Claude skills and agent skills

JeffallanSkill

security-reviewer

Jeffallan/claude-skills/skills/security-reviewer/SKILL.md

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

MicrosoftSkill

ghaw-pr-security

microsoft/intelligent-terminal/.github/skills/ghaw-pr-security/SKILL.md

Review Intelligent Terminal pull requests for C++/WinRT, COM, WTA, ACP, session MCP, hooks, terminal mutation, path, diagnostic, packaging, and GitHub Actions security regressions. Use for evidence-based immutable-diff review and structured HIGH/medium/low findings.

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/inspector/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow — board it, verify who owns the code path, accept or reject, fix it in the private fork, ship to every affected release line, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

wgpsecSkill

ai-data-security

wgpsec/AboutSecurity/skills/ai-security/ai-data-security/SKILL.md

AI 系统数据安全测试方法论。当需要评估 LLM/AI 系统的数据泄露风险、训练数据安全、 或 RAG/向量库数据完整性时触发。覆盖: System Prompt 泄露(元 Prompt/角色扮演/关键字定位)、 训练数据推导与提取、成员推断攻击、模型反演攻击、RAG 数据投毒、API 信息泄露、 级联幻觉攻击、外部数据源信息泄露。

GitHubReads credentialsSkill

mcp-security-audit

github/awesome-copilot/skills/mcp-security-audit/SKILL.md

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions, not bare names, @latest, or ranges - Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, npm exec, uvx, uv tool run, and pipx run references in MCP configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]

OpenAISkill

deep-security-scan

openai/plugins/plugins/codex-security/skills/deep-security-scan/SKILL.md

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

OpenAISkill

security-diff-scan

openai/plugins/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

GoogleSkill

google-cloud-waf-security

google/skills/skills/cloud/google-cloud-waf-security/SKILL.md

Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and perimeter security, data security and encryption, security logging and threat detection, software supply chain hardening, AI security, data privacy, regulatory compliance, and cloud sovereignty. The recommendations are aligned with the Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework (WAF). Use when the user asks about firewall rules, zero trust, shared responsibility and shared fate, audit logging, security monitoring, threat mitigation, shift-left CI/CD security, Secure AI Framework (SAIF), data residency, or hardening Google Cloud resources. Don't use for other Well-Architected Framework pillars (Cost Optimization, Operational Excellence, Reliability, Performance Optimization, or Sustainability).

trezorSkill

security-headers

trezor/trezor-suite/skills/security-headers/SKILL.md

Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.

NVIDIASkill

fix-security-issue

NVIDIA/OpenShell/.agents/skills/fix-security-issue/SKILL.md

Implement an authorized fix for a reviewed security issue and open a PR that closes its issue.

static-web-serverSkill

security-advisory

static-web-server/static-web-server/.agents/skills/security-advisory/SKILL.md

Draft a GitHub Security Advisory (GHSA) for the Static Web Server (SWS) project — reproduce and scope the vulnerability, verify affected versions, score it with CVSS 3.1 and CWEs, write the advisory text, and create or update the private draft via gh. Use when a vulnerability is reported privately or confirmed by an audit, or when editing an existing draft advisory.

MicrosoftSkill

security-planning

microsoft/hve-core/.github/skills/project-planning/security-planning/SKILL.md

Security planning and plan-drift analysis for STRIDE, standards, controls, backlog handoff, current findings, and TM7 generation.

hook0Skill

security-advisory

hook0/hook0/.claude/skills/security-advisory/SKILL.md

Standard process for turning a confirmed Hook0 vulnerability into a published security advisory and, where warranted, a CVE. Use whenever a security report is confirmed and a fix is being prepared or has shipped, or when the team asks to "publish an advisory", "request a CVE", "assign a CVE", "credit a researcher", or "handle a security disclosure". Covers the CVE decision, the GitHub Security Advisory draft, timing, doc updates, and crediting the reporter.

CloudAI-XReads credentialsSkill

security-patterns

CloudAI-X/claude-workflow/skills/security-patterns/SKILL.md

Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.

GitHubSkill

developer-security

github/gh-aw/.github/skills/developer-security/SKILL.md

Security best practices for gh-aw workflows and Go code: template injection prevention, shell script security, supply chain hardening, and static analysis integration.

ruvnetSkill

V3 Security Overhaul

ruvnet/wifi-densepose/.claude/skills/v3-security-overhaul/SKILL.md

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Often used withagent-agent·agent-analyze-code-quality·agent-app-store

GoogleSkill

gke-workload-security

google/skills/skills/cloud/gke-workload-security/SKILL.md

Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

GoogleSkill

gke-platform-security

google/skills/skills/cloud/gke-platform-security/SKILL.md

Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security).

edwardkimSkill

rhwp-security-sweep

edwardkim/rhwp/.claude/skills/rhwp-security-sweep/SKILL.md

HWP/HWPX 문서의 배포 전/수신 후 보안 점검을 수행합니다. inspect hidden-text(조판 은닉)·injection(프롬프트 주입 신호)·unicode(화면-바이트 불일치) 3축 스윕, edit redact --dry-run(읽기 전용 PII 탐지) → redact/sanitize 적용 → 재스윕 게이트까지 닫습니다. 트리거 — 사용자가 "이 문서 보내도 돼/배포 전 점검", "숨긴 텍스트/주입/유니코드 검사", "개인정보 마스킹하고 내보내", "받은 첨부 안전한지 확인", "메타데이터 지워줘", "rhwp inspect/redact/sanitize" 등을 요청할 때. gym 이 아니라 실사용 에이전트 경로다.

No other project uses it yet

ruvnetSkill

V3 Security Overhaul

ruvnet/claude-flow/.agents/skills/v3-security-overhaul/SKILL.md

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Often used withagent-agent·agent-analyze-code-quality·agent-app-store