Claude skills and agent skills

RabbyHubSkill

rabby-security-review

RabbyHub/Rabby/skills/rabby-security-review/SKILL.md

Hunt architectural, lifecycle, and state-confusion security bugs in Rabby that diff-scoped review misses — consent surviving session boundaries, cross-context message confusion, fail-open guards, and unsafe state across restarts. Use for any security audit of the Rabby codebase, especially non-PR-scoped or release-time audits.

lobehubSkill

desktop-security-update

lobehub/lobe-chat/.agents/skills/desktop-security-update/SKILL.md

Inspect, mark, or revoke vulnerable LobeHub Desktop versions through the existing release workflow and signed R2 security policy. Use for forced security updates across Stable, Canary, Beta, and Nightly.

agent-substrateSkill

security-status-report

agent-substrate/substrate/.agents/skills/security-status-report/SKILL.md

Generates a security status report based on docs/threats.json by spinning up sub-agents for each threat to compute a quality score.

No other project uses it yet

MicrosoftSkill

supply-chain-security

microsoft/hve-core/.github/skills/security/supply-chain-security/SKILL.md

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

Often used withbinary-diff·pentest-tools·js-reverse

AWSSkill

threat-modeling-with-aws-security-agent

aws/agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/threat-modeling-with-aws-security-agent/SKILL.md

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

No other project uses it yet

lee-toReads credentialsSkill

aif-security-checklist

lee-to/ai-factory/skills/aif-security-checklist/SKILL.md

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

usestrixSkill

find-security-vulnerabilities-in-code

usestrix/strix/skills/find-security-vulnerabilities-in-code/SKILL.md

Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.

nyldnReads credentialsSkill

skill-security-framing

nyldn/claude-octopus/.claude/skills/skill-security-framing/SKILL.md

URL validation and content sanitization for untrusted sources — use when handling external input safely

nyldnSkill

skill-security-framing

nyldn/claude-octopus/skills/skill-security-framing/SKILL.md

URL validation and content sanitization for untrusted sources — use when handling external input safely

camundaPipes a download into a shellSkill

ci-security-compliance

camunda/camunda/.agents/skills/ci-security-compliance/SKILL.md

Enforces GitHub Actions security and compliance for this monorepo. Use when adding third-party actions, handling secrets, defining permissions, and reviewing CI security trade-offs.

OpenAISkill

define-security-policy

openai/codex-security/plugins/codex-security/skills/define-security-policy/SKILL.md

Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

symfonySkill

symfony-security-review

symfony/ux/.agents/skills/symfony-security-review/SKILL.md

Review a change (a PR, the current branch diff, or a set of files) or audit a Symfony UX package or the whole `src/` tree for missing or incorrect security hardening. Reasons about trust boundaries from first principles, then checks the code against the hardening families catalogued from ux's past security fixes. Use when asked for a security review or a security audit of ux code, whether a change weakens a security control, or to hunt a vulnerability class across the packages.

SnailSploitSkill

offensive-api-security

SnailSploit/Claude-Red/Skills/api/offensive-api-security/SKILL.md

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

yaklangPipes a download into a shellSkill

linux-security-bypass

yaklang/hack-skills/skills/linux-security-bypass/SKILL.md

Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.

yaklangSkill

macos-security-bypass

yaklang/hack-skills/skills/macos-security-bypass/SKILL.md

macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.

nrwlSkill

draft-security-advisory

nrwl/nx/.claude/skills/draft-security-advisory/SKILL.md

Draft a GitHub security advisory (GHSA) for nrwl/nx from a vulnerability report. Investigates the affected code, determines affected packages and version ranges, proposes a CVSS score and CWEs, and writes a draft advisory following the layout of previously published nrwl/nx advisories. Output is a local draft only — a human reviews and publishes. Use when a security vulnerability report needs to become an advisory, or when the user says "draft an advisory", "write a GHSA", or "security advisory for <report>".

paperclipaiSkill

deal-with-security-advisory

paperclipai/paperclip/.agents/skills/deal-with-security-advisory/SKILL.md

Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.

eeeeeeeeee-codeReads credentialsSkill

miniapp-security-core

eeeeeeeeee-code/e0e1-wx/SKILL.md

Use when reviewing authorized WeChat mini-program or mini-app targets for authentication bypass, IDOR, undefined-path access, API abuse, decryption and signature analysis, runtime reverse engineering, route mapping, and sensitive data exposure, with file-submission attack surfaces intentionally excluded.

OpenAISkill

define-security-policy

openai/plugins/plugins/codex-security/skills/define-security-policy/SKILL.md

Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

FOSSBillingReads credentialsSkill

security-advisory-fix

FOSSBilling/FOSSBilling/.agents/skills/security-advisory-fix/SKILL.md

Design, implement, test, and ship the actual code fix for a security advisory that has already been verified as real (typically by security-advisory-triage) against this repo. Use this whenever the user asks to fix, patch, remediate, harden, or "build a comprehensive fix for" a confirmed vulnerability or GHSA, or says something like "now let's fix it" right after a triage/verification step. Don't wait for the user to ask for "the process" by name; if a vulnerability is confirmed and they want it shipped, this skill is almost certainly what they want. Companion to security-advisory-triage, which verifies and writes up the advisory; this one builds and ships the fix.