Claude skills and agent skills

arcasilesgroupSkill

ai-security

arcasilesgroup/ai-engineering/skills/ai-security/SKILL.md

Audits code for exploitable vulnerabilities with independent validation and schema-checked findings. Trigger: milestone security audits, "security review", "find security bugs", or "pen-test". Reports real impact, not theory. Not for runtime diagnosis (/ai-debug) or diff correctness (/ai-verify).

bagofwords1Skill

security-scan

bagofwords1/bagofwords/.agents/skills/security-scan/SKILL.md

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes. Use for "scan with Snyk", "resolve the security issues", dependency-CVE cleanup, or a pre-release security pass.

Often used withdjango-security·deployment-patterns·postgres-patterns

CloudflareSkill

security-audit

cloudflare/security-audit-skill/skills/security-audit/SKILL.md

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Often used withcreate-stories·community-led-growth·story-done

rommappPipes a download into a shellSkill

security-audit

rommapp/romm/.claude/skills/security-audit/SKILL.md

Audit a diff (a release tag range or a PR branch) for anything malicious or a serious security regression before shipping/merging. Use when asked to "check this release", "make sure nothing malicious slipped in", "security review this PR", or vet upstream/contributor changes. Covers supply chain, egress/exfiltration, auth/injection/traversal, CI/infra, and commit provenance, with a fast direct pass plus fanned-out deep review. Trigger on any "is this change safe?" request over a diff.

Often used withcreate-stories·community-led-growth·story-done

MindrallySkill

jwt-security

Mindrally/skills/jwt-security/SKILL.md

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage

nirholasSkill

okx-security

nirholas/three.ws/.agents/skills/okx-security/SKILL.md

Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, message signature safety, malicious transaction detection, approval safety checks, token approval management. Triggers: 'is this token safe', 'check token security', 'honeypot check', 'scan this tx', 'scan this swap tx', 'tx risk check', 'is this URL a scam', 'check if this dapp is safe', 'phishing site check', 'is this signature safe', 'check this signing request', 'check my approvals', 'show risky approvals', 'revoke approval', 'check if this approve is safe', token authorization, ERC20 allowance, Permit2. Covers token-scan, dapp-scan, tx-scan (EVM+Solana pre-execution), sig-scan (EIP-712/personal_sign), approvals (ERC-20/Permit2). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance/send/history — use okx-agentic-wallet.

ResgridSkill

security-scan

Resgrid/Core/.agents/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

ResgridSkill

security-scan

Resgrid/Core/.claude/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

heliomarpmSkill

sk-security

heliomarpm/skills/skills/sk-security/SKILL.md

Audita e projeta a segurança de aplicações: autenticação e sessão (OAuth com PKCE, OIDC, JWT), autorização por recurso (RBAC/ABAC, BOLA/IDOR), entrada e injeções, criptografia e segredos, dependências, cabeçalhos web, logs e privacidade, com checklist baseado no OWASP, achados com severidade e plano de remediação. Use sempre que o usuário pedir 'audite a segurança', 'isto é seguro?', 'revise a autenticação', 'proteja este endpoint', 'vazou um segredo', 'vulnerabilidades', 'OWASP', 'hash de senha', 'CSP' ou 'permissões', mesmo sem a palavra 'segurança'. NÃO use para desenhar contratos de API (isso é sk-api-design), infraestrutura e pipelines (isso é sk-devops) nem para revisar um diff em geral (isso é sk-code-review).

