Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
marketcallsSkillmarketcalls/openalgo/.claude/skills/security-audit/SKILL.md
Run OpenAlgo's periodic security audit across backend, frontend, database, cache, routes and dependencies, producing a dated xlsx report. Use for the monthly or twice-monthly review, before a release, after a dependency bump, or when the user asks for a security check, vulnerability scan, or audit report.
aws-samplesSkillaws-samples/sample-apex-skills/skills/ecs-security/SKILL.md
Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.
aws-samplesSkillaws-samples/sample-apex-skills/skills/eks-security/SKILL.md
Use whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS cluster", "Bottlerocket vs AL2023 vs RHEL/Ubuntu AMI", "EKS Pod Identity vs IRSA", "Access Entries vs aws-auth", "GuardDuty for EKS", "Pod Security Admission / Kyverno / OPA", "NetworkPolicy / Security Groups for Pods", "ECR scanning / image signing (Cosign / Notation)", "EKS audit logging", "etcd / secrets encryption", or regulated-workload / audit-prep guidance. Walks the discovery-driven 7-layer security stack (OS/AMI → identity → workload → image → runtime → audit → compliance accelerators), the compliance-regime scope view, the AWS-canonical baseline, and a 30/60/90 hardening roadmap. Trigger even if "compliance" is never said — any EKS hardening, audit-prep, or regulated-workload decision qualifies. Skip for non-EKS (ECS/ROSA), account-level security with no EKS angle, or GenAI-workload security (use eks-genai).
morrealevSkillmorrealev/wordpress-manager/skills/wp-security/SKILL.md
Use when hardening WordPress security: filesystem permissions, HTTP security headers, authentication hardening, REST/XML-RPC API restriction, user capabilities audit, wp-config security constants, and incident response procedures.
drvossSkilldrvoss/everything-copilot-cli/skills/security/security-scan/SKILL.md
Use when you want a quick security pass on code changes or dependencies — checks OWASP Top 10 patterns, runs dependency audits, and surfaces critical vulnerabilities with targeted fixes.
wgpsecSkillwgpsec/AboutSecurity/skills/ai-security/agent-security/SKILL.md
AI Agent 系统安全测试方法论。当目标系统使用 AI Agent 执行工具调用、多 Agent 协作、 或自主决策时触发。覆盖 OWASP Agentic AI Security Top 10 (ASI01-ASI10): 目标劫持、工具滥用、身份权限、供应链、代码执行、记忆投毒、多 Agent 通信、 级联故障、人机信任利用、失控 Agent。
jefflesterSkilljefflester/claude-skills-supercharged/.claude/skills/api-security/SKILL.md
API security best practices and common vulnerability prevention. Enforces security checks for authentication, input validation, SQL injection, XSS, and OWASP Top 10 vulnerabilities. Use when building or modifying APIs.
relaticleSkillrelaticle/relaticle/.claude/skills/spatie-security/SKILL.md
Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.
loulanyueSkillloulanyue/awesome-claude-notes/skills/perl-security/SKILL.md
Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.
h0rn3tSkillh0rn3t/golang-skills/skills/go-security/SKILL.md
Use when writing or reviewing Go code that touches untrusted input, secrets, or credentials — SQL, shell, or template injection, path traversal, SSRF, cookies and security headers, password hashing, TLS settings, token comparison, or what may appear in a log line. Also use when a handler accepts a file name, URL, or command argument from a client, or when asked to find "vulnerabilities", even if the user never says "security". Does not cover the os.Root and crypto/rand mechanics (see go-defensive) or the dependency CVE scan in the gate (see go-linting).
simoncorrySkillsimoncorry/foundry/.agents/skills/security-scan/SKILL.md
Single-round adversarial security scan.
gyuhaSkillgyuha/forge/skills/fg-security/SKILL.md
Domain-specialised security audit of a codebase, outside the forge loop — a vendored multi-phase methodology (recon → parallel attack-class hunting → independent validation → machine-readable findings) whose findings, past a severity gate and your approval, become fix-forward backlog plans. Artefacts stay OUTSIDE the repo (upstream's ~/security-audit-skill/) so a vulnerability list has no path into a commit at all. Always skipped in fg-next all / fg-loop. Use in contexts like 'forge security', 'fg-security', '보안 감사', '취약점 찾아줘', 'security audit'.
opencueSkillopencue/cuecards/.agents/skills/vc-security/SKILL.md
STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc:autoresearch pattern.
PydanticSkillpydantic/monty/.agents/skills/review-security/SKILL.md
Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses. Use when reviewing changes for security risk, or before merging anything touching the heap/ module, path_security.rs, the wire protocol or the pool.
engineering-osSkillengineering-os/engineering-os/.agents/skills/eos-security/SKILL.md
Run adversarial Engineering OS security scanning, auditing, dependency checks, threat modeling, or compliance checks.
muyenSkillmuyen/vibe-to-prod/.claude/skills/security-scan/SKILL.md
Proactive security scanning. Triggers when modifying auth, API endpoints, user data, or sensitive operations.
KbWenSkillKbWen/agentic-os/.agents/skills/auth-security/SKILL.md
Secure authentication and authorization when credentials, sessions, roles, or permissions change.
thejordanleopoldSkillthejordanleopold/claude-code-skills-distilled/ai-security/SKILL.md
Use when auditing AI/LLM systems for security vulnerabilities, reviewing prompt injection risks, auditing MCP server tool integrations, assessing AI agent behavioral drift, reviewing credential scoping for agents, or designing safe agentic systems. Triggers: \"AI security\", \"LLM security\", \"prompt injection\", \"tool abuse\", \"MCP security\", \"agent security\", \"behavioral drift\", \"AI agent audit\", \"insecure plugin\", \"agentic threat\", \"LLM threat\", \"indirect injection\", \"credential exposure\", \"excessive agency\".
laolaoshirenSkilllaolaoshiren/claude-code-skills-zh/skills/security-audit/SKILL.md
代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践
duriantacoSkillduriantaco/skylos/.agents/skills/skylos-security/SKILL.md
Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries, classify severity, or add regression tests for security-sensitive analyzer behavior.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
