Find the best CLAUDE.md, AGENTS.md and Claude skills

chadixearthReads credentialsSkill

security-scan

chadixearth/graphyloop/skills/security-scan/SKILL.md

Scan your OpenCode configuration (.opencode/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks AGENTS.md, settings.json, MCP servers, hooks, and agent definitions.

Often used withdjango-security·deployment-patterns·postgres-patterns

Joshua-PalamuttamReads credentialsSkill

security-scan

Joshua-Palamuttam/workbench-template/.agents/skills/security-scan/SKILL.md

Security audit with Security Engineer posture — OWASP Top 10, secrets detection, dependency risks

Often used withdjango-security·deployment-patterns·postgres-patterns

kayamanReads credentialsSkill

app-security

kayaman/skills/app-security/SKILL.md

Application and infrastructure security review skill. Use this skill whenever reviewing, auditing, designing, or hardening any application — whether it's a new project, a PR review, an architecture decision, or a "is this secure?" question. Covers OWASP Top 10, cloud infrastructure (AWS, Azure, GCP), serverless security, API security, authentication/authorization, secrets management, dependency supply chain, CI/CD pipeline hardening, and observability. Trigger this skill for any mention of security audit, threat model, hardening, vulnerability, pen-test prep, compliance checklist, or secure-by-default architecture. Also trigger when the user asks to review Terraform/IaC, Lambda functions, API Gateway configs, IAM policies, or Cognito setups — even if they don't explicitly say "security."

Kur1sulabSkill

api-security

Kur1sulab/blackbox/pt-api-security/SKILL.md

API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

Often used withbinary-diff·pentest-tools·llm-security

LeahyCCReads credentialsSkill

api-security

LeahyCC/claude-skills/skills/api-security/SKILL.md

OWASP API Security Top 10 (2023) with production Next.js App Router code — access control, authentication, input validation, rate limiting, security headers, data exposure, supply chain, SSRF, and AI tools on those APIs

Often used withbinary-diff·pentest-tools·llm-security

neronainSkill

security-scan

neronain/ClaudeSkills-Neronain/skills/engineering/security-scan/SKILL.md

Run full security scans on the codebase using Ruflo security tools

Often used withdjango-security·deployment-patterns·postgres-patterns

ryankoleanReads credentialsSkill

site-security

ryankolean/summit-claude-skills/skills/site-security/SKILL.md

Security scanning, evaluation, audit, resolution and monitoring for Summit websites and apps. Runs secrets, dependency, static-analysis, CI-workflow, header/TLS and live-site checks; normalizes every result into one findings file; gates production deploys; then triages findings and fixes them one atomic PR at a time. Activates on "security scan", "security audit", "is this site secure", "check for secrets", "vulnerability scan", "harden this site", "fix security findings", "security gate", "pre-launch security check", or as the security part of the framework's audit, launch gate (SUMMIT-252) and monitor modes.

zeljkoobrenovicSkill

security-scan

zeljkoobrenovic/sokrates-skills/skills/scanners/security-scan/SKILL.md

Security review in one pass, design first and code second: identity, authentication and permission design, secrets by design and in the tree, boundary validation and injection (command, SQL, path, template), crypto and randomness, unsafe and dynamic code, trust in third-party code (plugins, models, dependencies), with a posture stating what was swept clean and what was not covered. Use for security reviews or audits, auth or permission design, secrets, injection, crypto, unsafe code, plugin trust, or the threat surface.

Often used withdjango-security·deployment-patterns·postgres-patterns

waybarriosSkill

security-review

waybarrios/opencode-power-pack/skills/security-review/SKILL.md

Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging. This is NOT a general code review.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

codexstar69Skill

security-review

codexstar69/bug-hunter/skills/security-review/SKILL.md

Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

me2reshSkill

security-review

me2resh/apexyard/.claude/skills/security-review/SKILL.md

Security-focused PR review for vulnerabilities and best practices. Invokes the Security Reviewer agent (Hakim).

Often used withdependency-cve-sweep·agent-sort·brand-discovery

MystenLabsSkill

move-security

MystenLabs/skills/move-security/SKILL.md

Move smart contract security on Sui. Use when reviewing Move code for security vulnerabilities, designing access control patterns, handling capabilities safely, securing randomness usage, validating invariants, planning upgrade governance, managing keys, or auditing privileged operations. Also use when the user asks about UpgradeCap security, capability revocation, shared object authorization, onchain randomness restrictions, oracle data validation, emergency controls, or frontend transaction signing safety.

hardw00tSkill

cloud-security

hardw00t/ai-security-arsenal/skills/cloud-security/SKILL.md

Multi-cloud security assessment skill for AWS, Azure, and GCP. Use when performing cloud security audits, scanning for misconfigurations, testing IAM policies, auditing storage permissions, and identifying privilege escalation paths. Triggers on requests to audit cloud security, scan AWS/Azure/GCP, check cloud misconfigurations, or perform cloud penetration testing. Covers CIS benchmarks, CSPM, and cross-cloud identity federation.

TermiX-officialSkill

security-check

TermiX-official/cryptoclaw/skills/security-check/SKILL.md

Assess token and address security via the GoPlus Security API.

MasriyanReads credentialsSkill

09-web-security

Masriyan/Claude-Code-CyberSecurity-Skill/skills/09-web-security/SKILL.md

OWASP Top 10 testing, injection vulnerability detection, API security

appsec-foundrySkill

security-score

appsec-foundry/appsec-advisor/skills/security-score/SKILL.md

Deterministic quick Security Score (0-100) for a repository, computed from the scanner layer alone — no agents, no LLM, no threat model, nothing written into the target repository. Reports the score together with how many rules applied, the finding tally, and the weakest control domains. Use for a fast indication or a per-commit trend; it is not a risk rating and does not replace /appsec-advisor:appsec-analyzer.

Hassaan146Skill

senior-security

Hassaan146/claude-skills/senior-security/SKILL.md

Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.

kanfu-pandaSkill

pdlc-security

kanfu-panda/pdlc-skills/skills/pdlc-security/SKILL.md

安全审计——先跑依赖漏洞与密钥扫描工具并记录退出码，再人工审阅鉴权、注入、敏感数据等

striderZASkill

security-audit

striderZA/OpenCodeGameStudios/.agents/skills/security-audit/SKILL.md

Audit the game for security vulnerabilities: save tampering, cheat vectors, network exploits, data exposure, and input validation gaps. Produces a prioritised security report with remediation guidance. Run before any public release or multiplayer launch.

Often used withcreate-stories·community-led-growth·story-done

SHAdd0WTAkaSkill

security-review

SHAdd0WTAka/Zen-Ai-Pentest/skills/security-review/SKILL.md

Security Review & Audit Skill Workflows für PR-Review, Security-Audit, Log-Analyse, Testing, Compliance. ## PR Security Review ### Automatisierte Checks ```bash # Dependency Scan trivy fs --severity CRITICAL,HIGH --exit-code

Often used withdependency-cve-sweep·agent-sort·brand-discovery