Claude skills and agent skills

lgzarturoSkill

security-grc

lgzarturo/codeconductor/.agents/skills/security-grc/SKILL.md

Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.

lgzarturoSkill

security-web

lgzarturo/codeconductor/.agents/skills/security-web/SKILL.md

Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.

lushun2014Skill

api-security

lushun2014/lushibo-skills/api-security/SKILL.md

API security testing for REST/GraphQL/WebSocket/SOAP: discovery, authz, BOLA/IDOR, JWT/OAuth, rate-limit, and CI-oriented validation workflows.

Often used withbinary-diff·pentest-tools·llm-security

lushun2014Skill

llm-security

lushun2014/lushibo-skills/llm-security/SKILL.md

LLM/agent security testing: prompt injection, tool abuse, data exfil paths, guardrail bypass research, and evaluation harnesses.

Often used withattack-chain·pentest-tools·binary-diff

Manu-del-sourceSkill

security-api

Manu-del-source/ai-security-audit/skills/security-api/SKILL.md

Audit application APIs for broken authorization, unsafe input handling, injection, excessive data exposure, webhook trust failures, and business-logic abuse. Use for API or backend security reviews.

omdenkar2-uiSkill

aio-security

omdenkar2-ui/all-in-one/skills/aio-security/SKILL.md

Audit backend trust boundaries, agent tools, tenant access and data exposure. Default to static inspection; use controlled reproduction and authorized hardening when requested.

prasadmogulothuSkill

rls-security

prasadmogulothu/agent-skills/rls-security/SKILL.md

Generate row-level-security policies plus a cross-user isolation test, so users can only access their own rows. Written for Postgres/Supabase; adaptable to other databases. Use for any per-user or multi-tenant data.

thanvish21Skill

security-scan

thanvish21/hcc-bundle/security-scan/SKILL.md

Automated security scanning in Hermes workflows

Often used withdjango-security·deployment-patterns·postgres-patterns

TheurgicDuke771Skill

security-scan

TheurgicDuke771/DataQ/.claude/skills/security-scan/SKILL.md

Run the end-of-week security scan (CONTRIBUTING rule 36) — Dependabot + secret-scanning alerts, local pip-audit/pnpm-audit mirror of the CI gates, betterleaks sweep, OWASP spot check on endpoints added this week, Key Vault access audit, and the credential-rotation register. Use weekly, before a deploy, or when the user asks "run the security scan" / "any open vulns?".

Often used withdjango-security·deployment-patterns·postgres-patterns

troskaterSkill

security-scan

troskater/flowdeck-claude/skills/security-scan/SKILL.md

Pre-commit security scan covering secrets, injection, auth, CVE dependencies. Returns PASS/FAIL verdict with severity-ranked findings and specific remediations.

Often used withdjango-security·deployment-patterns·postgres-patterns

UfukCetinkaya57Skill

security-scan

UfukCetinkaya57/backend-governance/.claude/skills/security-scan/SKILL.md

Sistematik guvenlik tarama proseduru - otomatik pattern arama ve risk tespiti

Often used withdjango-security·deployment-patterns·postgres-patterns

ValuatumOySkill

security-scan

ValuatumOy/Claude_skills/skills/security-scan/SKILL.md

Scans code for security vulnerabilities before they reach production. Use this skill whenever the user asks to check for security issues, vulnerabilities, or security problems in their code — including phrases like "scan for vulnerabilities", "security review", "check for bugs", "is this code safe", "before I push this", "pentest my code", "security audit", "look for XSS/SQLi/injection", or any time the user is about to deploy or open a PR. Also trigger proactively when the user is writing authentication, database queries, file handling, API routes, or anything that touches user input.

Often used withdjango-security·deployment-patterns·postgres-patterns

YosoyepaSkill

wct-security

Yosoyepa/write-check-trust/.claude/skills/wct-security/SKILL.md

Run and interpret WCT static security, secret, dependency vulnerability, and SBOM checks. Use for security review, dependency upgrades, trust-boundary code, leaked credentials, or G-SAST, G-SECRET, G-CVE, and G-SBOM failures.

vivy-yiSkill

account-security

vivy-yi/xiaohongshu-skills/skills/05-平台规则/account-security/SKILL.md

Use when protecting Xiaohongshu account from unauthorized access, preventing account theft, recovering compromised accounts, or implementing security measures to safeguard account and follower base

brenorbSkill

security-audit

brenorb/freedom-skills/skills/security-audit/SKILL.md

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Often used withcreate-stories·community-led-growth·story-done

EL4CTEOSkill

roblox-security

EL4CTEO/roblox-skills/skills/roblox-security/SKILL.md

Anti-exploit design - never trust the client, validate every remote argument (NaN, spoofed instances, strings), rate limiting, ProximityPrompt/ClickDetector abuse, network ownership, movement and hit validation, economy/trade duplication, code confidentiality, secure teleports, Device Trust API, heuristics, Ban API. Use when writing server handlers for client input, combat/economy/trading, or reviewing for exploits.

dirienSkill

security-audit

dirien/yet-another-agent-harness/.claude/skills/security-audit/SKILL.md

Comprehensive security audit covering OWASP Top 10, secrets detection, supply chain security, threat modeling, and language-specific vulnerability patterns. Investigates actual code paths rather than grep-matching keywords. Generates a scored SECURITY_AUDIT.md with prioritized remediation. Use when assessing application security, preparing for a security review, or onboarding to a codebase with security concerns.

Often used withcreate-stories·community-led-growth·story-done

germanfndezSkill

fivem-security

germanfndez/fiveai-skills/skills/fivem-security/SKILL.md

Trigger: security, anti-cheat, exploit, secure events, validate client data, server authority, distance check, rate limit, review server code. Harden FiveM net events and server-side validation.

TwigpineSkill

security-audit

Twigpine/openclaude-skills/skills/security-audit/SKILL.md

Reviews code changes for common security risks.

Often used withcreate-stories·community-led-growth·story-done

songjiun10-collabSkill

security-review

songjiun10-collab/Senior-thinking-skills/security-review/SKILL.md

Review security-sensitive code changes before they ship — injection, broken auth, access control, secrets, data exposure — for diffs touching auth, user input, APIs, databases, or credentials. Use before a PR or merge when the change touches security-relevant paths, when adding an endpoint or auth flow, or when handling user input or credentials. Skip for diffs with no security surface (UI-only, docs, refactors with no input or trust-boundary change).

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example