Find the best CLAUDE.md, AGENTS.md and Claude skills

first-flukeSkill

oma-security

first-fluke/oh-my-agent/skills/oma-security/SKILL.md

Scan application source, agent skills, and MCP components; run

ruvnetSkill

security-audit

ruvnet/claude-flow/.agents/skills/security-audit/SKILL.md

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.

Often used withcreate-stories·community-led-growth·story-done

jiten-singh-shahiSkill

sf-security

jiten-singh-shahi/salesforce-claude-code/.cursor/skills/sf-security/SKILL.md

Use when implementing Salesforce Apex security — CRUD/FLS enforcement, sharing keywords, SOQL injection prevention, AppExchange review prep. Do NOT use for general Apex or LWC patterns.

bodadotshSkill

npm-security

bodadotsh/npm-security-best-practices/skills/npm-security/SKILL.md

Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating dependencies or configuring package managers

openclawSkill

security-triage

openclaw/openclaw/.agents/skills/security-triage/SKILL.md

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

codewithmukeshSkill

security-scan

codewithmukesh/dotnet-claude-kit/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

hardw00tSkill

sca-security

hardw00t/ai-security-arsenal/skills/sca-security/SKILL.md

Software Composition Analysis: find vulnerable dependencies, correlate CVE/GHSA/OSV across ecosystems, generate CycloneDX/SPDX SBOMs, assess license compliance, and run reachability-aware triage to suppress unexploitable findings. Use when scanning package dependencies (npm, PyPI, Maven, Cargo, Go, RubyGems, Composer), reviewing PR lockfile diffs, generating SBOMs, auditing licenses, hunting malicious packages, or auditing the software supply chain. Triggers on requests to scan dependencies, check vulnerable packages, generate SBOM, license compliance, typosquat/dependency-confusion review, or reachability-based vuln triage.

awarexonePipes a download into a shellSkill

cicd-security

awarexone/Agentic-Bug-Hunter/skills/cicd-security/SKILL.md

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

kingxiaozheSkill

cm-security

kingxiaozhe/cm-workflow/skills/cm-security/SKILL.md

用户运行 cm-security，或要求代码安全扫描、漏洞检查、密钥泄露排查、依赖漏洞检查时使用。默认检查当前分支相对主分支及已跟踪未提交修改，结合业务地图复核；--all 检查全部已跟踪文件。只报告问题，不自动修复、安装、升级或发布。安装自检用 cm-check，功能测试与覆盖率用 cm-test。

zhaoxuya520Skill

email-security

zhaoxuya520/reverse-skill/skills/email-security/SKILL.md

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

GitHubReads credentialsSkill

spring-security

github/awesome-copilot/skills/spring-security/SKILL.md

Configure, test and review Spring Security 6/7 in Spring Boot 3/4 apps: SecurityFilterChain lambda DSL, method security, OAuth2 resource server with JWT, OIDC login, CSRF/CORS, password encoding, headers, actuator protection, and MockMvc security tests. Use when adding or auditing authentication and authorization.

PostHogReads credentialsSkill

security-audit

PostHog/posthog/.agents/skills/security-audit/SKILL.md

Threat-model-driven security audit of a change. Build a threat model from the diff, PR, commits, and product purpose, then assess the implementation against each threat. Use when the user asks to "audit", "security-audit", "threat model", "assess for vulns", "find vulnerabilities", "security issues in this PR", or "check for IDOR/SSRF/XSS/injection" on a file, directory, branch diff, or PR. Covers access control, injection, auth/secrets, sensitive data, business logic, web boundary, and AI agent/LLM trifecta risks. Produces severity- and confidence-ranked findings with data flow, exploit request, and fix — no theoretical or defense-in-depth nits. Handles the GitHub review follow-up for a PR target and a reproducer test plus fix for a local branch.

Often used withcreate-stories·community-led-growth·story-done

DonchitosSkill

security-audit

Donchitos/Claude-Code-Game-Studios/.claude/skills/security-audit/SKILL.md

Security audit — save tampering, cheat vectors, network exploits, data exposure, input validation. Before public or multiplayer release.

Often used withcreate-stories·community-led-growth·story-done

affaan-mReads credentialsSkill

security-review

affaan-m/ECC/.agents/skills/security-review/SKILL.md

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

arcasilesgroupSkill

ai-security

arcasilesgroup/ai-engineering/skills/ai-security/SKILL.md

Audits code for exploitable vulnerabilities with independent validation and schema-checked findings. Trigger: milestone security audits, "security review", "find security bugs", or "pen-test". Reports real impact, not theory. Not for runtime diagnosis (/ai-debug) or diff correctness (/ai-verify).

bagofwords1Skill

security-scan

bagofwords1/bagofwords/.agents/skills/security-scan/SKILL.md

Run a Snyk security scan of the repo (frontend npm deps, backend pip deps, Dockerfile/base image, and Snyk Code SAST), triage findings, and remediate the real ones with verified fixes. Use for "scan with Snyk", "resolve the security issues", dependency-CVE cleanup, or a pre-release security pass.

Often used withdjango-security·deployment-patterns·postgres-patterns

mrhlaingbwardevReads credentialsSkill

web-security

mrhlaingbwardev/agentic-hacking-skills/skills/web-security-advanced/SKILL.md

SECURE BY DEFAULT. When building login, API routes, file uploads, database queries, payments, user content, admin panels, webhooks, forms, password reset, OAuth, or any web feature — auto-detect what the user is building and inject the correct security patterns BEFORE it ships. Prevents env leaks, XSS, SQLi, IDOR, CSRF, SSRF, path traversal, mass assignment. Frameworks: Next.js, React, Express, Remix, SvelteKit.

CloudflareSkill

security-audit

cloudflare/security-audit-skill/skills/security-audit/SKILL.md

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Often used withcreate-stories·community-led-growth·story-done

rommappPipes a download into a shellSkill

security-audit

rommapp/romm/.claude/skills/security-audit/SKILL.md

Audit a diff (a release tag range or a PR branch) for anything malicious or a serious security regression before shipping/merging. Use when asked to "check this release", "make sure nothing malicious slipped in", "security review this PR", or vet upstream/contributor changes. Covers supply chain, egress/exfiltration, auth/injection/traversal, CI/infra, and commit provenance, with a fast direct pass plus fanned-out deep review. Trigger on any "is this change safe?" request over a diff.

Often used withcreate-stories·community-led-growth·story-done

MindrallySkill

jwt-security

Mindrally/skills/jwt-security/SKILL.md

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage