Claude skills and agent skills

shuvonsecPipes a download into a shellSkill

cicd-security

shuvonsec/claude-bug-bounty/skills/cicd-security/SKILL.md

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

PostHogReads credentialsSkill

security-audit

PostHog/posthog/.agents/skills/security-audit/SKILL.md

Focused security audit of code, calibrated to surface real exploitable bugs and suppress theoretical findings. Use when the user asks to "audit", "security-audit", "find vulnerabilities", "check for IDOR/SSRF/XSS/injection", or wants a security review of a file, directory, branch diff, or PR. Covers access control, injection, auth/secrets, sensitive data, business logic, web boundary, and AI agent/LLM trifecta risks. Produces calibrated findings with data flow, exploit request, fix, and confidence — no theoretical or defense-in-depth nits.

Often used withcreate-stories·community-led-growth·story-done

zhaoxuya520Skill

email-security

zhaoxuya520/reverse-skill-private/skills/email-security/SKILL.md

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

affaan-mReads credentialsSkill

security-review

affaan-m/ECC/.agents/skills/security-review/SKILL.md

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

DonchitosSkill

security-audit

Donchitos/Claude-Code-Game-Studios/.claude/skills/security-audit/SKILL.md

Security audit — save tampering, cheat vectors, network exploits, data exposure, input validation. Before public or multiplayer release.

Often used withcreate-stories·community-led-growth·story-done

bagofwords1Skill

security-scan

bagofwords1/bagofwords/.agents/skills/security-scan/SKILL.md

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes. Use for "scan with Snyk", "resolve the security issues", dependency-CVE cleanup, or a pre-release security pass.

Often used withdjango-security·deployment-patterns·postgres-patterns

arcasilesgroupSkill

ai-security

arcasilesgroup/ai-engineering/skills/ai-security/SKILL.md

Six-phase security audit of a codebase — web apps, APIs, services, CLI tools, libraries, and daemons — with adversarial validation: the agent that verifies a finding is never the one that found it. Recon, parallel hunting across 8 attack classes, validation, reporting, schema-validated findings.json, and independent verification. Only exploitable issues with real impact are reported — never theoretical concerns or industry-standard behavior. Use when a milestone declares a security audit, when findings must be validated adversarially, or for trigger phrases "security review", "audit for vulnerabilities", "find security bugs", and "pen-test the code". Not for diagnosing a runtime failure — use /ai-debug. Not for judging a diff for correctness — use /ai-verify.

CloudflareSkill

security-audit

cloudflare/security-audit-skill/skills/security-audit/SKILL.md

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Often used withcreate-stories·community-led-growth·story-done

MindrallySkill

jwt-security

Mindrally/skills/jwt-security/SKILL.md

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage

rommappPipes a download into a shellSkill

security-audit

rommapp/romm/.claude/skills/security-audit/SKILL.md

Audit a diff (a release tag range or a PR branch) for anything malicious or a serious security regression before shipping/merging. Use when asked to "check this release", "make sure nothing malicious slipped in", "security review this PR", or vet upstream/contributor changes. Covers supply chain, egress/exfiltration, auth/injection/traversal, CI/infra, and commit provenance, with a fast direct pass plus fanned-out deep review. Trigger on any "is this change safe?" request over a diff.

Often used withcreate-stories·community-led-growth·story-done

loulanyueReads credentialsSkill

security-scan

loulanyue/awesome-claude-notes/skills/security-scan/SKILL.md

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Often used withdjango-security·deployment-patterns·postgres-patterns

nirholasSkill

okx-security

nirholas/three.ws/.agents/skills/okx-security/SKILL.md

Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, message signature safety, malicious transaction detection, approval safety checks, token approval management. Triggers: 'is this token safe', 'check token security', 'honeypot check', 'scan this tx', 'scan this swap tx', 'tx risk check', 'is this URL a scam', 'check if this dapp is safe', 'phishing site check', 'is this signature safe', 'check this signing request', 'check my approvals', 'show risky approvals', 'revoke approval', 'check if this approve is safe', token authorization, ERC20 allowance, Permit2. Covers token-scan, dapp-scan, tx-scan (EVM+Solana pre-execution), sig-scan (EIP-712/personal_sign), approvals (ERC-20/Permit2). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance/send/history — use okx-agentic-wallet.

SystemTceReads credentialsSkill

04-security

SystemTce/dify-skills/04-security/SKILL.md

Dify 安全实践和部署运维完整指南，涵盖SSRF防护、代码沙箱、Docker/Kubernetes部署、监控告警和故障恢复

kubesharkReads credentialsSkill

security-audit

kubeshark/kubeshark/skills/security-audit/SKILL.md

Kubernetes network security audit skill powered by Kubeshark MCP. Use this skill whenever the user wants to audit a cluster for security threats, detect compromised workloads, find malicious traffic patterns, hunt for indicators of compromise (IOCs), check for data exfiltration, identify C2 (command and control) communication, detect cryptomining, find lateral movement, discover credential theft attempts, assess network security posture, or perform threat hunting in Kubernetes. Also trigger when the user mentions security audit, threat detection, compromise assessment, vulnerability scan, "is my cluster compromised", "find malicious traffic", "check for threats", DNS exfiltration, DNS tunneling, port scanning, IMDS access, reverse shell, crypto miner, MITRE ATT&CK, IOC detection, anomaly detection, suspicious traffic, rogue workloads, unauthorized access, or any request to evaluate cluster security through network traffic analysis.

Often used withcreate-stories·community-led-growth·story-done

ResgridSkill

security-scan

Resgrid/Core/.agents/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

ResgridSkill

security-scan

Resgrid/Core/.claude/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

vinayaklattheSkill

iac-security

vinayaklatthe/microsoft-security-skills/skills/iac-security/SKILL.md

Guidance for securing Infrastructure-as-Code (Bicep, ARM, Terraform, and ACI/Container) pipelines on Azure — shift-left scanning, policy-as-code, secret hygiene, identity for pipelines, drift detection, and supply chain. Covers Microsoft Defender for Cloud DevOps Security (GitHub / Azure DevOps connectors), Microsoft Security DevOps (MSDO) extension, Bicep linter and template specs, Terraform best practices on Azure (state management, backend hardening, provider versions), Azure Policy as deploy-time and CI-time gate, GitOps with Flux/ArgoCD on AKS, secret scanning and dependency review, signed commits / artifact signing, OIDC federation for pipeline identity (no client secrets), and integration with Defender for Cloud posture. WHEN: IaC security, Bicep security, Terraform Azure security, Defender for Cloud DevOps Security, MSDO, Microsoft Security DevOps, shift-left Azure, policy as code, OIDC GitHub Actions Azure, secrets in IaC, drift detection, signed Bicep, supply chain Azure. DO NOT USE for Kubernetes admission control alone (use defender-for-containers), generic CI/CD design, or app-layer security.

Strategic-AutomationSkill

llm-security

Strategic-Automation/violin/skills/llm-security/SKILL.md

Test LLM prompt injection and MCP tool/agent surfaces.

Often used withattack-chain·pentest-tools·binary-diff

raroqueReads credentialsSkill

vibe-security

raroque/vibe-security-skill/vibe-security/SKILL.md

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

AnthropicSkill

claude-security

anthropics/claude-plugins-official/plugins/claude-security/skills/claude-security/SKILL.md

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.