Find the best CLAUDE.md, AGENTS.md and Claude skills

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/servers/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or the SDK underneath, accept or reject, fix it in the private fork, release, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix or belongs to an SDK; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

rtk-aiDeletes or force-pushesSkill

security-guardian

rtk-ai/rtk/.claude/skills/security-guardian/SKILL.md

CLI security expert for RTK - command injection, shell escaping, hook security

rusel95Skill

ios-security

rusel95/ios-agent-skills/skills/ios-security/SKILL.md

Use for any iOS security question — whether you're asking about a specific vulnerability, checking if a pattern is secure, or running a full audit. Triggers on: Keychain vs UserDefaults decisions, ATS/NSAllowsArbitraryLoads configuration, certificate pinning implementation, WebView security (UIWebView, WKWebView), hardcoded secrets or API keys, jailbreak/tamper detection, biometric authentication, MASVS controls, OWASP mobile security, App Store rejection risks, and compliance requirements (HIPAA, PCI DSS, GDPR). Also use when someone asks 'is this secure?', 'what should I use instead?', or 'how do I fix this?' about any iOS storage, network, or cryptography pattern.

superagent-aiReads credentialsSkill

ci-cd-security

superagent-ai/skills/skills/ci-cd-security/SKILL.md

Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution. Use this skill whenever the user shares a `.github/workflows/` file, pastes workflow YAML, asks for a CI/CD security review, mentions `pull_request_target`, `workflow_run`, action pinning, `GITHUB_TOKEN` permissions, pwn requests, template injection, cache poisoning, secret exfiltration, supply chain risk, or any GitHub Actions hardening topic. Also trigger when the user is hardening an OSS repo, doing a CI/CD red team assessment, evaluating a target for supply-chain scanning, or writing publicly about CI/CD security. Bias toward triggering this skill rather than answering from memory — CI/CD security defaults are wrong almost everywhere and the rules are unintuitive.

superagent-aiSkill

skill-security

superagent-ai/skills/skills/skill-security/SKILL.md

Audit an AI agent skill for security risks before installing or trusting it. Runs a deterministic scanner (regex patterns, Python AST analysis, source-to-sink taint tracking, and YARA signatures) and then reasons about intent — catching prompt injection, credential exfiltration, persistence, memory poisoning, malicious code, supply-chain risks, and description-vs-behavior mismatch. Make sure to use this skill whenever the user wants to scan, audit, vet, review, or check the safety of a skill, plugin, SKILL.md, or agent tool — whether it is a local folder, a zip/.skill file, or a cloned repo — and whenever someone asks "is this skill safe to install?".

ziggy42Skill

security-audit

ziggy42/epsilon/.agents/skills/security-audit/SKILL.md

Use this skill to perform a security-focused audit of the codebase to identify vulnerabilities, sandbox escapes, and logic flaws.

Often used withcreate-stories·community-led-growth·story-done

n24q02mSkill

security-sweep

n24q02m/better-code-review-graph/skills/security-sweep/SKILL.md

Graph-driven security sweep -- scan for dangerous sinks, then rank each finding by whether an entry point can actually reach it, and triage the rest into suppressions.

bybren-llcReads credentialsSkill

security-audit

bybren-llc/safe-agentic-workflow/.agents/skills/security-audit/SKILL.md

RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes for auth, scanning for vulnerabilities, reviewing for exposed credentials, or performing pre-deployment security review. Do NOT use for routine feature development.

Often used withcreate-stories·community-led-growth·story-done

bybren-llcReads credentialsSkill

security-audit

bybren-llc/safe-agentic-workflow/.claude/skills/security-audit/SKILL.md

RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes, or scanning for security issues.

Often used withcreate-stories·community-led-growth·story-done

hypnguyen1209Skill

cloud-security

hypnguyen1209/offensive-claude/skills/cloud-security/SKILL.md

Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse

vemetricSkill

redis-security

vemetric/vemetric/.agents/skills/redis-security/SKILL.md

Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.

code-yeongyuSkill

security-research

code-yeongyu/oh-my-openagent/.agents/skills/security-research/SKILL.md

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.

developer-overheid-nlSkill

don-security

developer-overheid-nl/skills-developer-overheid-nl/skills/don-security/SKILL.md

Authenticatie en beveiliging bij Nederlandse overheid: DigiD, eHerkenning, OAuth, OIDC, PKIoverheid, BIO, NIS2, security.txt, kwetsbaarheid melden.

EvilFreelancerSkill

iac-security

EvilFreelancer/secas/.agents/skills/iac-security/SKILL.md

Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep. Orchestrates Checkov, tfsec, Terrascan, KICS, kubesec, kube-linter, Polaris, cfn-lint/cfn-nag, and OPA/Conftest. Use when auditing IaC for misconfigurations, scanning Terraform plans, validating K8s security policies, checking cloud infrastructure compliance, or authoring custom policy-as-code (Rego).

vitormiziaraSkill

saas-security

vitormiziara/saas-security/SKILL.md

Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or authorization logic, check for injection risks, race conditions, or insecure configurations, or asks anything related to SaaS security hardening. Also trigger proactively when the user shares code and asks for a review — always include a security perspective using this skill.

KbWenSkill

auth-security

KbWen/agent-virtual-office/.agents/skills/auth-security/SKILL.md

Secure authentication and authorization when credentials, sessions, roles, or permissions change.

agammSkill

owasp-security

agamm/claude-code-owasp/.claude/skills/owasp-security/SKILL.md

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security issues, implementing authentication, authorization, sessions, or cryptography, handling untrusted input, files, or URLs, hardening config, dependencies, or CI, or building LLM and AI agent features.

trycompaiSkill

security-review

trycompai/comp/.claude/skills/security-review/SKILL.md

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

apereoSkill

cas-web-security

apereo/cas/.claude/skills/cas-web-security/SKILL.md

Rules for the single Spring Security filter chain CAS builds from CasWebSecurityConfigurer beans, shared by actuators, Palantir, the MCP server, OAuth/OIDC and others: declaring CSRF-protected endpoints and registering authentication entry points without breaking other modules. Use when adding or changing a CasWebSecurityConfigurer, CSRF protection or a login entry point in any module.

auxi-wardrobeSkill

ck:security

auxi-wardrobe/auxi-all-in/.agents/skills/ck-security/SKILL.md

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern.