Run an authorized security review of a web app you own or are cleared to test, especially local and dev builds. Dev mode finds the running dev server, writes the scope itself and screens the build end to end with no setup questions. Works in phases that confirm authorization and scope, map the attack surface, then test for common vulnerability classes (injection, broken auth and access control, SSRF and server-side, XSS and client-side, session handling, business logic, misconfiguration, exposed secrets, secrets and tokens visible in the browser, client-controlled values like role and price, tables without RLS and public storage buckets, API and LLM issues) against the OWASP WSTG and ASVS, verify each finding with evidence to kill false positives, then write a report with severity and remediation. Can also do a static secure-code review without running anything.
Security Analysis & Protection Expert
Expert in security analysis, reverse engineering, intrusion detection, and system hardening. Specializes in using tools like Ghidra, forensics utilities, and security monitoring to ensure system safety
Use for a full security audit — T3 verify gate (money, auth, user data, migrations), pre-launch check, or when the user asks to audit the codebase for vulnerabilities. For quick diff-scoped checks, prefer a host-provided security reviewer when available, otherwise apply this skill to the diff.
Scan a brownfield PHP codebase for OWASP Top 10 issues, secrets committed to the repo, CSRF and auth gaps, and injection patterns, and emit evidence-backed AUD-SEC findings ranked by ROI with remediation cross-linked to security skills. Use when the user needs a ranked OWASP-mapped findings report for a PHP project — injection, CSRF, auth gaps, insecure config — prioritised by ROI so the riskiest cheap fixes come first; the user wants to find secrets committed to the repo — API keys, passwords, private keys, tokens in `.env`, config, or history — and record them as findings; the user asks to security-audit or pentest-review an existing PHP codebase for OWASP Top 10 issues, injection, CSRF, broken auth, or misconfiguration, wanting ranked findings. Keywords: audit, security, findings, roi, report, owasp, secrets, csrf, injection, auth, input, brownfield.
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Evidence-grounded threat modeling, vulnerability review, and secure implementation. Use for explicit security audits or primary risks involving authorization, untrusted input, external requests, parsers/uploads, secrets, sensitive data, isolation, or release integrity. Not for routine implementation or non-security red-teaming. Add `security-identity-access` for identity and tenant authorization.
Security patterns and frameworks. Use when reviewing code for vulnerabilities, designing authentication/authorization, writing IAM policies, handling secrets, or discussing threat models.
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
MarvelCollinSkill
