or when the user asks to "harden X", "add auth", "validate input", "check for vulnerabilities", "secure endpoint" — enforces defense in depth, input validation, secure defaults, and OWASP best practices to prevent vulnerabilities before they ship
Often used withcost-reducerscalabilitytrigger-dev
ChainGPT-orgSkillChainGPT-org/chaingpt-claude-skill/skills/security/SKILL.md
Audit-before-action security workflow for any Web3 interaction the user is about to take. Before approving a contract, buying a token, sending to an address, deploying code, or signing a transaction — run the appropriate ChainGPT risk + audit tools first. Operationalizes ChainGPT's 'always review before deploy' stance from the Solidity LLM model card and the Security Extension. Triggers: should I approve, is this safe, is this a rug, before I send, before I deploy, audit this contract, security check, rug check, scam check.
Often used withcost-reducerscalabilitytrigger-dev
cognitedataReads credentialsSkillcognitedata/builder-skills/skills/security/SKILL.md
MUST be used whenever fixing security issues in a Flows app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report them. Do NOT skip this when the user asks for a security fix, security hardening, or vulnerability remediation — run every step in order. Triggers: security, security fix, security hardening, vulnerability, XSS, injection, credentials, secrets, auth, authentication, authorization, token, sensitive data, input validation, CORS, CSP, dependency audit.
Often used withcost-reducerscalabilitytrigger-dev
muon-m2Reads credentialsSkillmuon-m2/magento2-tools/skills/security/SKILL.md
Site-wide and per-module security audit for Magento 2. Use for a security review, pre-release security check, dependency CVE or secret-leakage audit, or Marketplace EQP scan. Produces severity-ranked findings (Markdown, JSON, SARIF) from a live composer audit, Adobe patch-state verdicts, secret scanning, EQP static rules, and cross-module patterns. Cross-module, dependency-level, repo-wide depth; for per-module security findings within a general quality review use magento2-tools:review.
Often used withcost-reducerscalabilitytrigger-dev
MarvelCollinSkillMarvelCollin/agent-skills/skills/security/SKILL.md
Run an authorized security review of a web app you own or are cleared to test, especially local and dev builds. Dev mode finds the running dev server, writes the scope itself and screens the build end to end with no setup questions. Works in phases that confirm authorization and scope, map the attack surface, then test for common vulnerability classes (injection, broken auth and access control, SSRF and server-side, XSS and client-side, session handling, business logic, misconfiguration, exposed secrets, secrets and tokens visible in the browser, client-controlled values like role and price, tables without RLS and public storage buckets, API and LLM issues) against the OWASP WSTG and ASVS, verify each finding with evidence to kill false positives, then write a report with severity and remediation. Can also do a static secure-code review without running anything.
Often used withcost-reducerscalabilitytrigger-dev
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
