Claude skills and agent skills

SentrySkill

sentry-security

getsentry/sentry/.agents/skills/sentry-security/SKILL.md

Sentry-specific security review based on real vulnerability history. Use when reviewing Sentry endpoints, serializers, or views for security issues. Trigger keywords: "sentry security review", "check for IDOR", "access control review", "org scoping", "cross-org", "security audit endpoint".

hypnguyen1209Skill

ai-security

hypnguyen1209/offensive-claude/skills/ai-security/SKILL.md

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

AWSSkill

aws-security

aws/agent-toolkit-for-aws/plugins/aws-core/skills/aws-security/SKILL.md

AWS security service suitability, coverage and cost recommendations: WAF/origin overlap, AWS Network Firewall inspection coverage and policy review, VPC endpoint, Transit Gateway/Cloud WAN segmentation and DNS Firewall security-control suitability, certificate renewal ownership and monitoring, incident response triage ownership, centralized security log store (CloudWatch or Security Lake). Also factual configuration, findings, data sources and severity scoring for GuardDuty, Inspector, Security Hub V2/OCSF (Exposure, connectors, automation), Security Hub CSPM/ASFF (standards, controls), Macie, Detective, Security Lake, AWS Security Incident Response membership and case coverage, and Organizations security policies. Applies to advisory security-service choices even when one service is named. Implementation, rule or code authoring, deployment, scans and troubleshooting outside these factual procedures belong to specialist skills. Supports local AWS CLI and AWS MCP.

mizchiSkill

sql-security

mizchi/skills/sql-security/SKILL.md

SQL injection screening for host code (MoonBit / TS / Rust) plus secretlint setup notes. Flags single-line template-literal or string-concat SQL builders, regardless of value source — the scanner is line-based and does NOT trace data flow, so a clean scan is not proof of safety (multi-line template literals are missed) and every hit needs a manual review or an explicit `// sql-security: ok` opt-out.

zakirkunSkill

security-ops

zakirkun/deep-eye/.agents/skills/security-ops/SKILL.md

Router for Deep Eye agent skills: pentest, bug-bounty, red-team, blue-team, ctf. Use for security ops, mixed intent, offensive vs defensive choice.

tinyfish-ioSkill

dep-security

tinyfish-io/tinyfish-cookbook/skills/dep-security/SKILL.md

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that Snyk, Dependabot, and npm audit miss. Use this skill whenever a user mentions checking dependencies for vulnerabilities, wants to audit their package.json, asks about CVEs for their packages, says "are my dependencies safe", "check my packages for security issues", "any new vulnerabilities in my deps", or pastes a package.json and asks about security. Also trigger when a user mentions wanting fresher data than Snyk or Dependabot provides. Returns: which dependencies have brand-new vulnerabilities, severity, what the vulnerability does, whether a patched version exists yet, and a prioritised fix list.

No other project uses it yet

MicrosoftSkill

dv-security

microsoft/Dataverse-skills/.github/plugins/dataverse/skills/dv-security/SKILL.md

Security-role assignment, user access, application users, business units, and admin self-elevation in Dataverse environments. Use when the user wants to give someone access, grant a role, become an admin, or add a service principal.

zereightReads credentialsSkill

security-scan

zereight/gitlab-mcp/.github/skills/security-scan/SKILL.md

Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps.

Often used withdjango-security·deployment-patterns·postgres-patterns

wgpsecSkill

mcp-security

wgpsec/AboutSecurity/skills/ai-security/mcp-security/SKILL.md

MCP (Model Context Protocol) 协议安全测试方法论。当目标环境使用 MCP Server 集成外部工具、 需要评估 MCP 工具描述安全性、或测试 Agent 通过 MCP 调用工具时的安全边界时触发。 覆盖: 工具描述投毒、地毯式骗局(动态篡改)、指令覆盖(Shadow Tool)、隐藏指令(ANSI/Unicode)、 跨 Server 攻击、Token 窃取、Schema 操纵、上下文溢出。

rodrigohighermindReads credentialsSkill

hm-security

rodrigohighermind/highermind-code-skills/hm-security/SKILL.md

Auditoria de segurança profunda (L1/L2/L3). Use antes de deploy externo, após adicionar auth/dados sensíveis/fluxo financeiro, ou periodicamente como manutenção. Cobre 14 domínios — CIS Docker, OWASP Top 10, OWASP API Top 10, ASVS AuthN/Session, dados/compliance (LGPD/GDPR/PCI), supply chain, AI/LLM (prompt injection, tool calling, multi-tenant LLM), file upload, business logic, secrets scan com 20+ patterns, Supabase/PostgREST RLS regime absoluto. Barra Tempest / Trail of Bits / Cure53.

first-flukeSkill

oma-security

first-fluke/oh-my-ag/.agents/skills/oma-security/SKILL.md

Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.

first-flukeSkill

oma-security

first-fluke/oh-my-ag/skills/oma-security/SKILL.md

Scan application source, agent skills, and MCP components; run

heartleoSkill

security-scan

heartleo/zlib/.agents/skills/security-scan/SKILL.md

Scan zlib for security problems before a release or after a dependency, network, credential, or file-handling change — govulncheck, secret scanning, GitHub alert review, and a credential-boundary code review — and handle a private vulnerability report through a GitHub security advisory.

Often used withdjango-security·deployment-patterns·postgres-patterns

ruvnetSkill

security-audit

ruvnet/claude-flow/.agents/skills/security-audit/SKILL.md

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.

Often used withcreate-stories·community-led-growth·story-done

jiten-singh-shahiSkill

sf-security

jiten-singh-shahi/salesforce-claude-code/.cursor/skills/sf-security/SKILL.md

Use when implementing Salesforce Apex security — CRUD/FLS enforcement, sharing keywords, SOQL injection prevention, AppExchange review prep. Do NOT use for general Apex or LWC patterns.

bodadotshSkill

npm-security

bodadotsh/npm-security-best-practices/skills/npm-security/SKILL.md

Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating dependencies or configuring package managers

moltbotSkill

security-triage

moltbot/moltbot/.agents/skills/security-triage/SKILL.md

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

hardw00tSkill

sca-security

hardw00t/ai-security-arsenal/skills/sca-security/SKILL.md

Software Composition Analysis: find vulnerable dependencies, correlate CVE/GHSA/OSV across ecosystems, generate CycloneDX/SPDX SBOMs, assess license compliance, and run reachability-aware triage to suppress unexploitable findings. Use when scanning package dependencies (npm, PyPI, Maven, Cargo, Go, RubyGems, Composer), reviewing PR lockfile diffs, generating SBOMs, auditing licenses, hunting malicious packages, or auditing the software supply chain. Triggers on requests to scan dependencies, check vulnerable packages, generate SBOM, license compliance, typosquat/dependency-confusion review, or reachability-based vuln triage.

kingxiaozheSkill

cm-security

kingxiaozhe/cm-workflow/skills/cm-security/SKILL.md

用户运行 cm-security，或要求代码安全扫描、漏洞检查、密钥泄露排查、依赖漏洞检查时使用。默认检查当前分支相对主分支及已跟踪未提交修改，结合业务地图复核；--all 检查全部已跟踪文件。只报告问题，不自动修复、安装、升级或发布。安装自检用 cm-check，功能测试与覆盖率用 cm-test。

awarexonePipes a download into a shellSkill

cicd-security

awarexone/Agentic-Bug-Hunter/skills/cicd-security/SKILL.md

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.