ffsshhttiikkReads credentialsSkillsecurity
ffsshhttiikk/opencode-agents-skills/security/SKILL.md
Security best practices and patterns
Often used withalbert-dmcost-reducertrigger-dev
Claude skills and agent skills
Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Best matches · from page 4Worked for most · soon
ffsshhttiikkReads credentialsSkill
flywheel-productSkillsecurity
flywheel-product/ai-build-skills/security/SKILL.md
Audit a vibe-coded web app's security against a practical checklist — RLS/auth, exposed secrets, signups, storage, IDOR, webhooks, headers, XSS. Tuned for React/Vite + Supabase on Netlify/Vercel/Cloudflare, with adaptations for Firebase and custom Node/Next APIs. Use whenever asked to do a security review/audit, check for vulnerabilities, find exposed secrets/keys, verify RLS or auth, harden an app before launch, or when the user types /security. Supports `/security --fix` (apply safe fixes on a branch) and `/security --grep` (offline CI-friendly scan only).
Often used withalbert-dmcost-reducertrigger-dev
gingermindsReads credentialsSkillsecurity
gingerminds/claude-skills/skills/security/SKILL.md
Audits a project's dependency and infrastructure security — runs composer/npm audit, checks CMS/framework security advisories, reviews the Docker setup, ranks every finding by exploitable criticality, and either applies safe fixes or gives exact step-by-step remediation. Stack-agnostic: pulls stack-specific advisory checks (e.g. Drupal SAs) from the loaded stack/ resource. Use when the user asks for a security audit, a CVE/vulnerability check, a dependency-security pass, or invokes /gm:security.
Often used withalbert-dmcost-reducertrigger-dev
joeldevzSkillsecurity
joeldevz/skynex-pi/skills/security/SKILL.md
On-demand security audit of code, config, or infrastructure. Use when the user wants security review outside the normal /skill:validate flow.
Often used withalbert-dmcost-reducertrigger-dev
subhansh-devSkillSECURITY
subhansh-dev/agent-maxxing/SECURITY/SKILL.md
Security Policy ## Reporting a Vulnerability If you discover a security vulnerability in this project, please report it responsibly. Do NOT open a public GitHub issue for security vulnerabilities. Open
Often used withalbert-dmcost-reducertrigger-dev
tomas-uSkillsecurity
tomas-u/claude-skills/security/SKILL.md
Expert security architect providing comprehensive security guidance, architecture assessments, threat modeling, and compliance verification. Follows OWASP, NIS2, ISO 27001, NIST, and industry best practices. Use for security architecture design and review, threat modeling, security strategy, compliance assessment (OWASP, NIS2, GDPR, PCI DSS, SOC 2), infrastructure security, API security patterns, and incident response planning. For code-level security reviews, use the code-review skill.
Often used withalbert-dmcost-reducertrigger-dev
aibytalesReads credentialsSkillsecurity
aibytales/claude-skills-pack/skills/security/SKILL.md
Audits code before it ships. Use before any deploy, release, pull request or when the user says ship, launch or go live.
Often used withalbert-dmcost-reducertrigger-dev
AllThingsSmittySkillsecurity
AllThingsSmitty/proven-skills/skills/security/SKILL.md
Security review for code, APIs, and system designs. Always use this skill when reviewing code for vulnerabilities, auditing authentication or authorization, evaluating input handling, checking for secrets or hardcoded credentials, reviewing dependencies, or threat modeling. Use when the user says "is this secure", "review this for security issues", "could this be exploited", "check for vulnerabilities", "threat model this", "review for SQL injection", "is this JWT implementation safe", or "is my auth correct". Also use proactively when implementing auth, handling untrusted input, or storing sensitive data.
Often used withalbert-dmcost-reducertrigger-dev
Autocss-comReads credentialsSkillsecurity
Autocss-com/ai/.agents/skills/security/SKILL.md
Security rules for projects following the air-gapped, declarative-first architecture. Covers Content Security Policy, recommended security headers, and the architectural decisions that enable a strict CSP without unsafe-inline or unsafe-eval. Use when configuring deployment, reviewing CSP, or auditing for inline-script or inline-style violations.
Often used withalbert-dmcost-reducertrigger-dev
BappozSkillsecurity
Bappoz/My-Claude-Skills/skills/engineering/security/SKILL.md
Segurança de aplicações production-grade: OWASP Top 10, autenticação/autorização, gestão de segredos, threat modeling (STRIDE), validação de input e secure defaults. Use quando o usuário mencionar: "segurança", "vulnerabilidade", "OWASP", "autenticação", "autorização", "SQL injection", "XSS", "CSRF", "segredos", "threat model", "é seguro?", "hardening", "pentest". Não auxilia ataques maliciosos — foco em defesa e testes autorizados.
