Find the best CLAUDE.md, AGENTS.md and Claude skills

usestrixReads credentialsSkill

api-security-testing

usestrix/strix/skills/api-security-testing/SKILL.md

Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.

OpenAISkill

security-best-practices

openai/skills/skills/.curated/security-best-practices/SKILL.md

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Often used withsupabase-postgres-best-practices·systematic-debugging·vercel-react-best-practices

AWSSkill

cdk-security-review

aws/aws-cdk/skills/cdk-review/cdk-security-review/SKILL.md

AWS CDK security reviewer. Use when reviewing an AWS CDK pull request for security exposure introduced BY the PR — across IAM least-privilege, network/resource access, secrets/credentials, and secure-by-default changes. Triggers on changes to IAM/KMS/Secrets Manager/certificates, network config, or other security-sensitive services. Leading concepts: least-privilege and secure-by-default.

secdevSkill

Scapy security audit

secdev/scapy/.github/skills/scapy-security-audit/SKILL.md

Use this when conducting a long-running autonomous security audit of Scapy, validating a suspected vulnerability, or preparing a source-backed security report.

No other project uses it yet

zhaoxuya520Skill

supply-chain-security

zhaoxuya520/reverse-skill/skills/supply-chain-security/SKILL.md

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

Often used withbinary-diff·pentest-tools·js-reverse

MicrosoftSkill

security-report-check

microsoft/TypeScript/.github/skills/security-report-check/SKILL.md

Are you doing security research on this repo? This document covers what guarantees and non-guarantees are provided. Consult this document before reporting a security issue or conducting security research.

PrefectHQSkill

review-security-report

PrefectHQ/fastmcp/.agents/skills/review-security-report/SKILL.md

Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them. Use for security advisories, bug-bounty submissions, OAuth or MCP vulnerability claims, and proposed security fixes.

usestrixSkill

application-security-testing

usestrix/strix/skills/application-security-testing/SKILL.md

Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.

ruvnetSkill

agent-security-manager

ruvnet/claude-flow/.agents/skills/agent-security-manager/SKILL.md

Agent skill for security-manager - invoke with $agent-security-manager

qazbnm456Skill

awesome-web-security

qazbnm456/awesome-web-security/skills/awesome-web-security/SKILL.md

Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.

No other project uses it yet

GitHubSkill

security-alert-triage

github/github-mcp-server/pkg/skills/catalog/skills/security-alert-triage/SKILL.md

USE FOR: investigating GitHub security alerts — code scanning, Dependabot, secret scanning and advisories — and deciding what to fix now, schedule, dismiss, or escalate. NOT FOR: summarising overall repository health, or reviewing feedback on a pull request.

addyosmaniReads credentialsSkill

security-and-hardening

addyosmani/agent-skills/skills/security-and-hardening/SKILL.md

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions or session cookies, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Often used withconstraint-driven-development·observability-and-instrumentation·doubt-driven-development

OpenAISkill

security-threat-model

openai/skills/skills/.curated/security-threat-model/SKILL.md

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

JeffallanReads credentialsSkill

secure-code-guardian

Jeffallan/claude-skills/skills/secure-code-guardian/SKILL.md

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.

NVIDIASkill

review-security-issue

NVIDIA/OpenShell/.agents/skills/review-security-issue/SKILL.md

Review an authorized security issue or private GitHub advisory for validity, severity, and a remediation plan.

No other project uses it yet

penpotReads credentialsSkill

security-and-hardening

penpot/penpot/.agents/skills/security-and-hardening/SKILL.md

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Often used withconstraint-driven-development·observability-and-instrumentation·doubt-driven-development

ruvnetSkill

agent-v3-security-architect

ruvnet/claude-flow/.agents/skills/agent-v3-security-architect/SKILL.md

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

kedro-orgDeletes or force-pushesSkill

kedro-security-review

kedro-org/kedro/.agents/skills/kedro-security-review/SKILL.md

Run a Kedro security scan on the full codebase or just a pull request. This skill always runs Semgrep first and then evaluates the findings against the Kedro security model. Use when the user says things like "run security scan on the full codebase" or "run security scan on this PR". Produce one final report only, in chat by default or posted to GitHub when explicitly asked.

SnailSploitSkill

offensive-ai-security

SnailSploit/Claude-Red/Skills/ai/offensive-ai-security/SKILL.md

SKILL: AI Pentest ## Metadata - **Skill Name**: ai-security - **Folder**: offensive-ai-security - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ai.md ## Description AI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial

symfonySkill

symfony-security-review

symfony/symfony/.agents/skills/symfony-security-review/SKILL.md

Review a change (a PR, the current branch diff, or a set of files) or audit a component or the whole tree for missing or incorrect security hardening. Reasons about trust boundaries from first principles, then checks the code against Symfony's hardening-invariant families and runs the .github/sa-tools gates. Use when the user says "security review", "security audit", "check hardening", "review this PR/branch for security", "audit <component> for <vuln class>", "is any hardening missing", or names a vulnerability class to hunt for.