Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
AhmedAbdelfattah0Reads credentialsSkillAhmedAbdelfattah0/AI-Skills/skills/security/SKILL.md
Secure-by-default coding practices that stop fast-moving work from shipping a vulnerability — apply them by default, even when unasked.
Often used withcost-reduceralbert-dmscalability
daianepepes-labSkilldaianepepes-lab/claude-skills/security/SKILL.md
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Often used withcost-reduceralbert-dmscalability
MarvelCollinSkillMarvelCollin/agent-skills/skills/security/SKILL.md
Run an authorized security review of a web app you own or are cleared to test, especially local and dev builds. Dev mode finds the running dev server, writes the scope itself and screens the build end to end with no setup questions. Works in phases that confirm authorization and scope, map the attack surface, then test for common vulnerability classes (injection, broken auth and access control, SSRF and server-side, XSS and client-side, session handling, business logic, misconfiguration, exposed secrets, secrets and tokens visible in the browser, client-controlled values like role and price, tables without RLS and public storage buckets, API and LLM issues) against the OWASP WSTG and ASVS, verify each finding with evidence to kill false positives, then write a report with severity and remediation. Can also do a static secure-code review without running anything.
Often used withcost-reduceralbert-dmscalability
n-n-codeSkilln-n-code/n-n-code-skills/.agents/skills/security/SKILL.md
Evidence-grounded threat modeling, vulnerability review, and secure implementation. Use for explicit security audits or primary risks involving authorization, untrusted input, external requests, parsers/uploads, secrets, sensitive data, isolation, or release integrity. Not for routine implementation or non-security red-teaming. Add `security-identity-access` for identity and tenant authorization.
Often used withcost-reduceralbert-dmscalability
plipowczanSkillplipowczan/claude-piv-skeleton/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withcost-reduceralbert-dmscalability
pluginagentmarketplaceReads credentialsSkillpluginagentmarketplace/custom-plugin-backend/skills/security/SKILL.md
Secure backend applications against OWASP threats. Implement authentication, encryption, scanning, compliance, and incident response procedures.
Often used withcost-reduceralbert-dmscalability
sny-tanakaSkillsny-tanaka/tanacode/.claude/skills/security/SKILL.md
tanacode のセキュリティの対応の手順。Dependabot の警告・脆弱性の非公開の報告（Private vulnerability reporting）・コードスキャンとシークレットスキャンの警告への対応や、セキュリティの観点でのコードの点検をするときに使います。
Often used withcost-reduceralbert-dmscalability
umararshad4Reads credentialsSkillumararshad4/honey-stack/skills/security/SKILL.md
Use when touching auth, sessions, permissions, secrets, payments, user data, DB writes, webhooks or deploy config, or when asked for a security audit.
Often used withcost-reduceralbert-dmscalability
yoonationReads credentialsSkillyoonation/ai-grounded/.claude/skills/security/SKILL.md
Security patterns and frameworks. Use when reviewing code for vulnerabilities, designing authentication/authorization, writing IAM policies, handling secrets, or discussing threat models.
Often used withcost-reduceralbert-dmscalability
JustinK33SkillJustinK33/foreman/skills/security/SKILL.md
Use when the user asks for a security review, vulnerability scan, security audit, or to check code for security issues, front end or back end.
Often used withcost-reduceralbert-dmscalability
vndeeReads credentialsSkillvndee/engineering-skills/.claude/skills/security/SKILL.md
Use when implementing authentication, authorization, input validation, or security hardening in Go, Python, or React applications
Often used withcost-reduceralbert-dmscalability
wangqiqiPipes a download into a shellSkillwangqiqi/cursor-ai/.cursor/skills/security/SKILL.md
合并前安全审查 — auth、密钥、PII、支付/webhook/敏感交易。
Often used withcost-reduceralbert-dmscalability
zhaoxuya520Skillzhaoxuya520/reverse-skill-private/skills/api-security/SKILL.md
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
Often used withattack-chainllm-securitypentest-tools
zhaoxuya520Skillzhaoxuya520/reverse-skill-private/skills/llm-security/SKILL.md
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Often used withattack-chainpentest-toolsbinary-diff
bchoxSkillbchox/agent-practices/skills/security/SKILL.md
Use when the change touches auth, secrets, trust boundaries, or sensitive data.
Often used withcost-reduceralbert-dmscalability
Effulgent-PointSkillEffulgent-Point/paw/skills/security/SKILL.md
Security Skill **When to use:** Any code touching authentication, user input, external APIs, or sensitive data. ## OWASP Top 10 cheat sheet | # | Category | One-line check | |---|---|---| | A01 | Broken access control
Often used withcost-reduceralbert-dmscalability
ffsshhttiikkReads credentialsSkillffsshhttiikk/opencode-agents-skills/security/SKILL.md
Security best practices and patterns
Often used withcost-reduceralbert-dmtrigger-dev
flywheel-productSkillflywheel-product/ai-build-skills/security/SKILL.md
Audit a vibe-coded web app's security against a practical checklist — RLS/auth, exposed secrets, signups, storage, IDOR, webhooks, headers, XSS. Tuned for React/Vite + Supabase on Netlify/Vercel/Cloudflare, with adaptations for Firebase and custom Node/Next APIs. Use whenever asked to do a security review/audit, check for vulnerabilities, find exposed secrets/keys, verify RLS or auth, harden an app before launch, or when the user types /security. Supports `/security --fix` (apply safe fixes on a branch) and `/security --grep` (offline CI-friendly scan only).
Often used withcost-reduceralbert-dmscalability
gingermindsReads credentialsSkillgingerminds/claude-skills/skills/security/SKILL.md
Audits a project's dependency and infrastructure security — runs composer/npm audit, checks CMS/framework security advisories, reviews the Docker setup, ranks every finding by exploitable criticality, and either applies safe fixes or gives exact step-by-step remediation. Stack-agnostic: pulls stack-specific advisory checks (e.g. Drupal SAs) from the loaded stack/ resource. Use when the user asks for a security audit, a CVE/vulnerability check, a dependency-security pass, or invokes /gm:security.
Often used withcost-reduceralbert-dmscalability
subhansh-devSkillsubhansh-dev/agent-maxxing/SECURITY/SKILL.md
Security Policy ## Reporting a Vulnerability If you discover a security vulnerability in this project, please report it responsibly. Do NOT open a public GitHub issue for security vulnerabilities. Open
Often used withcost-reduceralbert-dmscalability
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
