Find the best CLAUDE.md, AGENTS.md and Claude skills

Hassaan146Skill

senior-security

Hassaan146/claude-skills/senior-security/SKILL.md

Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team, AI security, threat hunting, secure code review). This skill owns threat modeling; everything else routes to a sibling.

kanfu-pandaSkill

pdlc-security

kanfu-panda/pdlc-skills/skills/pdlc-security/SKILL.md

安全审计——先跑依赖漏洞与密钥扫描工具并记录退出码，再人工审阅鉴权、注入、敏感数据等

SHAdd0WTAkaSkill

security-review

SHAdd0WTAka/Zen-Ai-Pentest/skills/security-review/SKILL.md

Security Review & Audit Skill Workflows für PR-Review, Security-Audit, Log-Analyse, Testing, Compliance. ## PR Security Review ### Automatisierte Checks ```bash # Dependency Scan trivy fs --severity CRITICAL,HIGH --exit-code

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

openJiuwen-aiReads credentialsSkill

security-review

openJiuwen-ai/agent-core/.claude/skills/security-review/SKILL.md

10-category security checklist for agent-core: secrets, input validation, sandbox, and prompt injection.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

JeffallanSkill

security-reviewer

Jeffallan/claude-skills/skills/security-reviewer/SKILL.md

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

leonvanzylReads credentialsSkill

security-scanner

leonvanzyl/agentic-coding-starter-kit/.agents/skills/security-scanner/SKILL.md

Performs comprehensive OWASP Top 10:2025 security vulnerability analysis on any codebase. Use this skill whenever the user asks to: review code for security, perform a security audit, scan for vulnerabilities, find security issues, improve application security, check for OWASP compliance, do a penetration test review, assess security posture, look for security flaws, scan for security risks, harden an application, or check code for exploits. Also trigger when the user mentions OWASP, CVEs, CWEs, security hardening, vulnerability assessment, or asks for a security report — even if they don't explicitly say "security scan." This skill works on any codebase in any language (JavaScript, TypeScript, Python, Java, Go, Ruby, C#, PHP, etc.).

derHakenReads credentialsSkill

security-review

derHaken/SuperAntigravity/skills/security-review/SKILL.md

Use when reviewing code for vulnerabilities, implementing authentication or authorization, handling user input, storing sensitive data, or before any feature that touches security boundaries goes to production

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

OpenAISkill

deep-security-scan

openai/codex-security/plugins/codex-security/skills/deep-security-scan/SKILL.md

Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.

OpenAISkill

security-diff-scan

openai/codex-security/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

Model Context ProtocolReads credentialsSkill

security-advisory

modelcontextprotocol/inspector/.claude/skills/security-advisory/SKILL.md

Take a privately reported vulnerability through this repo's security advisory flow — board it, verify who owns the code path, accept or reject, fix it in the private fork, ship to every affected release line, publish, then turn the card into public tracking. Use when a vulnerability is reported privately; when deciding whether an advisory is ours to fix; when looking up or creating its private fork; when answering a reporter; or when a GHSA-titled board card needs handling.

MicrosoftReads credentialsSkill

ghaw-pr-security

microsoft/intelligent-terminal/.github/skills/ghaw-pr-security/SKILL.md

Review Intelligent Terminal pull requests for C++/WinRT, COM, WTA, ACP, session MCP, hooks, terminal mutation, path, diagnostic, packaging, and GitHub Actions security regressions. Use for evidence-based immutable-diff review and structured HIGH/medium/low findings.

SentrySkill

security-review

getsentry/warden/packages/warden/src/builtin-skills/security-review/SKILL.md

Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

axisroboSkill

arch-security

axisrobo/ea-harness/.agents/skills/arch-security/SKILL.md

Deep-dive security audit of a technical architecture diagram. Focused exclusively on authentication, authorization, credential protection, network boundaries, and data classification. Does NOT score overall quality — produces a prioritized security finding list. Use after arch-validate when you want a security specialist's deep cut.

superagent-aiSkill

authz-security

superagent-ai/skills/skills/authz-security/SKILL.md

Review application source code for broken authorization — IDOR / Broken Object Level Authorization (OWASP API1), Broken Function Level Authorization (API5), mass assignment (API3), multi-tenant isolation gaps, and privilege escalation. Reads routes, controllers, resolvers, and data models offline and reports the missing ownership/role check at file:line with a framework-correct fix. No running app, no credentials, no tools. Trigger when reviewing endpoints/handlers, auditing a PR diff that adds or changes routes, hardening a multi-tenant SaaS, or when the user asks "is this endpoint authorized?", "can a user access another user's data?", "IDOR", "BOLA", or "broken access control".