Find the best CLAUDE.md, AGENTS.md and Claude skills

MicrosoftDocsSkill

azure-security

MicrosoftDocs/Agent-Skills/skills/azure-security/SKILL.md

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

jim60105Skill

api-security

jim60105/copilot-prompt/skills/api-security/SKILL.md

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

Often used withbinary-diff·pentest-tools·llm-security

decebalsReads credentialsSkill

security-audit

decebals/claude-code-java/skills/security-audit/SKILL.md

Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.

Often used withcreate-stories·community-led-growth·story-done

Ray0907Skill

security-scan

Ray0907/security-scan/SKILL.md

Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.

Often used withdjango-security·deployment-patterns·postgres-patterns

thejefflarsonSkill

ipc-security

thejefflarson/soundcheck/.claude/skills/ipc-security/SKILL.md

Detects IPC receivers that accept input without verifying caller identity. Use

thejefflarsonSkill

mcp-security

thejefflarson/soundcheck/.claude/skills/mcp-security/SKILL.md

Detects MCP tool handlers vulnerable to malicious inputs, hardcoded secrets,

thejefflarsonSkill

rag-security

thejefflarson/soundcheck/.claude/skills/rag-security/SKILL.md

Detects RAG pipelines that ingest external documents into LLM context without

alinaqiSkill

security-audit

alinaqi/maggy/skills/security-audit/SKILL.md

Structured, adversarial, multi-phase security audit of a codebase — recon → coverage-led hunting → finder≠validator validation → machine-readable findings → target-neutral report

Often used withcreate-stories·community-led-growth·story-done

hellowind777Reads credentialsSkill

hello-security

hellowind777/helloagents/skills/hello-security/SKILL.md

涉及认证、密码、token、JWT、OAuth、session、cookie、加密、密钥、API key、权限、角色、用户输入验证、文件上传等安全敏感操作时使用。

ThibautBaissacSkill

security-audit

ThibautBaissac/rails_ai_agents/.agents/skills/security-audit/SKILL.md

Audits Rails application security against OWASP Top 10, detects vulnerabilities with Brakeman, and verifies Pundit authorization policies. Use when the user wants a security audit, vulnerability scan, or when user mentions security, OWASP, Brakeman, XSS, SQL injection, or authorization. WHEN NOT: Implementing security fixes (use specialist agents), setting up authentication (use authentication-flow), or writing Pundit policies (use policy-agent).

Often used withcreate-stories·community-led-growth·story-done

samberSkill

golang-security

samber/cc-skills-golang/skills/golang-security/SKILL.md

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

Often used withgolang-how-to·golang-gopls·golang-refactoring

argos-ciSkill

security-audit

argos-ci/argos/.agents/skills/security-audit/SKILL.md

Run a deep security audit of Argos — or of one area of it — that ends in verified findings, a fix with a guard test for each contained one, and a private report of the rest. Covers GraphQL and REST authorization, multi-tenant isolation, authentication (sessions, SAML, SCIM, OAuth, passkeys, CLI login, CI tokens), webhooks and outgoing requests, uploads and deployments, and client-side redirects and XSS. Use whenever someone asks for a security audit, pentest, vulnerability hunt or threat-model review, asks to "find security holes" or "check for breaches", wants to know whether tenants or roles are properly isolated, or asks to review an area (SAML, the REST API, webhooks…) for vulnerabilities. For a review of only the pending diff on a branch, the lighter built-in security review fits better.

Often used withcreate-stories·community-led-growth·story-done

ceptlnSkill

security-fix

ceptln/quota-burner/skills/security-fix/SKILL.md

Use to find and fix one batch of concrete security issues: vulnerable dependencies, injection risks, secrets in code, unsafe patterns.

ProxiBlueReads credentialsSkill

security-scan

ProxiBlue/claude-skills/security-scan/SKILL.md

Comprehensive Magento 2 security scanning skill that checks for vulnerabilities, misconfigurations, outdated dependencies, security patches, and compliance with security best practices.

Often used withdjango-security·deployment-patterns·postgres-patterns

gmh5225Skill

mobile-security

gmh5225/awesome-game-security/.claude/skills/mobile-security/SKILL.md

Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing. Use when mobile OS or device behavior is central.

awarexoneSkill

api-security

awarexone/AXguard/api-security/SKILL.md

Analyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).

Often used withbinary-diff·pentest-tools·llm-security

awarexoneSkill

jwt-security

awarexone/AXguard/jwt-security/SKILL.md

Analyze JWT implementation flaws — use when reviewing alg confusion, none algorithm, missing verify, weak secrets, or claim validation gaps (A07:2021 / API2:2023 / auth.jwt rules).

awarexonePipes a download into a shellSkill

mcp-security

awarexone/AXguard/mcp-security/SKILL.md

Review Model Context Protocol servers/clients and tool bridges for trust, supply-chain, and over-privileged tool exposure before ship.

delorenjSkill

aws-security

delorenj/skills/aws-security/SKILL.md

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

AndreyBegmaReads credentialsSkill

cs-security

AndreyBegma/claude-code-plugin/skills/security/SKILL.md

Scan the project for security vulnerabilities, insecure patterns, exposed secrets, and OWASP Top 10 issues