vinayaklattheSkill

iac-security

vinayaklatthe/microsoft-security-skills/skills/iac-security/SKILL.md

Guidance for securing Infrastructure-as-Code (Bicep, ARM, Terraform, and ACI/Container) pipelines on Azure — shift-left scanning, policy-as-code, secret hygiene, identity for pipelines, drift detection, and supply chain. Covers Microsoft Defender for Cloud DevOps Security (GitHub / Azure DevOps connectors), Microsoft Security DevOps (MSDO) extension, Bicep linter and template specs, Terraform best practices on Azure (state management, backend hardening, provider versions), Azure Policy as deploy-time and CI-time gate, GitOps with Flux/ArgoCD on AKS, secret scanning and dependency review, signed commits / artifact signing, OIDC federation for pipeline identity (no client secrets), and integration with Defender for Cloud posture. WHEN: IaC security, Bicep security, Terraform Azure security, Defender for Cloud DevOps Security, MSDO, Microsoft Security DevOps, shift-left Azure, policy as code, OIDC GitHub Actions Azure, secrets in IaC, drift detection, signed Bicep, supply chain Azure. DO NOT USE for Kubernetes admission control alone (use defender-for-containers), generic CI/CD design, or app-layer security.

Strategic-AutomationSkill

llm-security

Strategic-Automation/violin/skills/llm-security/SKILL.md

Test LLM prompt injection and MCP tool/agent surfaces.

Often used withattack-chain·pentest-tools·binary-diff

AnthropicSkill

claude-security

anthropics/claude-plugins-official/plugins/claude-security/skills/claude-security/SKILL.md

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.

Google CloudSkill

security-scan

GoogleCloudPlatform/cloud-solutions/projects/build-with-gemini-demo/build-with-antigravity/.agents/skills/security-scan/SKILL.md

Performs a security audit of the project source code and dependencies to identify vulnerabilities and recommend remediations. Use when scanning the codebase for security issues. Don't use for functional unit testing or style-only code formatting.

Often used withdjango-security·deployment-patterns·postgres-patterns

Hassaan146Skill

ai-security

Hassaan146/claude-skills/ai-security/SKILL.md

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

monoSkill

security-audit

mono/SkiaSharp/.agents/skills/security-audit/SKILL.md

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline. Read-only investigation that produces a status report with recommendations.

Often used withcreate-stories·community-led-growth·story-done

RTFM-IT-Services-LLCSkill

msp-security

RTFM-IT-Services-LLC/msp-claude-skills/skills/msp-security/SKILL.md

Use this skill for security standards at your managed IT services (MSP) business, in both directions: the baseline every managed client must meet (MFA, endpoint protection, email security, backups, admin access, offboarding) and how the MSP secures itself (RMM hardening, the credential vault, admin separation, partner-delegated admin access into client tenants, our own devices). Trigger on "security baseline", "security standard", "harden this tenant", "is this client secure enough", "security assessment", "cyber insurance questionnaire", "can we say we're compliant", HIPAA, FTC Safeguards, WISP, CMMC, PCI, CIS Controls, "lock down our RMM", or any question about what controls a client or our MSP should have. msp-helpdesk owns incident response; msp-maintenance owns patch and backup cadence; this skill owns the standard they deliver against. Apply alongside msp-onboarding, msp-qbr, msp-legal, msp-pricing, msp-client-comms, and msp-sales.

langfuseSkill

security-review

langfuse/langfuse/.agents/skills/security-review/SKILL.md

Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy. Use when a design or change accepts URLs or host fields, handles secrets or cross-tenant data, makes outbound requests, adds an integration, follows redirects, widens permissions, or can send customer-controlled UI data through analytics, monitoring, or session replay.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

symfonySkill

security-triage

symfony/symfony/.agents/skills/security-triage/SKILL.md

Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter). Assigns severity and affected maintained branches, and routes to the next step. Use when the user says "does this need a CVE", "CVE or hardening", "triage this report", "is this a security issue", "classify this finding", or "how should we disclose this".

hardw00tSkill

api-security

hardw00t/ai-security-arsenal/skills/api-security/SKILL.md

Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.

Often used withbinary-diff·pentest-tools·js-reverse

hardw00tSkill

iac-security

hardw00t/ai-security-arsenal/skills/iac-security/SKILL.md

Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep. Orchestrates Checkov, tfsec, Terrascan, KICS, kubesec, kube-linter, Polaris, cfn-lint/cfn-nag, and OPA/Conftest. Use when auditing IaC for misconfigurations, scanning Terraform plans, validating K8s security policies, checking cloud infrastructure compliance, or authoring custom policy-as-code (Rego).