Find the best CLAUDE.md, AGENTS.md and Claude skills

joe-bellSkill

security-review

joe-bell/cva/.agents/skills/security-review/SKILL.md

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

SentrySkill

security-model

getsentry/skills/skills/security-model/SKILL.md

Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.

bienhoangSkill

wp-security

bienhoang/wp-pro-max/skills/wp-security/SKILL.md

Hardens a WordPress build and scans it for vulnerabilities (stage `security`). Applies a hardening checklist via WP-CLI / wp-config (disable file editing, force SSL admin, security headers, limit login attempts, regenerate strong salts, file-permission guidance, hide version, disable XML-RPC if unused, least-privilege users) and runs a vulnerability scan of core/plugins/themes (wp core/plugin/theme check-update plus WPScan/Patchstack known-vuln lookup) and a secrets scan of the theme. Reports findings by severity. Use when hardening WordPress, applying security headers, scanning for vulnerable plugins/themes or leaked secrets, or when the pipeline reaches the `security` stage. Reuses the repo security-scan skill where available. Reads plugins, theme, project; writes security.{hardeningApplied,vulnScan}.

romangalaxys10-specSkill

qa-security

romangalaxys10-spec/fable/skills/qa-security/SKILL.md

name: qa-security title: Automated Security Testing & OWASP Hardening category: Security author: Principal QA Architect & Systems Staff Engineer --- # qa-security — Security Testing & OWASP Hardening Scans for security vulnerabilities including OWASP

thejordanleopoldSkill

ai-security

thejordanleopold/claude-code-skills-distilled/ai-security/SKILL.md

Use when auditing AI/LLM systems for security vulnerabilities, reviewing prompt injection risks, auditing MCP server tool integrations, assessing AI agent behavioral drift, reviewing credential scoping for agents, or designing safe agentic systems. Triggers: \"AI security\", \"LLM security\", \"prompt injection\", \"tool abuse\", \"MCP security\", \"agent security\", \"behavioral drift\", \"AI agent audit\", \"insecure plugin\", \"agentic threat\", \"LLM threat\", \"indirect injection\", \"credential exposure\", \"excessive agency\".

2233adminSkill

api-security

2233admin/reverse-skill-evolver/skills/api-security/SKILL.md

Test authorized REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, input validation, and rate-limiting flaws. Use for API security assessments and JWT/OAuth testing.

Often used withbinary-diff·pentest-tools·llm-security

2233adminDeletes or force-pushesSkill

llm-security

2233admin/reverse-skill-evolver/skills/llm-security/SKILL.md

Assess authorized LLM applications and AI agents for prompt injection, tool misuse, memory poisoning, and model supply-chain weaknesses. Use for AI application security testing and agent threat analysis.

Often used withattack-chain·pentest-tools·binary-diff

5throckReads credentialsSkill

security-scan

5throck/ai-workspace-standards/.agents/skills/security-scan/SKILL.md

Runs static analysis, secret detection (via gitleaks), dependency vulnerability auditing (via bun audit), and auth-surface auditing (unauthenticated signup endpoints) across the workspace.

Often used withdjango-security·deployment-patterns·postgres-patterns

doorkeeper-gemSkill

security-review

doorkeeper-gem/doorkeeper/.agents/skills/security-review/SKILL.md

Verify that code changes do not introduce OAuth security vulnerabilities. Use when modifying token handling, client authentication, scope validation, redirect URI checks, secret comparison, or grant flows in Doorkeeper.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

laolaoshirenSkill

security-audit

laolaoshiren/claude-code-skills-zh/skills/security-audit/SKILL.md

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

Often used withcreate-stories·community-led-growth·story-done

duriantacoSkill

skylos-security

duriantaco/skylos/.agents/skills/skylos-security/SKILL.md

Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries, classify severity, or add regression tests for security-sensitive analyzer behavior.

nirholasSkill

pump-security

nirholas/pump-fun-sdk/skills/pump-security/SKILL.md

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

rackSkill

security-triage

rack/rack/.agents/skills/security-triage/SKILL.md

End-to-end process for handling a Rack security report (GitHub Security Advisory) from receipt to backported release. Use when asked to triage, review, accept, describe, fix, merge, or backport a security advisory, or to review a review document for one.

RustNSparksSkill

security-audit

RustNSparks/sockudo/.agents/skills/security-audit/SKILL.md

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

Often used withcreate-stories·community-led-growth·story-done

dithiothreitolSkill

ea-security

dithiothreitol/ea-skills/skills/ea-security/SKILL.md

Work the security architecture in the existing model - classify data, mark exposure and trust zones, find unguarded paths from the public internet, propose threat assessments for trust-boundary crossings, anchor high-rated systems to a control framework (NIST SP 800-53, SP 800-207, CSF), and check SBOMs against security standards. Use for security architecture reviews, threat modelling, attack-surface or "what could an attacker reach" questions, data classification, zero-trust or control-coverage questions, and SEC001-SEC003 or ALN009 findings.

Kin9ZeusSkill

ai-security

Kin9Zeus/senior-engineer-skills/skills/ai-security/SKILL.md

Security for AI-powered software — LLM applications, agents, tool calling, RAG, MCP servers and AI-assisted coding. Covers prompt injection (direct and indirect), excessive agency, output handling, data leakage, vector-store tenant isolation, AI-provider key theft and spend abuse, supply chain for models, plugins and skills, and testing and monitoring of AI features. Use when the user says "prompt injection", "jailbreak", "secure my chatbot", "LLM security", "AI agent security", "MCP security", "tool calling safe", "RAG security", "OWASP LLM", "system prompt leak", "AI API key leaked", "unexpected OpenAI bill", "unexpected Anthropic bill", "agent permissions", "can the agent be tricked", "AI inference provider attack" or "is it safe to give the agent shell access"; when a project calls an LLM API, defines tools or agents, runs an MCP server, or loads third-party skills or plugins; and as a pass in any audit of an AI feature. Defensive security only. By Devleck.

gocronx-teamSkill

security-check

gocronx-team/gocron/.agents/skills/security-check/SKILL.md

Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities. Use for security reviews, vulnerability remediation, Dependabot security alerts, release hardening, or suspected exposure.

MicrosoftDocsSkill

azure-security

MicrosoftDocs/Agent-Skills/skills/azure-security/SKILL.md

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

jim60105Skill

api-security

jim60105/copilot-prompt/skills/api-security/SKILL.md

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

Often used withbinary-diff·pentest-tools·llm-security

decebalsReads credentialsSkill

security-audit

decebals/claude-code-java/skills/security-audit/SKILL.md

Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.

Often used withcreate-stories·community-led-growth·story-done