One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
AbdurRafay2004SkillAbdurRafay2004/handoff/skills/security/SKILL.md
Use for a full security audit — T3 verify gate (money, auth, user data, migrations), pre-launch check, or when the user asks to audit the codebase for vulnerabilities. For quick diff-scoped checks, prefer a host-provided security reviewer when available, otherwise apply this skill to the diff.
Often used withcost-reduceralbert-dmscalability
AhmedAbdelfattah0Reads credentialsSkillAhmedAbdelfattah0/AI-Skills/skills/security/SKILL.md
Secure-by-default coding practices that stop fast-moving work from shipping a vulnerability — apply them by default, even when unasked.
Often used withcost-reduceralbert-dmscalability
daianepepes-labSkilldaianepepes-lab/claude-skills/security/SKILL.md
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Often used withcost-reduceralbert-dmscalability
n-n-codeSkilln-n-code/n-n-code-skills/.agents/skills/security/SKILL.md
Evidence-grounded threat modeling, vulnerability review, and secure implementation. Use for explicit security audits or primary risks involving authorization, untrusted input, external requests, parsers/uploads, secrets, sensitive data, isolation, or release integrity. Not for routine implementation or non-security red-teaming. Add `security-identity-access` for identity and tenant authorization.
Often used withcost-reduceralbert-dmscalability
plipowczanSkillplipowczan/claude-piv-skeleton/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withcost-reduceralbert-dmscalability
pluginagentmarketplaceReads credentialsSkillpluginagentmarketplace/custom-plugin-backend/skills/security/SKILL.md
Secure backend applications against OWASP threats. Implement authentication, encryption, scanning, compliance, and incident response procedures.
Often used withcost-reduceralbert-dmscalability
RhovianSkillRhovian/niles/skills/security/SKILL.md
Use when security review is requested.
Often used withcost-reduceralbert-dmscalability
sny-tanakaSkillsny-tanaka/tanacode/.claude/skills/security/SKILL.md
tanacode のセキュリティの対応の手順。Dependabot の警告・脆弱性の非公開の報告（Private vulnerability reporting）・コードスキャンとシークレットスキャンの警告への対応や、セキュリティの観点でのコードの点検をするときに使います。
Often used withcost-reduceralbert-dmscalability
umararshad4Reads credentialsSkillumararshad4/honey-stack/skills/security/SKILL.md
Use when touching auth, sessions, permissions, secrets, payments, user data, DB writes, webhooks or deploy config, or when asked for a security audit.
Often used withcost-reduceralbert-dmscalability
yoonationReads credentialsSkillyoonation/ai-grounded/.claude/skills/security/SKILL.md
Security patterns and frameworks. Use when reviewing code for vulnerabilities, designing authentication/authorization, writing IAM policies, handling secrets, or discussing threat models.
Often used withcost-reduceralbert-dmscalability
JustinK33SkillJustinK33/foreman/skills/security/SKILL.md
Use when the user asks for a security review, vulnerability scan, security audit, or to check code for security issues, front end or back end.
Often used withcost-reduceralbert-dmscalability
vndeeReads credentialsSkillvndee/engineering-skills/.claude/skills/security/SKILL.md
Use when implementing authentication, authorization, input validation, or security hardening in Go, Python, or React applications
Often used withcost-reduceralbert-dmscalability
zhaoxuya520Skillzhaoxuya520/reverse-skill-private/skills/api-security/SKILL.md
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
Often used withattack-chainllm-securitypentest-tools
zhaoxuya520Skillzhaoxuya520/reverse-skill-private/skills/llm-security/SKILL.md
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Often used withattack-chainpentest-toolsbinary-diff
bchoxSkillbchox/agent-practices/skills/security/SKILL.md
Use when the change touches auth, secrets, trust boundaries, or sensitive data.
Often used withcost-reduceralbert-dmscalability
Effulgent-PointSkillEffulgent-Point/paw/skills/security/SKILL.md
Security Skill **When to use:** Any code touching authentication, user input, external APIs, or sensitive data. ## OWASP Top 10 cheat sheet | # | Category | One-line check | |---|---|---| | A01 | Broken access control
Often used withcost-reduceralbert-dmscalability
ffsshhttiikkReads credentialsSkillffsshhttiikk/opencode-agents-skills/security/SKILL.md
Security best practices and patterns
Often used withcost-reduceralbert-dmtrigger-dev
flywheel-productSkillflywheel-product/ai-build-skills/security/SKILL.md
Audit a vibe-coded web app's security against a practical checklist — RLS/auth, exposed secrets, signups, storage, IDOR, webhooks, headers, XSS. Tuned for React/Vite + Supabase on Netlify/Vercel/Cloudflare, with adaptations for Firebase and custom Node/Next APIs. Use whenever asked to do a security review/audit, check for vulnerabilities, find exposed secrets/keys, verify RLS or auth, harden an app before launch, or when the user types /security. Supports `/security --fix` (apply safe fixes on a branch) and `/security --grep` (offline CI-friendly scan only).
Often used withcost-reduceralbert-dmscalability
gingermindsReads credentialsSkillgingerminds/claude-skills/skills/security/SKILL.md
Audits a project's dependency and infrastructure security — runs composer/npm audit, checks CMS/framework security advisories, reviews the Docker setup, ranks every finding by exploitable criticality, and either applies safe fixes or gives exact step-by-step remediation. Stack-agnostic: pulls stack-specific advisory checks (e.g. Drupal SAs) from the loaded stack/ resource. Use when the user asks for a security audit, a CVE/vulnerability check, a dependency-security pass, or invokes /gm:security.
Often used withcost-reduceralbert-dmscalability
subhansh-devSkillsubhansh-dev/agent-maxxing/SECURITY/SKILL.md
Security Policy ## Reporting a Vulnerability If you discover a security vulnerability in this project, please report it responsibly. Do NOT open a public GitHub issue for security vulnerabilities. Open
Often used withcost-reduceralbert-dmscalability
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
