Find the best CLAUDE.md, AGENTS.md and Claude skills

JeffallanSkill

security-reviewer

Jeffallan/claude-skills/skills/security-reviewer/SKILL.md

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

openJiuwen-aiReads credentialsSkill

security-review

openJiuwen-ai/agent-core/.claude/skills/security-review/SKILL.md

10-category security checklist for agent-core: secrets, input validation, sandbox, and prompt injection.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

leonvanzylReads credentialsSkill

security-scanner

leonvanzyl/agentic-coding-starter-kit/.agents/skills/security-scanner/SKILL.md

Performs comprehensive OWASP Top 10:2025 security vulnerability analysis on any codebase. Use this skill whenever the user asks to: review code for security, perform a security audit, scan for vulnerabilities, find security issues, improve application security, check for OWASP compliance, do a penetration test review, assess security posture, look for security flaws, scan for security risks, harden an application, or check code for exploits. Also trigger when the user mentions OWASP, CVEs, CWEs, security hardening, vulnerability assessment, or asks for a security report — even if they don't explicitly say "security scan." This skill works on any codebase in any language (JavaScript, TypeScript, Python, Java, Go, Ruby, C#, PHP, etc.).

derHakenReads credentialsSkill

security-review

derHaken/SuperAntigravity/skills/security-review/SKILL.md

Use when reviewing code for vulnerabilities, implementing authentication or authorization, handling user input, storing sensitive data, or before any feature that touches security boundaries goes to production

Often used withdependency-cve-sweep·agent-sort·brand-discovery

OpenAISkill

deep-security-scan

openai/codex-security/plugins/codex-security/skills/deep-security-scan/SKILL.md

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent Standard scans with the Codex Security deep-scan tool. Do not use for PRs, commits, branch diffs, or working-tree diffs.

OpenAISkill

security-diff-scan

openai/codex-security/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/inspector/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow — board it, verify who owns the code path, accept or reject, fix it in the private fork, ship to every affected release line, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

SentrySkill

security-review

getsentry/warden/packages/warden/src/builtin-skills/security-review/SKILL.md

Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

axisroboSkill

arch-security

axisrobo/ea-harness/.agents/skills/arch-security/SKILL.md

Deep-dive security audit of a technical architecture diagram. Focused exclusively on authentication, authorization, credential protection, network boundaries, and data classification. Does NOT score overall quality — produces a prioritized security finding list. Use after arch-validate when you want a security specialist's deep cut.

MicrosoftReads credentialsSkill

ghaw-pr-security

microsoft/intelligent-terminal/.github/skills/ghaw-pr-security/SKILL.md

Review Intelligent Terminal pull requests for C++/WinRT, COM, WTA, ACP, session MCP, hooks, terminal mutation, path, diagnostic, packaging, and GitHub Actions security regressions. Use for evidence-based immutable-diff review and structured HIGH/medium/low findings.

superagent-aiSkill

authz-security

superagent-ai/skills/skills/authz-security/SKILL.md

Review application source code for broken authorization — IDOR / Broken Object Level Authorization (OWASP API1), Broken Function Level Authorization (API5), mass assignment (API3), multi-tenant isolation gaps, and privilege escalation. Reads routes, controllers, resolvers, and data models offline and reports the missing ownership/role check at file:line with a framework-correct fix. No running app, no credentials, no tools. Trigger when reviewing endpoints/handlers, auditing a PR diff that adds or changes routes, hardening a multi-tenant SaaS, or when the user asks "is this endpoint authorized?", "can a user access another user's data?", "IDOR", "BOLA", or "broken access control".

