Claude skills and agent skills

ffsshhttiikkSkill

app-security

ffsshhttiikk/opencode-agents-skills/app-security/SKILL.md

Expert-level knowledge and advanced techniques for App Security

INERATESkill

security-law

INERATE/atelier/skills/security-law/SKILL.md

The Atelier Security Law — OWASP-grade defense for every request path (injection, XSS, CSRF, tenant isolation, rate limiting, transport). Load before writing ANY endpoint, form, or data-processing code — not just auth. Auth token/session mechanics live in [[auth-law]]; this is everything else.

juninmdSkill

security-ops

juninmd/skills/.agents/skills/security-ops/SKILL.md

Audit dependencies, code, secrets, privacy, and access. Use for CVE scans, dependency registry publication age and provenance reviews, vulnerability audits, pen tests, Gitleaks, least privilege, threat modeling, LGPD/GDPR, and plugin/MCP vetting. Trigger on 'is this secure', 'run a security audit', 'we leaked a key', 'are we LGPD compliant', 'can I trust this plugin'.

JustineDevsSkill

llm-security

JustineDevs/premortem/.cursor/skills/llm-security/SKILL.md

LLM and AI agent security testing for prompt injection, RAG poisoning, MCP injection, and guardrail evaluation. Authorization required.

Often used withattack-chain·pentest-tools·binary-diff

kenhuangusSkill

security-scan

kenhuangus/defense-factory-skills/skills/security-scan/SKILL.md

Runs authorized defensive discovery across inventoried assets and writes finding candidates for the Defense Factory Discovery phase. Use for baseline or periodic scans, not for unauthorized offensive testing.

Often used withdjango-security·deployment-patterns·postgres-patterns

moh-obaidaReads credentialsSkill

web-security

moh-obaida/ReadyVibe-Skills/skills/security/web-security/SKILL.md

Use when preparing a public launch of a site or app that has client and server code, environment variables, accounts, or APIs, to find launch-blocking security mistakes: exposed secrets and client-side env misuse, missing authorization on routes and APIs, publicly reachable private routes, debug endpoints, unsafe redirects and rendering, and insecure session handling. It reports evidence and fixes clear low-risk issues. Do not use it as a penetration test, to claim a site is secure, to use or rotate credentials, or to treat a hidden admin link as authorization.

ronmkrReads credentialsSkill

security-scan

ronmkr/PromptBook/skills/technical/security-scan/SKILL.md

Scan your The Agent Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Often used withdjango-security·deployment-patterns·postgres-patterns

Rootx202Skill

api-security

Rootx202/appsec-skills/api-security/SKILL.md

Focused API security auditor for REST, GraphQL, and webhook endpoints in any stack. Use when the user is building or reviewing an API layer, mentions rate limiting, API keys, webhooks, CORS, or specifically wants "API security" checked — as opposed to a full-project audit.

Often used withbinary-diff·pentest-tools·llm-security

seikaikyoSkill

security-scan

seikaikyo/dash-skills/skills/security-scan/SKILL.md

用外部掃描工具對 repo 做相依漏洞、機密外洩、SAST 三層檢查，並把結果對回 OWASP Top 10:2025 分類。適用：面試或對外發布前的作品體檢、接手不熟的 repo、想確認自己的修正經得起獨立工具驗證。不適用：判斷認證邏輯對不對、權限有沒有寫錯這類要讀懂程式意圖的問題，那要人或 agent 讀碼。

Often used withdjango-security·deployment-patterns·postgres-patterns

TorpedoDReads credentialsSkill

security-scan

TorpedoD/claude-sentinel/skills/security-scan/SKILL.md

12-tool security audit — SAST, secrets, SBOM, SCA, AI-skill safety, and hidden-instruction detection via a single slash command

Often used withdjango-security·deployment-patterns·postgres-patterns

TsinHzlReads credentialsSkill

security-scan

TsinHzl/claude-code-config/skills/security-scan/SKILL.md

使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。

Often used withdjango-security·deployment-patterns·postgres-patterns

OpenCovenSkill

security-agent

OpenCoven/coven/skills/security-agent/SKILL.md

Comprehensive OpenClaw security assessment, hardening, and monitoring agent. Covers 7 domains — gateway hardening, channel/sender policy, tool/exec policy, credential hygiene, prompt injection defense, host OS hardening, and continuous monitoring. Use when asked to audit security, harden the setup, check for exposed secrets, assess threat model, schedule security monitoring, respond to potential compromise, fix security audit findings, or review OpenClaw config safety. Triggers on phrases like "security audit", "harden my setup", "check my security", "exposed secrets", "am I secure", "security agent", "threat model", "I think I'm compromised", "fix security warnings", "security posture".

mizchiReads credentialsSkill

security-expert

mizchi/skills/security-expert/SKILL.md

Security specialist perspective for the weekly review. Focuses on XSS/CSRF, authorization boundaries, input validation, secrets handling, and dependency CVEs.

CosmianReads credentialsSkill

security-review

Cosmian/kms/.github/skills/security-review/SKILL.md

AI-powered security scanner — OWASP Top 10, CWE Top 25, KMIP authorization, FIPS gating, memory safety, side-channel, supply chain, and 20 vulnerability families. Use when asked to review code security, audit KMIP access control, or scan for vulnerabilities.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

tranhieuttReads credentialsSkill

security-audit

tranhieutt/software_development_department/.claude/skills/security-audit/SKILL.md

name: security-audit type: workflow description: "Conducts a comprehensive security audit covering web application vulnerabilities, API security, OWASP Top 10, and security hardening recommendations. Use when auditing a codebase

Often used withcreate-stories·community-led-growth·story-done

wgpsecSkill

ai-data-security

wgpsec/AboutSecurity/skills/ai-security/ai-data-security/SKILL.md

AI 系统数据安全测试方法论。当需要评估 LLM/AI 系统的数据泄露风险、训练数据安全、 或 RAG/向量库数据完整性时触发。覆盖: System Prompt 泄露(元 Prompt/角色扮演/关键字定位)、 训练数据推导与提取、成员推断攻击、模型反演攻击、RAG 数据投毒、API 信息泄露、 级联幻觉攻击、外部数据源信息泄露。

No other project uses it yet

kousenSkill

security-review

kousen/claude-code-training/skills/security-review/SKILL.md

Read-only security audit of code for SQL injection, XSS, auth/authz flaws, input validation gaps, sensitive data exposure, and insecure cryptography. Surfaces findings without modifying code.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

ebibibiReads credentialsSkill

security-audit

ebibibi/claude-code-discord-bridge/.claude/skills/security-audit/SKILL.md

Security checklist specific to claude-code-discord-bridge — subprocess injection, env leaks, input validation

Often used withcreate-stories·community-led-growth·story-done

lgbarnReads credentialsSkill

security-audit

lgbarn/shipyard/skills/security-audit/SKILL.md

Audits code for OWASP Top 10 issues, secrets in code (API keys, passwords, tokens), dependency vulnerabilities, IaC security, Docker hardening, and supply chain risks. Use when working with code that handles user input, authentication, authorization, or secrets. Also use when adding or updating dependencies, reviewing infrastructure-as-code, or before claiming security posture is adequate. Applies when code touches a database query, HTTP endpoint, or config file with credentials.

Often used withcreate-stories·community-led-growth·story-done

ww-w-aiReads credentialsSkill

bkend-security

ww-w-ai/bkit-gemini/skills/bkend-security/SKILL.md

bkend.ai security policies and encryption expert skill. Covers API key management (Public vs Secret), Row Level Security (RLS) with 4 roles (admin/user/guest/self), data encryption (Argon2id, AES-256-GCM, TLS 1.2+), and security best practices.