Often used withalbert-dmcost-reducertrigger-dev
caglarbaranboraSkillsecurity
caglarbaranbora/Apple-Agent-Kit/skills/security/SKILL.md
Route Keychain Services implementation tasks to the correct Knowledge Contracts -- item CRUD via SecItemAdd/SecItemCopyMatching/SecItemUpdate/SecItemDelete, accessibility levels, access groups and sharing, and storing structured/Codable data. Use when working with kSecClassGenericPassword, kSecClassInternetPassword, OSStatus, errSecSuccess, errSecItemNotFound, errSecDuplicateItem, kSecAttrAccessible, kSecAttrAccessGroup, Keychain Sharing, or kSecValueData. v1 is general (non-biometric-bound) Keychain item CRUD for generic/internet password items -- no SecAccessControl/biometric binding, no AutoFill/credential providers, no iCloud Keychain sync, no certificate/key/identity item classes. Triggers on SecItemAdd, SecItemCopyMatching, SecItemUpdate, SecItemDelete, kSecClassGenericPassword, kSecClassInternetPassword, kSecAttrAccessible, kSecAttrAccessGroup, Keychain access group, kSecValueData, Keychain, credential storage.
Often used withalbert-dmcost-reducertrigger-dev
cwklurksSkillsecurity
cwklurks/ship-score/skills/security/SKILL.md
Security Category — Ship Score Sub-Skill You are running the **Security** category of a Ship Score production readiness audit. Follow every instruction below precisely. Do not add checks beyond
Often used withalbert-dmcost-reducertrigger-dev
efficience-itReads credentialsSkillsecurity
efficience-it/claude-skills-php/.claude/skills/security/SKILL.md
Audit de sécurité rapide pour projet PHP/Symfony. Analyse les fichiers modifiés ou un périmètre donné. Détecte injections SQL, XSS, CSRF, exposition de données, permissions manquantes. Basé sur OWASP Top 10. Utiliser avant un commit ou pour auditer un périmètre.
Often used withalbert-dmcost-reducertrigger-dev
huyvpSkillsecurity
huyvp/claude-skills/security/SKILL.md
Secure web and desktop application development. Use when writing authentication, authorization, API endpoints, form handling, database queries, file uploads, Electron apps, Tauri apps, IPC handlers, cryptography, secrets management, security headers, input validation, or when reviewing code for vulnerabilities. Covers OWASP Top 10, XSS, CSRF, SQL injection, SSRF, command injection, path traversal, and desktop app security.
Often used withalbert-dmtrigger-devscalability
ksed8Skillsecurity
ksed8/cc-loopkit/.claude/skills/security/SKILL.md
Security audits and threat modeling — find and reason about vulnerabilities in auth, input handling, data access, secrets, and dependencies. Use when reviewing code for security, threat-modeling a feature, hardening an endpoint, handling auth/authz, or checking for injection, secret leakage, or unsafe data exposure. For a focused review of the current diff, prefer the `/security-review` command.
Often used withalbert-dmcost-reducertrigger-dev
michaelsvanbeekReads credentialsSkillsecurity
michaelsvanbeek/personal-agent-skills/skills/security/SKILL.md
Application security standards and hardening practices. Use when: reviewing code for vulnerabilities, implementing authentication, configuring CORS, adding input validation, managing secrets, scanning dependencies, setting CSP headers, reviewing IAM policies, auditing an existing application for OWASP top 10 vulnerabilities, or hardening an existing deployment. Covers OWASP top 10, secrets management, dependency auditing, and security headers.
Often used withalbert-dmcost-reducertrigger-dev
musterd-ioSkillsecurity
musterd-io/musterd/.agents/skills/security/SKILL.md
The security role — the member who owns the team's application-security evidence (threat models, authorized scans, validated findings, private disclosure, the smallest defensible fix, and honest posture claims). Use when threat-modeling a system or a change, reviewing code or a workflow for security, running or reading a scanner, judging whether a finding is real and how severe, handling a leaked secret, reviewing a new dependency or the release pipeline, or writing anything public about security.
Often used withalbert-dmcost-reducertrigger-dev
precise-alloySkillsecurity
precise-alloy/ritus/skills/security/SKILL.md
Loaded automatically by execute-task and verify-task when changes touch auth, billing, migration, tenant isolation, infra, or shared contracts - security checklist. Do not invoke standalone unless the user specifically asks for a security review
Often used withalbert-dmcost-reducertrigger-dev
QinAnzeReads credentialsSkillsecurity
QinAnze/SKILLS/skills/before-push-v2/security/SKILL.md
安全审计与加固。覆盖SAST/SCA/密钥扫描/STRIDE威胁建模/合规检查，按语言特定工具链识别漏洞并提供修复方案。Use when the user asks to check security, scan for vulnerabilities, audit code, or prepare for compliance.
Often used withalbert-dmcost-reducertrigger-dev
Rajveerx11Skillsecurity
Rajveerx11/skills/skills/checking/security/SKILL.md
Design, review, harden, or repair web and desktop application security. Use for authentication, authorization, tenancy, APIs, forms, databases, file uploads, SSRF, XSS, CSRF, injection, secrets, cryptography, dependencies, Electron/Tauri IPC, security headers, threat modeling, or evidence-backed vulnerability review and regression testing.
Often used withalbert-dmcost-reducertrigger-dev
About skills
What is a Claude skill?
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.