Find the best CLAUDE.md, AGENTS.md and Claude skills

stellaSkill

security-audit

stella/stella/.agents/skills/security-audit/SKILL.md

Audit Stella code, paths, or Git diffs for security defects affecting privileged legal data, tenant isolation, authentication, files, AI, and auditability. Use for security reviews; keep audits read-only unless remediation is explicitly requested.

Often used withcreate-stories·community-led-growth·story-done

openreviewSkill

security-audit

openreview/openreview-py/.github/skills/security-audit/SKILL.md

Perform a targeted privacy and integrity audit of an openreview-py stage, process function, builder, journal flow or helper, tracing the readers, signatures, emails and edges it produces for every venue setting and reproducing findings with an integration test. Use when asked to audit security, check who can see a note or an identity, verify anonymity, review conflict detection or assignment visibility, assess a workflow stage end to end, or when the request mentions threat model, data leak, deanonymization or attack surface for any part of this codebase. For reviewing a pull request diff rather than auditing a whole feature, use the code-review skill instead.

Often used withcreate-stories·community-led-growth·story-done

gongyijie85Reads credentialsSkill

security-scan

gongyijie85/dsh-ecc/skills/security-scan/SKILL.md

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.

Often used withdjango-security·deployment-patterns·postgres-patterns

jdanigoReads credentialsSkill

security-scan

jdanigo/hydraia/skills/security-scan/SKILL.md

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Often used withdjango-security·deployment-patterns·postgres-patterns

redpanda-dataSkill

rpk-security

redpanda-data/skills/skills/rpk-security/SKILL.md

Manage Redpanda authentication and authorization from the CLI using the `rpk security` command group (`user`, `acl`, `role`, `secret` subcommands; `rpk acl` is a deprecated alias). Use when creating or deleting SASL/SCRAM users, granting or revoking Kafka ACLs on topics, groups, the cluster, or transactional IDs, creating or assigning RBAC roles (Enterprise), managing secrets for Redpanda Cloud clusters, or configuring SASL/PLAIN, OAUTHBEARER/OIDC, GSSAPI/Kerberos, or mTLS principal mapping. Also covers Enterprise security config keys like Audit Logging, GBAC, Schema ID Validation, and FIPS mode, plus bootstrapping a new cluster with a superuser. For Schema Registry-specific ACL patterns, see /redpanda:rpk-registry; for the Enterprise license itself, see /redpanda:rpk-cluster.

ShaheerKhawajaReads credentialsSkill

security-scan

ShaheerKhawaja/ProductionOS/.claude/skills/security-scan/SKILL.md

ProductionOS security scanner. Auto-activates when editing auth, payment, credential, or admin files. Runs OWASP Top 10 checks, dependency audit, and secret detection.

Often used withdjango-security·deployment-patterns·postgres-patterns

YepAPISkill

api-security

YepAPI/skills/skills/api-security/SKILL.md

API security — strict CORS, rate limiting, payload limits, key rotation.

Often used withbinary-diff·pentest-tools·llm-security

colinhacksSkill

security-advisory

colinhacks/zod/.claude/skills/security-advisory/SKILL.md

Triage a draft security advisory in colinhacks/zod — a private vulnerability report from the Security tab, named by GHSA id (GHSA-xxxx-xxxx-xxxx) or reached from "the draft advisories", "the security reports", "the vulnerability queue". Use instead of the `triage` skill whenever the ticket is an advisory rather than a public issue or PR, because the workflow is different: the report is private, the burden of proof is on the reporter, the fix must be LANDED before any comment is drafted, and the publish-or-decline call has its own calculus. Covers reproducing a PoC against main, the schema-vs-input test, deduplicating a cluster of reports into distinct defects, landing the fix first, the publish-vs-decline framework, per-reporter privacy rules that make a GHSA id unlinkable, and the results.md format under .triage/advisories/GHSA-xxxx-xxxx-xxxx/.

wpultimatesecuritySkill

ajax-security

wpultimatesecurity/WordPress-Security-Skills/skills/ajax-security/SKILL.md

Use when registering or handling WordPress AJAX over admin-ajax.php - wp_ajax_{action} / wp_ajax_nopriv_{action} hooks, JavaScript that posts to admin_url('admin-ajax.php'), or wp.apiFetch / fetch calls to custom actions. Verifies the nonce with check_ajax_referer, gates the action with current_user_can, unslashes and sanitizes every field, and replies with wp_send_json_success / wp_send_json_error. Prevents CSRF, broken access control, and injection on the AJAX surface.

