Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
nirholasSkillnirholas/AuditKit/.agents/skills/security/SKILL.md
Security Skill — AuditKit This skill is auto-included in the generated ZIP when the Security pillar score is below 90. ## HTTP Security Headers Add all of these to every response
Often used withalbert-dmcost-reducertrigger-dev
LazyIsEfficientSkillLazyIsEfficient/agentic-os/.claude/skills/security/SKILL.md
Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.
Often used withalbert-dmcost-reducertrigger-dev
manu14357Skillmanu14357/Zelaxy/.agents/skills/security/SKILL.md
Maintain and improve security across the Zelaxy platform. Use for: secret encryption boundaries, auth modes (session/API key/internal JWT/cron), CSP and middleware hardening, webhook verification, tenant isolation, and security test coverage.
Often used withalbert-dmcost-reducertrigger-dev
kpbraySkillkpbray/power-bi-agent-skills/.github/skills/security/SKILL.md
Implements Row-Level Security (RLS) and Object-Level Security (OLS) for Power BI models. Use for data access control, dynamic security, and multi-tenant scenarios.
Often used withalbert-dmcost-reducertrigger-dev
prangishviliAbeSkillprangishviliAbe/agent-skills/security/SKILL.md
Audit, threat-model, and harden application or AI-agent trust boundaries. Use for security reviews, authorization flaws, injection, SSRF, sessions, sensitive data, cryptography, webhooks, race conditions, dependency risks, or agent tool permissions. Trace actual exploit paths, prioritize evidence, and verify scoped fixes without running unauthorized probes or treating a checklist as proof of security.
Often used withalbert-dmcost-reducertrigger-dev
ChainGPT-orgSkillChainGPT-org/chaingpt-claude-skill/skills/security/SKILL.md
Audit-before-action security workflow for any Web3 interaction the user is about to take. Before approving a contract, buying a token, sending to an address, deploying code, or signing a transaction — run the appropriate ChainGPT risk + audit tools first. Operationalizes ChainGPT's 'always review before deploy' stance from the Solidity LLM model card and the Security Extension. Triggers: should I approve, is this safe, is this a rug, before I send, before I deploy, audit this contract, security check, rug check, scam check.
Often used withalbert-dmcost-reducertrigger-dev
MarvelCollinSkillMarvelCollin/agent-skills/skills/security/SKILL.md
Run an authorized security review of a web app you own or are cleared to test, especially local and dev builds. Dev mode finds the running dev server, writes the scope itself and screens the build end to end with no setup questions. Works in phases that confirm authorization and scope, map the attack surface, then test for common vulnerability classes (injection, broken auth and access control, SSRF and server-side, XSS and client-side, session handling, business logic, misconfiguration, exposed secrets, secrets and tokens visible in the browser, client-controlled values like role and price, tables without RLS and public storage buckets, API and LLM issues) against the OWASP WSTG and ASVS, verify each finding with evidence to kill false positives, then write a report with severity and remediation. Can also do a static secure-code review without running anything.
Often used withalbert-dmcost-reducertrigger-dev
0xSeroSkill0xSero/claude-skill-dir/security/SKILL.md
Security Analysis & Protection Expert Expert in security analysis, reverse engineering, intrusion detection, and system hardening. Specializes in using tools like Ghidra, forensics utilities, and security monitoring to ensure system safety
Often used withalbert-dmcost-reducertrigger-dev
AbdurRafay2004SkillAbdurRafay2004/handoff/skills/security/SKILL.md
Use for a full security audit — T3 verify gate (money, auth, user data, migrations), pre-launch check, or when the user asks to audit the codebase for vulnerabilities. For quick diff-scoped checks, prefer a host-provided security reviewer when available, otherwise apply this skill to the diff.
Often used withalbert-dmcost-reducertrigger-dev
daianepepes-labSkilldaianepepes-lab/claude-skills/security/SKILL.md
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Often used withalbert-dmcost-reducertrigger-dev
n-n-codeSkilln-n-code/n-n-code-skills/.agents/skills/security/SKILL.md
Evidence-grounded threat modeling, vulnerability review, and secure implementation. Use for explicit security audits or primary risks involving authorization, untrusted input, external requests, parsers/uploads, secrets, sensitive data, isolation, or release integrity. Not for routine implementation or non-security red-teaming. Add `security-identity-access` for identity and tenant authorization.
Often used withalbert-dmcost-reducertrigger-dev
plipowczanSkillplipowczan/claude-piv-skeleton/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withalbert-dmcost-reducertrigger-dev
RhovianSkillRhovian/niles/skills/security/SKILL.md
Use when security review is requested.
Often used withalbert-dmcost-reducertrigger-dev
sny-tanakaSkillsny-tanaka/tanacode/.claude/skills/security/SKILL.md
tanacode のセキュリティの対応の手順。Dependabot の警告・脆弱性の非公開の報告（Private vulnerability reporting）・コードスキャンとシークレットスキャンの警告への対応や、セキュリティの観点でのコードの点検をするときに使います。
Often used withalbert-dmcost-reducertrigger-dev
JustinK33SkillJustinK33/foreman/skills/security/SKILL.md
Use when the user asks for a security review, vulnerability scan, security audit, or to check code for security issues, front end or back end.
Often used withalbert-dmcost-reducertrigger-dev
zhaoxuya520Skillzhaoxuya520/reverse-skill/skills/api-security/SKILL.md
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
Often used withbinary-diffpentest-toolsllm-security
zhaoxuya520Skillzhaoxuya520/reverse-skill/skills/llm-security/SKILL.md
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Often used withattack-chainpentest-toolsbinary-diff
bchoxSkillbchox/agent-practices/skills/security/SKILL.md
Use when the change touches auth, secrets, trust boundaries, or sensitive data.
Often used withalbert-dmcost-reducertrigger-dev
Effulgent-PointSkillEffulgent-Point/paw/skills/security/SKILL.md
Security Skill **When to use:** Any code touching authentication, user input, external APIs, or sensitive data. ## OWASP Top 10 cheat sheet | # | Category | One-line check | |---|---|---| | A01 | Broken access control
Often used withalbert-dmcost-reducertrigger-dev
flywheel-productSkillflywheel-product/ai-build-skills/security/SKILL.md
Audit a vibe-coded web app's security against a practical checklist — RLS/auth, exposed secrets, signups, storage, IDOR, webhooks, headers, XSS. Tuned for React/Vite + Supabase on Netlify/Vercel/Cloudflare, with adaptations for Firebase and custom Node/Next APIs. Use whenever asked to do a security review/audit, check for vulnerabilities, find exposed secrets/keys, verify RLS or auth, harden an app before launch, or when the user types /security. Supports `/security --fix` (apply safe fixes on a branch) and `/security --grep` (offline CI-friendly scan only).
Often used withalbert-dmcost-reducertrigger-dev
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
