Claude skills and agent skills

first-flukeSkill

oma-security

first-fluke/oh-my-agent/skills/oma-security/SKILL.md

Scan application source, agent skills, and MCP components; run

ruvnetSkill

security-audit

ruvnet/claude-flow/.agents/skills/security-audit/SKILL.md

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.

Often used withcreate-stories·community-led-growth·story-done

openclawSkill

security-triage

openclaw/openclaw/.agents/skills/security-triage/SKILL.md

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

awarexonePipes a download into a shellSkill

cicd-security

awarexone/Agentic-Bug-Hunter/skills/cicd-security/SKILL.md

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

zhaoxuya520Skill

email-security

zhaoxuya520/reverse-skill/skills/email-security/SKILL.md

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

GitHubReads credentialsSkill

spring-security

github/awesome-copilot/skills/spring-security/SKILL.md

Configure, test and review Spring Security 6/7 in Spring Boot 3/4 apps: SecurityFilterChain lambda DSL, method security, OAuth2 resource server with JWT, OIDC login, CSRF/CORS, password encoding, headers, actuator protection, and MockMvc security tests. Use when adding or auditing authentication and authorization.

PostHogReads credentialsSkill

security-audit

PostHog/posthog/.agents/skills/security-audit/SKILL.md

Threat-model-driven security audit of a change. Build a threat model from the diff, PR, commits, and product purpose, then assess the implementation against each threat. Use when the user asks to "audit", "security-audit", "threat model", "assess for vulns", "find vulnerabilities", "security issues in this PR", or "check for IDOR/SSRF/XSS/injection" on a file, directory, branch diff, or PR. Covers access control, injection, auth/secrets, sensitive data, business logic, web boundary, and AI agent/LLM trifecta risks. Produces severity- and confidence-ranked findings with data flow, exploit request, and fix — no theoretical or defense-in-depth nits. Handles the GitHub review follow-up for a PR target and a reproducer test plus fix for a local branch.

Often used withcreate-stories·community-led-growth·story-done

DonchitosSkill

security-audit

Donchitos/Claude-Code-Game-Studios/.claude/skills/security-audit/SKILL.md

Security audit — save tampering, cheat vectors, network exploits, data exposure, input validation. Before public or multiplayer release.

Often used withcreate-stories·community-led-growth·story-done

affaan-mReads credentialsSkill

security-review

affaan-m/ECC/.agents/skills/security-review/SKILL.md

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

CloudflareSkill

security-audit

cloudflare/security-audit-skill/skills/security-audit/SKILL.md

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Often used withcreate-stories·community-led-growth·story-done

rommappPipes a download into a shellSkill

security-audit

rommapp/romm/.claude/skills/security-audit/SKILL.md

Audit a diff (a release tag range or a PR branch) for anything malicious or a serious security regression before shipping/merging. Use when asked to "check this release", "make sure nothing malicious slipped in", "security review this PR", or vet upstream/contributor changes. Covers supply chain, egress/exfiltration, auth/injection/traversal, CI/infra, and commit provenance, with a fast direct pass plus fanned-out deep review. Trigger on any "is this change safe?" request over a diff.

Often used withcreate-stories·community-led-growth·story-done

kubesharkReads credentialsSkill

security-audit

kubeshark/kubeshark/skills/security-audit/SKILL.md

Kubernetes network security audit skill powered by Kubeshark MCP. Use this skill whenever the user wants to audit a cluster for security threats, detect compromised workloads, find malicious traffic patterns, hunt for indicators of compromise (IOCs), check for data exfiltration, identify C2 (command and control) communication, detect cryptomining, find lateral movement, discover credential theft attempts, assess network security posture, or perform threat hunting in Kubernetes. Also trigger when the user mentions security audit, threat detection, compromise assessment, vulnerability scan, "is my cluster compromised", "find malicious traffic", "check for threats", DNS exfiltration, DNS tunneling, port scanning, IMDS access, reverse shell, crypto miner, MITRE ATT&CK, IOC detection, anomaly detection, suspicious traffic, rogue workloads, unauthorized access, or any request to evaluate cluster security through network traffic analysis.

Often used withcreate-stories·community-led-growth·story-done

AnthropicSkill

claude-security

anthropics/claude-plugins-official/plugins/claude-security/skills/claude-security/SKILL.md

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.

GitHubReads credentialsSkill

security-review

github/awesome-copilot/skills/security-review/SKILL.md

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

monoSkill

security-audit

mono/SkiaSharp/.agents/skills/security-audit/SKILL.md

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline. Read-only investigation that produces a status report with recommendations.

Often used withcreate-stories·community-led-growth·story-done

langfuseSkill

security-review

langfuse/langfuse/.agents/skills/security-review/SKILL.md

Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy. Use when a design or change accepts URLs or host fields, handles secrets or cross-tenant data, makes outbound requests, adds an integration, follows redirects, widens permissions, or can send customer-controlled UI data through analytics, monitoring, or session replay.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

symfonySkill

security-triage

symfony/symfony/.agents/skills/security-triage/SKILL.md

Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter). Assigns severity and affected maintained branches, and routes to the next step. Use when the user says "does this need a CVE", "CVE or hardening", "triage this report", "is this a security issue", "classify this finding", or "how should we disclose this".

wekanSkill

meteor-security

wekan/wekan/.agents/skills/meteor-security/SKILL.md

Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow/deny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).

MaxMiksaSkill

security-audit

MaxMiksa/Auto-Company/.claude/skills/security-audit/SKILL.md

Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.

Often used withcreate-stories·community-led-growth·story-done

marketcallsReads credentialsSkill

security-audit

marketcalls/openalgo/.claude/skills/security-audit/SKILL.md

Run OpenAlgo's periodic security audit across backend, frontend, database, cache, routes and dependencies, producing a dated xlsx report. Use for the monthly or twice-monthly review, before a release, after a dependency bump, or when the user asks for a security check, vulnerability scan, or audit report.

Often used withcreate-stories·community-led-growth·story-done