Find the best CLAUDE.md, AGENTS.md and Claude skills

wekanSkill

meteor-security

wekan/wekan/.agents/skills/meteor-security/SKILL.md

Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow/deny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).

nearaiReads credentialsSkill

security-review

nearai/ironclaw/skills/security-review/SKILL.md

Security audit for code changes and PRs — OWASP top 10, auth flows, data handling, secrets exposure, supply chain risks. Writes findings as actionable items.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/servers/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or the SDK underneath, accept or reject, fix it in the private fork, release, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix or belongs to an SDK; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

rtk-aiDeletes or force-pushesSkill

security-guardian

rtk-ai/rtk/.claude/skills/security-guardian/SKILL.md

CLI security expert for RTK - command injection, shell escaping, hook security

code-yeongyuSkill

security-research

code-yeongyu/oh-my-openagent/.agents/skills/security-research/SKILL.md

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.

apereoSkill

cas-web-security

apereo/cas/.claude/skills/cas-web-security/SKILL.md

Rules for the single Spring Security filter chain CAS builds from CasWebSecurityConfigurer beans, shared by actuators, Palantir, the MCP server, OAuth/OIDC and others: declaring CSRF-protected endpoints and registering authentication entry points without breaking other modules. Use when adding or changing a CasWebSecurityConfigurer, CSRF protection or a login entry point in any module.

zhaoxuya520Skill

database-security

zhaoxuya520/reverse-skill/skills/database-security/SKILL.md

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

zhaoxuya520Skill

hardware-security

zhaoxuya520/reverse-skill/skills/hardware-security/SKILL.md

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

colinhacksSkill

security-advisory

colinhacks/zod/.claude/skills/security-advisory/SKILL.md

Triage a draft security advisory in colinhacks/zod — a private vulnerability report from the Security tab, named by GHSA id (GHSA-xxxx-xxxx-xxxx) or reached from "the draft advisories", "the security reports", "the vulnerability queue". Use instead of the `triage` skill whenever the ticket is an advisory rather than a public issue or PR, because the workflow is different: the report is private, the burden of proof is on the reporter, the fix must be LANDED before any comment is drafted, and the publish-or-decline call has its own calculus. Covers reproducing a PoC against main, the schema-vs-input test, deduplicating a cluster of reports into distinct defects, landing the fix first, the publish-vs-decline framework, per-reporter privacy rules that make a GHSA id unlinkable, and the results.md format under .triage/advisories/GHSA-xxxx-xxxx-xxxx/.

OpenAISkill

deep-security-scan

openai/codex-security/plugins/codex-security/skills/deep-security-scan/SKILL.md

Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.

OpenAISkill

security-diff-scan

openai/codex-security/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

JeffallanSkill

security-reviewer

Jeffallan/claude-skills/skills/security-reviewer/SKILL.md

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/inspector/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow — board it, verify who owns the code path, accept or reject, fix it in the private fork, ship to every affected release line, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

GitHubReads credentialsSkill

mcp-security-audit

github/awesome-copilot/skills/mcp-security-audit/SKILL.md

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions, not bare names, @latest, or ranges - Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, npm exec, uvx, uv tool run, and pipx run references in MCP configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]

GoogleSkill

google-cloud-waf-security

google/skills/skills/cloud/google-cloud-waf-security/SKILL.md

Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and perimeter security, data security and encryption, security logging and threat detection, software supply chain hardening, AI security, data privacy, regulatory compliance, and cloud sovereignty. The recommendations are aligned with the Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework (WAF). Use when the user asks about firewall rules, zero trust, shared responsibility and shared fate, audit logging, security monitoring, threat mitigation, shift-left CI/CD security, Secure AI Framework (SAIF), data residency, or hardening Google Cloud resources. Don't use for other Well-Architected Framework pillars (Cost Optimization, Operational Excellence, Reliability, Performance Optimization, or Sustainability).

NVIDIASkill

fix-security-issue

NVIDIA/OpenShell/.agents/skills/fix-security-issue/SKILL.md

Implement an authorized fix for a reviewed security issue and open a PR that closes its issue.

ruvnetSkill

V3 Security Overhaul

ruvnet/wifi-densepose/.claude/skills/v3-security-overhaul/SKILL.md

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Often used withagent-agent·agent-analyze-code-quality·agent-app-store

GoogleSkill

gke-workload-security

google/skills/skills/cloud/gke-workload-security/SKILL.md

Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

GoogleSkill

gke-platform-security

google/skills/skills/cloud/gke-platform-security/SKILL.md

Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security).

ruvnetSkill

V3 Security Overhaul

ruvnet/claude-flow/.agents/skills/v3-security-overhaul/SKILL.md

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

Often used withagent-agent·agent-analyze-code-quality·agent-app-store