One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
luk-s12Skillluk-s12/legion/.claude/skills/security-guide/SKILL.md
Security audit guide, agnostic of language and framework, based on the OWASP Top 10. worktree-agent-security MUST apply it when auditing, classifying each finding by severity and citing concrete evidence before declaring it blocking - so that the lack of context of a narrow audit doesn't stall a User Story for no real reason.
nafeeurSkillnafeeur/MaskShift/skills/security-audit/SKILL.md
Audit code and dependencies for concrete exploitable weaknesses while preserving MaskShift’s intentionally permissive local execution philosophy.
rcdelfinSkillrcdelfin/agentkit/skills/software-development/spatie-security/SKILL.md
Use for secure application, database, server, credential, TLS, CSRF, password, or access-control configuration and review.
ReeperReepxSkillReeperReepx/Security-Audit-Claude-Skill/skills/security-audit/SKILL.md
Enterprise-grade security audit — performs SAST, secrets detection, dependency auditing, IaC review, auth analysis, and auto-remediation across any codebase.
RichardGeorgeDavisSkillRichardGeorgeDavis/Codex-Workspace/.agents/skills/security-check/SKILL.md
Use when a task touches auth, secrets, permissions, unsafe input, shell execution, or other obvious security boundaries.
ronrefaelSkillronrefael/sonde/.claude/skills/security-audit/SKILL.md
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
seikaikyoSkillseikaikyo/dash-skills/skills/security-radar/SKILL.md
資安套件情報雷達。每日掃描並精選「有效、熱門、自身安全」的資安套件/工具，聚焦 Nuxt 3 / Vue 3 / TypeScript（npm）、Go、Python (FastAPI) 技術棧，以及 AI agent / LLM 應用安全（OWASP Agentic 2026、LLM Top 10 2026）。查詢已收錄套件的評估結論、安全狀態與選型建議時使用。
whatthehackinsgSkillwhatthehackinsg/agent-auction/.claude/skills/solidity-security/SKILL.md
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
alexastrumSkillalexastrum/skl/.agents/skills/golang-security/SKILL.md
Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication. Includes configuration of security tools.
wpankSkillwpank/ai/skills/meta/security-review/SKILL.md
Meta-skill that orchestrates a comprehensive security review by coordinating auth, input validation, secrets management, API security, and infrastructure hardening skills. Use before releases, after auth changes, during audits, or when adding new API endpoints.
lirantalSkilllirantal/tokenu/.claude/skills/snyk-skill/SKILL.md
A handful of commands available for code security, dependency security and other security audits using Snyk
pachcaSkillpachca/openapi/skills/pachca-security/SKILL.md
Pachca — журнал безопасности: отслеживание входов, действий пользователей, изменений сообщений и нарушений DLP. Требуется тариф «Корпорация». Используй этот скилл, когда пользователь хочет посмотреть события безопасности, журнал аудита, историю входов, подозрительную активность, узнать кто что делал, экспортировать логи безопасности или отслеживать нарушения DLP. НЕ для отправки сообщений или управления сотрудниками. Use when: журнал безопасности, аудит, события безопасности, кто заходил, история входов, подозрительная активность, DLP, экспорт логов, токены API. NOT for: отправить сообщение, управление сотрудниками.
CaseyLabsSkillCaseyLabs/kc-secure-repo-template/.agents/skills/security-review/SKILL.md
Manual-only skill.
CaseyLabsSkillCaseyLabs/kc-secure-repo-template/.claude/skills/security-review/SKILL.md
Manual-only skill.
clawsoulsSkillclawsouls/soulclaw/.agents/skills/security-triage/SKILL.md
Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.
fmindSkillfmind/dot/skills/security-review/SKILL.md
Review and fix code security; scan secrets and vulnerabilities with Gitleaks and Trivy.
Karthick-RamachandranSkillKarthick-Ramachandran/persist-os/.agents/skills/security-review/SKILL.md
Review a change for security risks before it is accepted. Use when a change touches a trust boundary — file writes, paths, dependencies, stored secrets, network calls, telemetry, MCP, auth — and needs a decision before merging. Skip for feature planning, test writing, and convention checks.
Phelan164SkillPhelan164/codex-howto/skills/review-security/SKILL.md
Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.
tomo3141592653Skilltomo3141592653/ayumu-oss/.claude/skills/security-review/SKILL.md
HTML作品・WebページをXSSやAPIキー露出チェック・公開前の必須チェック・innerHTMLやevalを使っているコードを確認するとき → このスキルを読む
NVIDIASkillNVIDIA/OpenShell/.agents/skills/review-security-issue/SKILL.md
Given a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