zhaoxuya520Skill

database-security

zhaoxuya520/reverse-skill-private/skills/database-security/SKILL.md

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

zhaoxuya520Skill

hardware-security

zhaoxuya520/reverse-skill-private/skills/hardware-security/SKILL.md

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

robconeryReads credentialsSkill

security-web

robconery/kolea/.claude/skills/security-web/SKILL.md

Web application security review for TypeScript/JavaScript stacks, frontend and backend: XSS and output encoding, CSRF, clickjacking, secrets leaking into client bundles, authn/authz and IDOR, injection (SQL/command/NoSQL/ template), SSRF, mass assignment, insecure deserialization, file upload, path traversal, security headers and cookie flags, and dependency/supply- chain risk. Includes targeted rules for Next.js (Server Actions, route handlers, middleware, `NEXT_PUBLIC_`, RSC data exposure), Nuxt (Nitro server routes, `runtimeConfig` vs `public`, `v-html`), Bun (`Bun.serve`, `Bun.$` shell, file serving), and Hono (middleware order, JWT, CORS, context). Use when reviewing or writing web code for vulnerabilities, triaging a security finding, or answering "is this exploitable / how do I fix it" questions. Ships secure-default config templates and a finding report format.

viknesh20-20Reads credentialsSkill

security-scan

viknesh20-20/claude-code-tool-kit/.claude/skills/security-scan/SKILL.md

Scans the codebase for security vulnerabilities including injection flaws, authentication issues, hardcoded secrets, and insecure configurations. Run before any PR touching auth, user input, or external APIs.

Often used withdjango-security·deployment-patterns·postgres-patterns

zcaceresReads credentialsSkill

security-scfw

zcaceres/skills/skills/security-scfw/SKILL.md

Set up and use Datadog's Supply-Chain Firewall (scfw) to block known-malicious npm/PyPI/Poetry packages at install time. Two modes — setup (pipx-install scfw, run `scfw configure` to route pip/npm/poetry through the firewall via shell aliases, smoke-test the pipeline with a dry run, and optionally install a Claude Code or Codex PreToolUse hook so the agent's own installs are vetted too) and review (confirm the firewall is still wired, read the local JSON Lines log for recent blocks/warnings, run `scfw audit` on installed packages, answer "did scfw block/see package X"). Client-side, install-time gate for a single developer machine — complements CI-side scanning, doesn't replace it. User-triggered only — activate via `/security-scfw [subcommand]`, or `$security-scfw [subcommand]` in Codex.

zcaceresSkill

security-snyk

zcaceres/skills/skills/security-snyk/SKILL.md

Set up Snyk on a repo. The integration is a GitHub App plus a Snyk-side "import this repo as a project" step, not a checked-in config, so most of the skill is walking the user through the three browser steps (Snyk login → GitHub App install → Add project) and then verifying via the GitHub API that the App actually landed on the right account. Pre-flips "Automatic fix PRs" off so the install doesn't dump a backlog of fix PRs into the repo. Optionally scaffolds a pinned CI workflow that runs `snyk code test` (SAST), which isn't covered by the App's free tier dependency-CVE scanning. User-triggered only — activate when the user invokes `/security-snyk`.

OpenBMBSkill

security-triage

OpenBMB/EdgeClaw/.agents/skills/security-triage/SKILL.md

Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.

KimYx0207Skill

code-security

KimYx0207/SkillSemgrep/SKILL.md

Runs Semgrep security scans on the current project to detect vulnerabilities, secrets leakage, and OWASP Top 10 issues. Use when the user asks for security scanning, vulnerability detection, code auditing, secrets checking, or says things like 安全扫描, 代码扫描, 扫漏洞, 安全检查, 漏洞检测, 扫一下安全.

altafinoSkill

kit-security

altafino/FableClaudeMDForOpus/.claude/skills/kit-security/SKILL.md

Security guardrails pack — injection, secrets, path traversal, auth defaults, deserialization, untrusted-content discipline. Use when asked for a security pass or when code touches user input, secrets, or auth.

sergeyklaySkill

scan-security

sergeyklay/.agents/.agents/skills/scan-security/SKILL.md

Run a Snyk SAST + SCA security audit on the repository, remediate findings that pass the project's verification gates, and write a prioritized report to .audit/. Optional scope argument: all (default), code, deps, or changed.

SentrySkill

security-review

getsentry/skills/skills/security-review/SKILL.md

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Often used withdependency-cve-sweep·agent-sort·brand-discovery