Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Hassaan146SkillHassaan146/claude-skills/cloud-security/SKILL.md
Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.
PL-Coding-GmbHSkillPL-Coding-GmbH/Skills/skills/react-security/SKILL.md
Client-side security for React SPAs that use token-based auth against their own API - access tokens kept in memory only, session state in core/auth, the fetchWithAuth wrapper with one shared in-flight refresh and a single retry on 401, a rotating refresh token in an httpOnly SameSite=Strict cookie that JavaScript never sees, restoring a session on startup through the refresh endpoint, ending a session (clearing the token, the Query cache and user-scoped storage, notifying other tabs), coordinating refreshes across tabs, route guards as UX only, safe post-login redirects, XSS rules (dangerouslySetInnerHTML, user-provided URLs, target=_blank), public VITE_ variables, CSP compatibility, logging, password-manager-friendly forms, and dependency hygiene. Use this skill whenever touching login, logout, registration, tokens, the session, the auth header, 401 handling, protected routes, redirects after login, rendering user-provided HTML or URLs, environment variables, browser storage, third-party scripts, or security headers. Trigger on phrases like "security", "auth", "cookie", "httpOnly", "SameSite", "CSRF", "login", "logout", "sign in", "session", "access token", "refresh token", "Authorization header", "401", "protected route", "redirect after login", "localStorage", "sessionStorage", "XSS", "dangerouslySetInnerHTML", "sanitize", "DOMPurify", "javascript: URL", "target=_blank", "CSP", "Content Security Policy", "secret", "API key", "VITE_", "password field", or "autocomplete".
EyadkellehSkillEyadkelleh/awesome-claude-skills-security/skills/security-fuzzing/SKILL.md
Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.
hoangsonwwSkillhoangsonww/AI-Agents-Orchestrator/.agents/skills/security-review/SKILL.md
Review code changes for security vulnerabilities, authentication gaps, injection risks, and unsafe patterns. Use before merging PRs or after security-sensitive changes.
Often used withlinkerd-patternsdependency-cve-sweepproject-guidelines-example
awarexoneSkillawarexone/AXguard/cloud-security/SKILL.md
Review cloud and CORS misconfiguration in app code and IaC-adjacent configs — metadata URLs, public buckets, wildcard origins (CWE-918 / CWE-942 / A05:2021 / A10:2021).
awarexoneSkillawarexone/AXguard/oauth-security/SKILL.md
Analyze OAuth/OIDC integration security — use when reviewing redirect URIs, state/nonce, token handling, PKCE, or confused-deputy risks in authorization code flows (CWE-601 / A07:2021 / API2:2023).
awarexoneSkillawarexone/AXguard/session-security/SKILL.md
Analyze session management security — use when reviewing cookie flags, session fixation, timeout, logout, concurrent sessions, or server-side session stores (A07:2021 / CWE-287 / CWE-352 adjacency).
CloudChefSkillCloudChef/atlasclaw-providers/skills/azure-security/SKILL.md
Expert knowledge for Azure Security development including troubleshooting, best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when securing AKS workloads, SBOMs, Notation image signing, Key Vault/HSM keys, or Customer Lockbox access, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Firewall (use azure-firewall), Azure DDos Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).
dawn840705Skilldawn840705/codex-code-studios/skills/security-audit/SKILL.md
Audit the game for security vulnerabilities: save tampering, cheat vectors, network exploits, data exposure, and input validation gaps. Produces a prioritised security report with remediation guidance. Run before any public release or multiplayer launch.
Often used withcreate-storiescommunity-led-growthstory-done
liuyi0808Skillliuyi0808/android-review/skills/security-audit/SKILL.md
Android application security audit based on OWASP MASVS v2.0 and Kotlin secure coding practices. Use when: writing or reviewing code involving sensitive data storage (SharedPreferences, Room), cryptography (encryption keys, Keystore), authentication (biometrics, token management), network security (TLS, cert pinning), WebView hardening, Content Provider security, reverse engineering resilience (root detection, tamper detection), or user privacy (data minimization, consent).
Often used withcreate-storiescommunity-led-growthstory-done
s-hiraokuSkills-hiraoku/synapse-a2a/.agents/skills/security-audit/SKILL.md
General-purpose security auditing guide. Covers OWASP Top 10, dependency vulnerabilities, authentication, authorization, input validation, and secret management. Use this when performing a security review or audit.
Often used withcreate-storiescommunity-led-growthstory-done
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
