Claude skills and agent skills

hardw00tSkill

llm-security

hardw00t/ai-security-arsenal/skills/llm-security/SKILL.md

LLM and AI application security testing skill for prompt injection (direct, indirect, multimodal), system-prompt extraction, RAG poisoning, memory poisoning, MCP server injection, skill-file injection, agentic tool misuse, computer-use UI injection, and excessive agency. Authorization required — this skill tests AI systems you are explicitly permitted to assess. Triggers on requests to test LLM / AI-agent / RAG / MCP / computer-use security, perform prompt injection, extract system prompts, poison RAG or memory, audit agent tool use, or evaluate AI guardrails.

Often used withattack-chain·pentest-tools·binary-diff

aws-samplesSkill

ecs-security

aws-samples/sample-apex-skills/skills/ecs-security/SKILL.md

Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.

aws-samplesSkill

eks-security

aws-samples/sample-apex-skills/skills/eks-security/SKILL.md

Read-only scripted security reviews of a live Amazon EKS cluster (exposed / not exposed / unknown), plus hardening and compliance guidance. (1) CVE and advisory review - "am I exposed to CVE-...", "check this AWS bulletin or GHSA against my cluster", "CVE review for EKS" - verdicts for add-ons and images; kubelet and node-OS items are review-only. (2) Security event response - compromised image or package, leaked credential, suspicious pod - scope, record, contain, snapshot, fix, verify. (3) Posture check - "would my cluster contain a compromised pod", IMDS, NetworkPolicy, PSA, identity, logging, GuardDuty, endpoint, supply chain. Also hardening and audit prep - 7-layer stack, CIS, HIPAA/PCI-DSS/FedRAMP/SOC 2, Pod Identity vs IRSA, Access Entries, image signing. Skip for EKS knowledge (eks-best-practices), Well-Architected review (eks-well-architected-review), upgrade readiness (eks-upgrade-check), an operational review (eks-operation-review), inventory (eks-recon), GenAI model security (eks-genai), non-EKS.

L-X-TSkill

ng-security

L-X-T/ng-agentic-skills/.agents/skills/ng-security/SKILL.md

Harden Angular applications against common web vulnerabilities. Use when reviewing or improving app security, preventing XSS, configuring Content Security Policy (CSP) or Trusted Types, working with sanitization / DomSanitizer / bypassSecurityTrust, securing HttpClient (XSRF/CSRF, XSSI), auth and token storage, SSR/SSRF (allowedHosts), or keeping dependencies patched.

blockmaticSkill

w-security

blockmatic/basilic-skills/skills/workflow/w-security/SKILL.md

Review the change or tree against repository security docs and existing checks.

wekanSkill

meteor-security

wekan/wekan/.agents/skills/meteor-security/SKILL.md

Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow/deny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).

MaxMiksaSkill

security-audit

MaxMiksa/Auto-Company/.claude/skills/security-audit/SKILL.md

Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.

Often used withcreate-stories·community-led-growth·story-done

CosmianSkill

meta-security

Cosmian/kms/.github/skills/meta-security/SKILL.md

Full security-audit orchestrator running /security-review, /cryptography-review, /threat-model, and /standards-review in canonical order per .github/skills/shared/orchestrator-contract.md. Each phase is a sub-agent (contract §6). Use before release or major changes; incremental skips only when explicitly requested for follow-ups.

yaklangPipes a download into a shellSkill

ai-ml-security

yaklang/hack-skills/skills/ai-ml-security/SKILL.md

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.

Seeed-ProjectsSkill

security-scan

Seeed-Projects/Seeed-Jetson-DevelopTool/skills/openclaw/security-scan/SKILL.md

Deploy a knife detection model on Triton Inference Server using reComputer J1010 for X-ray security scanning, with Raspberry Pi clients sending images for inference and displaying detection results.

Often used withdjango-security·deployment-patterns·postgres-patterns

morrealevSkill

wp-security

morrealev/wordpress-manager/skills/wp-security/SKILL.md

Use when hardening WordPress security: filesystem permissions, HTTP security headers, authentication hardening, REST/XML-RPC API restriction, user capabilities audit, wp-config security constants, and incident response procedures.

alibabaSkill

security-check

alibaba/loongcollector/skills/security-check/SKILL.md

提交或推送前的安全检查，扫描 API Key、访问令牌等敏感信息。

mrhlaingbwardevPipes a download into a shellSkill

web3-security

mrhlaingbwardev/agentic-hacking-skills/skills/web3-security/SKILL.md

Use when user says "web3 စစ်", "contract စစ်", "defi ဖောက်", "solidity စစ်", "web3 hack", "smart contract vulnerability". Hunts million-dollar bugs in smart contracts - reentrancy, oracle manipulation, access control bypass, flashloan exploits. Writes working PoCs, chains exploits, maximizes impact. Zero theory - pure attack.

LeanmcpSkill

security-repro

Leanmcp/superview.sh/skills/security-repro/SKILL.md

Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.

relaticleSkill

spatie-security

relaticle/relaticle/.claude/skills/spatie-security/SKILL.md

Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.

wgpsecSkill

agent-security

wgpsec/AboutSecurity/skills/ai-security/agent-security/SKILL.md

AI Agent 系统安全测试方法论。当目标系统使用 AI Agent 执行工具调用、多 Agent 协作、 或自主决策时触发。覆盖 OWASP Agentic AI Security Top 10 (ASI01-ASI10): 目标劫持、工具滥用、身份权限、供应链、代码执行、记忆投毒、多 Agent 通信、 级联故障、人机信任利用、失控 Agent。

theopencoSkill

security-audit

theopenco/llmgateway/.agents/skills/security-audit/SKILL.md

Security best practices, vulnerability review, and full security audits for LLM Gateway. Use when writing security-sensitive code (auth, sessions, API keys, provider keys, billing, webhooks, user-supplied URLs, admin routes, CORS, rendering user content), when asked for a security review, security report, vulnerability research, pen test, or security audit, and for the monthly audit routine that fixes confirmed findings in a PR.

Often used withcreate-stories·community-led-growth·story-done

gyuhaSkill

fg-security

gyuha/forge/skills/fg-security/SKILL.md

Domain-specialised security audit of a codebase, outside the forge loop — a vendored multi-phase methodology (recon → parallel attack-class hunting → independent validation → machine-readable findings) whose findings, past a severity gate and your approval, become fix-forward backlog plans. Artefacts stay OUTSIDE the repo (upstream's ~/security-audit-skill/) so a vulnerability list has no path into a commit at all. Always skipped in fg-next all / fg-loop. Use in contexts like 'forge security', 'fg-security', '보안 감사', '취약점 찾아줘', 'security audit'.

opencueSkill

vc:security

opencue/cuecards/.agents/skills/vc-security/SKILL.md

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc:autoresearch pattern.

simoncorrySkill

security-scan

simoncorry/foundry/.agents/skills/security-scan/SKILL.md

Single-round adversarial security scan.

Often used withdjango-security·deployment-patterns·postgres-patterns