Claude skills and agent skills

steipeteSkill

security-triage

steipete/clawdis/.agents/skills/security-triage/SKILL.md

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

affaan-mReads credentialsSkill

security-review

affaan-m/ECC/.agents/skills/security-review/SKILL.md

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

MicrosoftSkill

security-report-check

microsoft/TypeScript/.github/skills/security-report-check/SKILL.md

Are you doing security research on this repo? This document covers what guarantees and non-guarantees are provided. Consult this document before reporting a security issue or conducting security research.

addyosmaniReads credentialsSkill

security-and-hardening

addyosmani/agent-skills/skills/security-and-hardening/SKILL.md

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Often used withconstraint-driven-development·observability-and-instrumentation·doubt-driven-development

paperclipaiSkill

deal-with-security-advisory

paperclipai/paperclip/.agents/skills/deal-with-security-advisory/SKILL.md

Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.

electronSkill

chrome-release-verify

electron/electron/.claude/skills/chrome-release-verify/SKILL.md

End-to-end Chrome security backport for an Electron release branch. Given a Chrome Releases blog URL and a branch (e.g. 41-x-y), determines which CVE fixes are missing from the *actual synced source*, writes the cherry-pick patches locally, validates them with `e sync --3` + `lint --patches`, then pushes a single PR. Use when asked to backport a Chrome security release to N-x-y, "is CVE-X already in N-x-y?", or to produce/validate the cherry-pick set for a release branch.

No other project uses it yet

steipeteSkill

healthcheck

steipete/clawdis/skills/healthcheck/SKILL.md

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

Often used withdiscord-e2e·taskflow-inbox-triage·node-connect

garrytanSkill

cso

garrytan/gstack/cso/SKILL.md

Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)

Often used withios-clean·open-gstack-browser·landing-report

GoogleSkill

critique

google-gemini/gemini-cli/tools/gemini-cli-bot/.gemini/skills/critique/SKILL.md

Expertise in auditing and fixing repository scripts and GitHub Actions workflows to ensure technical robustness and security.

Often used withdelight·normalize·extract

NousResearchSkill

requesting-code-review

NousResearch/hermes-agent/skills/software-development/requesting-code-review/SKILL.md

Pre-commit review: security scan, quality gates, auto-fix.

Often used withchinese-code-review·diagnosing-superpowers·workflow-runner

steipeteSkill

openclaw-ghsa-maintainer

steipete/clawdis/.agents/skills/openclaw-ghsa-maintainer/SKILL.md

Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.

denolandSkill

review-pr

denoland/deno/.claude/skills/review-pr/SKILL.md

Review a Deno runtime pull request for correctness, tests, security, and conventions. Use when asked to review a PR or when a PR number/URL is provided for review.

Significant-GravitasSkill

pr-review

Significant-Gravitas/AutoGPT/.claude/skills/pr-review/SKILL.md

Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks to review a PR, check PR quality, or give feedback on a PR.

Often used withpr-fix

pytorchSkill

pr-review

pytorch/pytorch/.agents/skills/pr-review/SKILL.md

Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".

Often used withpr-fix

n8n-ioSkill

n8n:human-like-code-review

n8n-io/n8n/.agents/skills/human-like-code-review/SKILL.md

Reviews a GitHub pull request like a thoughtful human reviewer and writes the feedback to a markdown file. Prioritizes context, architecture fit, solution complexity, bugs, security edge cases, and missing tests. Use when given a PR URL to review, or when the user says /human-like-code-review.

DietrichGebertSkill

ponytail-audit

DietrichGebert/ponytail/skills/ponytail-audit/SKILL.md

Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.

electronSkill

chrome-release-cls

electron/electron/.claude/skills/chrome-release-cls/SKILL.md

Given a Chrome Releases blog post URL (chromereleases.googleblog.com), extract every CVE/bug and find the underlying Gerrit CL that fixed it by searching the local Chromium checkout and sub-repos. Use when asked to map Chrome security release notes to fixing CLs, or to find which commits correspond to CVEs in a Chrome stable update.

No other project uses it yet

langflow-aiReads credentialsSkill

backend-code-review

langflow-ai/langflow/.agents/skills/backend-code-review/SKILL.md

Review backend code for quality, security, maintainability, and best practices based on established checklist rules. Use when the user requests a review, analysis, or improvement of backend files (e.g., `.py`) under the `src/backend/` directory. Do NOT use for frontend files (e.g., `.tsx`, `.ts`, `.js`). Supports pending-change review, code snippets review, and file-focused review.

addyosmaniSkill

doubt-driven-development

addyosmani/agent-skills/skills/doubt-driven-development/SKILL.md

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

Often used withconstraint-driven-development·using-agent-skills·observability-and-instrumentation

SupabaseSkill

safe-sql-execution

supabase/supabase/.agents/skills/safe-sql-execution/SKILL.md

Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint that builds/returns SQL for database objects (tables, views, functions, DB triggers, indexes, RLS policies); interpolating a schema/table/column/search/route-param value into SQL text; storing, fetching, or re-running SQL that round-trips from the database (a policy's definition, a function/view definition, a snippet's saved content); and any "Run"/"Apply"/"Execute" action that sends SQL to a project's database (SQL editor run-selection, policy editor apply, snippet runner). Load this BEFORE writing such code, not only when reviewing a finished diff. Skip only for changes that never touch SQL text or execution — styling, unrelated data hooks, non-SQL form validation, or UI layout work.

No other project uses it yet