superagent-aiReads credentialsSkill

infra-security

superagent-ai/skills/skills/infra-security/SKILL.md

Audit Infrastructure-as-Code for security misconfigurations before it ships — Terraform (.tf/.tfvars/.hcl), CloudFormation/SAM (YAML/JSON), Kubernetes & Helm manifests, and Docker / Docker Compose. Reads the IaC offline and reports each misconfiguration at file:line with a severity (P0–P3) and a corrected snippet. A dependency-free scanner does the high-recall first pass; the model adds blast-radius and cross-resource judgment. No cloud credentials, no terraform apply, no pip install. Trigger when reviewing a Terraform plan before apply, auditing K8s/Helm manifests or a Dockerfile before deploy, checking CloudFormation for public S3 buckets or open security groups, doing a pre-deployment or compliance (SOC-2 / PCI-DSS / ISO-27001) security review, or when the user asks "audit this Terraform", "is this S3 bucket public?", "is this security group open to the internet?", "is this container running as root?", "what's the blast radius if this infra is wrong?", or "run an IaC security scan".

superagent-aiReads credentialsSkill

recon-security

superagent-ai/skills/skills/recon-security/SKILL.md

Guide authorized external penetration testing from recon through validation and scoped exploitation using free and open-source tools. Use for domain/IP attack surface mapping, subdomain discovery, nmap/httpx/nuclei/ffuf workflows, web app testing, SIP/NAS checks, Burp/ZAP validation, PoC documentation, and pentest reporting without commercial APIs.

1398281322-a11ySkill

api-security

1398281322-a11y/java-backend-guardrails/skills/java-backend-guardrails/api-security/SKILL.md

Use when hardening APIs: HTTPS, HMAC 签名, timestamp+nonce 防重放, CORS, 脱敏, JWT none 算法, 密钥不进 URL. For SQL injection and resource 越权 WHERE, use backend-safe-check.

Often used withbinary-diff·pentest-tools·llm-security

alex-voloshin-devSkill

security-scan

alex-voloshin-dev/ai-skills/.agents/skills/security-scan/SKILL.md

Security scan workflow — dependency audit, OWASP checklist, secrets scan, vulnerability report. Applies software-engineer role with security focus. Use standalone or as part of code review.

Often used withdjango-security·deployment-patterns·postgres-patterns

ashrafiucseReads credentialsSkill

llm-security

ashrafiucse/security-audit-skills/skills/llm-security/SKILL.md

Audits LLM/AI application security — prompt injection and data exfiltration via tools, unsafe model/artifact deserialization (pickle, torch.load, LangChain unsafe_deserialization), hardcoded LLM API keys (OpenAI, Anthropic, Google, Groq, Hugging Face), over-powered agent tools (shell/REPL), prompt/PII logging, and telemetry capturing prompts (LangSmith, W&B). Use when auditing LangChain/LlamaIndex/AutoGen apps, OpenAI/Anthropic integrations, RAG pipelines, chatbots, or repos containing model files.

Often used withattack-chain·pentest-tools·binary-diff

CodeWithBehnamSkill

security-scan

CodeWithBehnam/cc-docs/skills/security-scan/SKILL.md

Scan the codebase for security vulnerabilities based on the OWASP Top 10. Use when the user asks to audit security, find vulnerabilities, check for security issues, or says "security scan", "audit this", "find security bugs".

Often used withdjango-security·deployment-patterns·postgres-patterns

DonTiziReads credentialsSkill

security-scan

DonTizi/CodeGeass/.claude/skills/security-scan/SKILL.md

Deep security analysis of codebase. Scans for secrets, vulnerabilities, and insecure patterns.

Often used withdjango-security·deployment-patterns·postgres-patterns

DorianGalloSkill

api-security

DorianGallo/reverse-skill/skills/api-security/SKILL.md

# API 安全测试 > 覆盖 REST / GraphQL / WebSocket / SOAP 全协议 > 10 阶段方法论，从发现到 CI/CD 集成 ## 适用场景

Often used withpentest-tools·llm-security

DorianGalloSkill

llm-security

DorianGallo/reverse-skill/skills/llm-security/SKILL.md

# LLM / AI 安全测试 > 覆盖 OWASP LLM Top 10 v2.0 + OWASP Agentic AI Top 10

Often used withpentest-tools