Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
OpenAISkillopenai/plugins/plugins/codex-security/skills/security-scan/SKILL.md
Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.
Often used withdjango-securitydeployment-patternspostgres-patterns
AdversisSkillAdversis/skills/skills/security/SKILL.md
Entry point for the Adversis security plugin. Asks what you are trying to accomplish and routes you to the right skill: lint-baseline, threat-model, or security-persona. Start here.
Often used withcost-reducerscalabilitytrigger-dev
ArthurZakirovReads credentialsSkillArthurZakirov/SystemSmith/skills/security/SKILL.md
Mandatory credential protection skill for all agents. Prevents reading, exposing, or leaking credentials, secrets, API keys, tokens, passwords, and auth-capable config files.
Often used withcost-reducerscalabilitytrigger-dev
blueOctopusAIReads credentialsSkillblueOctopusAI/intel-hub/.claude/skills/security/skill.md
Security Auditor Evaluate security implications of tools, configurations, plugins, and the intelligence hub itself. ## Input `/security [target]` Targets: - No argument: full hub audit - A tool name: evaluate that specific tool
Often used withcost-reducerscalabilitytrigger-dev
bmarshall511Skillbmarshall511/Trellis/.claude/skills/security/SKILL.md
Use when handling user input, authentication, authorisation, secrets, file uploads, or database queries. Also when adding a dependency, exposing an endpoint, or reviewing whether something is safe to ship.
Often used withcost-reducerscalabilitytrigger-dev
CarriedWorldUniverseSkillCarriedWorldUniverse/nexus/.agents/skills/security/SKILL.md
Secure-coding rules for nexus + the vulnerability/secret/SAST scan gate run at review and merge.
Often used withcost-reducerscalabilitytrigger-dev
danielgefenSkilldanielgefen/sous/skills/security/SKILL.md
Adversarial security gate. Reviews the change for vulnerabilities and tries to exploit them against a local environment. A confirmed exploit blocks the merge. Runs after merge-risk, before qa. Usage - /sous:security <change-id>
Often used withcost-reducerscalabilitytrigger-dev
Dev-PGVAAReads credentialsSkillDev-PGVAA/skills/security/SKILL.md
Audit security boundaries in AI, agent, RAG, and MCP systems, or manage project secrets with SOPS and age. Use for threat models, scoped security reviews, encrypted dotenv migration, recipient rotation, and secret exposure response.
Often used withcost-reducerscalabilitytrigger-dev
eliabdevweb-svgReads credentialsSkilleliabdevweb-svg/opencode-skills-MCP/skills/security/SKILL.md
Sécurité applicative, OWASP Top 10, gestion des secrets, authentification, et bonnes pratiques de sécurité. Use when reviewing code for vulnerabilities, applying OWASP Top 10, handling authentication or authorization, managing secrets and tokens, auditing dependencies, or when the user mentions securite, vulnerabilite, XSS, injection, CSRF ou mot de passe.
Often used withcost-reducerscalabilitytrigger-dev
Geoffe-GaSkillGeoffe-Ga/well-worn-tools/.claude/skills/security/SKILL.md
Implement secure coding practices against common vulnerabilities. Use when handling user input, file paths, subprocess calls, SQL queries, API keys, or building web endpoints. Covers input validation, injection prevention, secret management, and XSS/CSRF protection across Python, TypeScript, Go, and Rust. Do NOT use for general error handling (use error-handling skill) or for remediating dependency vulnerability scanner failures and CVE / GHSA advisories (use cve-remediation skill).
Often used withcost-reducerscalabilitytrigger-dev
Greg-KleinSkillGreg-Klein/ai-rules-skills/skills/security/SKILL.md
Security rules and OWASP best practices — always active
Often used withcost-reducerscalabilitytrigger-dev
jack1415926Skilljack1415926/claude-skills/skills/security/SKILL.md
Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat detection architectures.
Often used withcost-reducerscalabilitytrigger-dev
jessedegansSkilljessedegans/jstack/skills/security/SKILL.md
Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving.
Often used withcost-reducerscalabilitytrigger-dev
jorekaiSkilljorekai/skills/skills/security/security/SKILL.md
Choose the next security skill for a new repository, a weekly sweep, or a leaked credential. Explains priorities, safeguards before each fix, and how to measure its result.
Often used withcost-reducerscalabilitytrigger-dev
KaratussSkillKaratuss/bstack/skills/security/SKILL.md
Spring Security filter chain·JWT·OAuth2·RBAC 구현. 인증/인가 설계·CORS/CSRF/XSS 방어 시 사용.
Often used withcost-reducerscalabilitytrigger-dev
KUNDURUHIMANEESHREDDYSkillKUNDURUHIMANEESHREDDY/saber/.agents/skills/security/SKILL.md
Security-focused supervisor specialized in threat modeling, security auditing, adversarial review, guardrail enforcement, and compliance checking. Audits for vulnerabilities, secrets, and regulatory compliance.
Often used withcost-reducerscalabilitytrigger-dev
latuconsinafrSkilllatuconsinafr/claude-code-config/skills/security/SKILL.md
Use when you want a dedicated security review of staged or recently changed files — deeper than the security section in /review. Covers OWASP Top 10, secrets exposure, dependency vulnerabilities, and auth gaps. Run before opening a PR on security-sensitive changes.
Often used withcost-reducerscalabilitytrigger-dev
LeostrukaReads credentialsSkillLeostruka/devin-bundle/skills/security/SKILL.md
Use when auditing code, dependencies, or infrastructure for security issues (SAST, dependency scanning, secret leak detection, OWASP-style checks), or when checking that a project or change follows secure defaults before committing or deploying.
Often used withcost-reducerscalabilitytrigger-dev
lgzarturoReads credentialsSkilllgzarturo/codeconductor/.agents/skills/security/SKILL.md
Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
Often used withcost-reducerscalabilitytrigger-dev
lgzarturoReads credentialsSkilllgzarturo/codeconductor/.cursor/skills/security/SKILL.md
Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
Often used withcost-reducerscalabilitytrigger-dev
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
