Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
vince-winkintelSkillvince-winkintel/gitlab-cli-skills/glab-security/SKILL.md
Configure GitLab project security scan profiles with glab. Use when enabling, disabling, or checking GitLab security scan profiles such as SAST, dependency scanning, secret detection, container scanning, or dependency-scanning auto-remediation. Triggers on GitLab security config, security scan profile, enable SAST, dependency scanning, secret detection, glab security.
viknesh20-20Skillviknesh20-20/claude-code-tool-kit/.claude/skills/security-scan/SKILL.md
Scans the codebase for security vulnerabilities including injection flaws, authentication issues, hardcoded secrets, and insecure configurations. Run before any PR touching auth, user input, or external APIs.
zhaoxuya520Skillzhaoxuya520/reverse-skill/skills/database-security/SKILL.md
Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
zhaoxuya520Skillzhaoxuya520/reverse-skill/skills/hardware-security/SKILL.md
Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
KimYx0207SkillKimYx0207/SkillSemgrep/SKILL.md
Runs Semgrep security scans on the current project to detect vulnerabilities, secrets leakage, and OWASP Top 10 issues. Use when the user asks for security scanning, vulnerability detection, code auditing, secrets checking, or says things like 安全扫描, 代码扫描, 扫漏洞, 安全检查, 漏洞检测, 扫一下安全.
altafinoSkillaltafino/FableClaudeMDForOpus/.claude/skills/kit-security/SKILL.md
Security guardrails pack — injection, secrets, path traversal, auth defaults, deserialization, untrusted-content discipline. Use when asked for a security pass or when code touches user input, secrets, or auth.
redpanda-dataSkillredpanda-data/skills/skills/rpk-security/SKILL.md
Manage Redpanda authentication and authorization from the CLI using the `rpk security` command group (`user`, `acl`, `role`, `secret` subcommands; `rpk acl` is a deprecated alias). Use when creating or deleting SASL/SCRAM users, granting or revoking Kafka ACLs on topics, groups, the cluster, or transactional IDs, creating or assigning RBAC roles (Enterprise), managing secrets for Redpanda Cloud clusters, or configuring SASL/PLAIN, OAUTHBEARER/OIDC, GSSAPI/Kerberos, or mTLS principal mapping. Also covers Enterprise security config keys like Audit Logging, GBAC, Schema ID Validation, and FIPS mode, plus bootstrapping a new cluster with a superuser. For Schema Registry-specific ACL patterns, see /redpanda:rpk-registry; for the Enterprise license itself, see /redpanda:rpk-cluster.
sergeyklaySkillsergeyklay/.agents/.agents/skills/scan-security/SKILL.md
Run a Snyk SAST + SCA security audit on the repository, remediate findings that pass the project's verification gates, and write a prioritized report to .audit/. Optional scope argument: all (default), code, deps, or changed.
awarexoneSkillawarexone/Agentic-Bug-Hunter/skills/security-arsenal/SKILL.md
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
blundergoatSkillblundergoat/goat-flow/.agents/skills/goat-security/SKILL.md
Use when assessing security implications of code changes, architecture decisions, or new features.
MicrosoftSkillmicrosoft/power-platform-skills/plugins/power-pages/skills/security-review/SKILL.md
Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report covering source code and dependencies, the live site, browser headers, firewall, authentication, and role-based permissions. Use when the user wants a full security review, a release-readiness check before publishing, a code-and-config check during development, live site monitoring, or asks open-ended questions like "review my site security", "is my site safe to ship", "do a security check", "monitor my site" — even if they do not name the individual checks.
robconerySkillrobconery/kolea/.claude/skills/security-web/SKILL.md
Web application security review for TypeScript/JavaScript stacks, frontend and backend: XSS and output encoding, CSRF, clickjacking, secrets leaking into client bundles, authn/authz and IDOR, injection (SQL/command/NoSQL/ template), SSRF, mass assignment, insecure deserialization, file upload, path traversal, security headers and cookie flags, and dependency/supply- chain risk. Includes targeted rules for Next.js (Server Actions, route handlers, middleware, `NEXT_PUBLIC_`, RSC data exposure), Nuxt (Nitro server routes, `runtimeConfig` vs `public`, `v-html`), Bun (`Bun.serve`, `Bun.$` shell, file serving), and Hono (middleware order, JWT, CORS, context). Use when reviewing or writing web code for vulnerabilities, triaging a security finding, or answering "is this exploitable / how do I fix it" questions. Ships secure-default config templates and a finding report format.
VeryGoodOpenSourceSkillVeryGoodOpenSource/vgv-ai-flutter-plugin/skills/static-security/SKILL.md
Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies. Use when reviewing or writing code handling secrets, user data, network communication, authentication, or cryptography, or adding validation to user input in login, sign-up, or payment forms reaching a repository or an API, as in "add validation to this form", "nothing is checked before this hits the API", or "validate these fields". Also when asked to implement the insecure change, not review it: "our reviewer flagged this line", "move this API key to --dart-define", "read it back with String.fromEnvironment", a .env file, or "pass it in from our CI secrets". Also for dependency vulnerability review and security audits even when it never says "security": "we cut a release tomorrow, is this pubspec safe", "check our dependencies for known vulnerabilities", "scan for CVEs", "is this ignored_advisories entry fine", or pinned versions we're exposed to.
elementalsoulsSkillelementalsouls/Claude-BugHunter/skills/security-arsenal/SKILL.md
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.
irahardiantoSkillirahardianto/awesome-agv/.agents/skills/security-audit/SKILL.md
Orchestration reference for the /security-audit workflow. Contains dimension scope cards for parallel subagent dispatch, subagent prompt template, and security audit report template.
forefySkillforefy/.context/skills/defensive/parse-security/SKILL.md
The last gate before untrusted instruction content is ingested. Screens a skill, goal or workflow fetched from git or any remote source for prompt injection, reading it as evidence rather than as instructions, on the assumption that its author wrote it to defeat this exact review. Use before installing, enabling, updating or reviewing any agent instruction content that did not come from the user directly - registry installs, git clones, gists, pasted SKILL.md files, or a skill that pulls further files at runtime.
ddmsolutionsSkillddmsolutions/claude-skills/ai-security/SKILL.md
Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.
jnMetaCodeSkilljnMetaCode/shellward/skills/security-guide/SKILL.md
OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation
wlsdksSkillwlsdks/ontology-atlas/.agents/skills/security-audit/SKILL.md
Periodic security sweep of Atlas in four areas (MCP and CLI, the Tauri desktop shell, the web renderer and connectors, the supply chain and CI) that follows untrusted input to what it can reach, proves each reach with a planted input, and turns every confirmed finding into a fix slice with a regression test. Not for a single diff, which takes the reviewer's security lens.
wlsdksSkillwlsdks/ontology-atlas/.claude/skills/security-audit/SKILL.md
Periodic security sweep of Atlas in four areas — MCP and CLI, the Tauri desktop shell, the web renderer and connectors, and the supply chain and CI — that follows untrusted input to what it can reach, proves each reach with a planted input, and turns every confirmed finding into a fix slice with a regression test.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
