Find the best CLAUDE.md, AGENTS.md and Claude skills

Google CloudSkill

security-scan

GoogleCloudPlatform/cloud-solutions/projects/build-with-gemini-demo/build-with-antigravity/.agents/skills/security-scan/SKILL.md

Performs a security audit of the project source code and dependencies to identify vulnerabilities and recommend remediations. Use when scanning the codebase for security issues. Don't use for functional unit testing or style-only code formatting.

Often used withdjango-security·deployment-patterns·postgres-patterns

luongnv89Reads credentialsSkill

security-setup

luongnv89/skills/skills/security-setup/SKILL.md

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI. Use when hardening repos or adding security hooks. Don't use for incident response or cloud security reviews.

GitHubReads credentialsSkill

security-review

github/awesome-copilot/skills/security-review/SKILL.md

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

Hassaan146Skill

ai-security

Hassaan146/claude-skills/ai-security/SKILL.md

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

monoSkill

security-audit

mono/SkiaSharp/.agents/skills/security-audit/SKILL.md

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline. Read-only investigation that produces a status report with recommendations.

Often used withcreate-stories·community-led-growth·story-done

RTFM-IT-Services-LLCSkill

msp-security

RTFM-IT-Services-LLC/msp-claude-skills/skills/msp-security/SKILL.md

Use this skill for security standards at your managed IT services (MSP) business, in both directions: the baseline every managed client must meet (MFA, endpoint protection, email security, backups, admin access, offboarding) and how the MSP secures itself (RMM hardening, the credential vault, admin separation, partner-delegated admin access into client tenants, our own devices). Trigger on "security baseline", "security standard", "harden this tenant", "is this client secure enough", "security assessment", "cyber insurance questionnaire", "can we say we're compliant", HIPAA, FTC Safeguards, WISP, CMMC, PCI, CIS Controls, "lock down our RMM", or any question about what controls a client or our MSP should have. msp-helpdesk owns incident response; msp-maintenance owns patch and backup cadence; this skill owns the standard they deliver against. Apply alongside msp-onboarding, msp-qbr, msp-legal, msp-pricing, msp-client-comms, and msp-sales.

langfuseSkill

security-review

langfuse/langfuse/.agents/skills/security-review/SKILL.md

Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy. Use when a design or change accepts URLs or host fields, handles secrets or cross-tenant data, makes outbound requests, adds an integration, follows redirects, widens permissions, or can send customer-controlled UI data through analytics, monitoring, or session replay.

Often used withdependency-cve-sweep·agent-sort·brand-discovery

symfonySkill

security-triage

symfony/symfony/.agents/skills/security-triage/SKILL.md

Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter). Assigns severity and affected maintained branches, and routes to the next step. Use when the user says "does this need a CVE", "CVE or hardening", "triage this report", "is this a security issue", "classify this finding", or "how should we disclose this".

hardw00tSkill

api-security

hardw00t/ai-security-arsenal/skills/api-security/SKILL.md

Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.

Often used withattack-chain·pentest-tools·binary-diff

hardw00tSkill

iac-security

hardw00t/ai-security-arsenal/skills/iac-security/SKILL.md

Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep. Orchestrates Checkov, tfsec, Terrascan, KICS, kubesec, kube-linter, Polaris, cfn-lint/cfn-nag, and OPA/Conftest. Use when auditing IaC for misconfigurations, scanning Terraform plans, validating K8s security policies, checking cloud infrastructure compliance, or authoring custom policy-as-code (Rego).

hardw00tSkill

llm-security

hardw00t/ai-security-arsenal/skills/llm-security/SKILL.md

LLM and AI application security testing skill for prompt injection (direct, indirect, multimodal), system-prompt extraction, RAG poisoning, memory poisoning, MCP server injection, skill-file injection, agentic tool misuse, computer-use UI injection, and excessive agency. Authorization required — this skill tests AI systems you are explicitly permitted to assess. Triggers on requests to test LLM / AI-agent / RAG / MCP / computer-use security, perform prompt injection, extract system prompts, poison RAG or memory, audit agent tool use, or evaluate AI guardrails.

Often used withattack-chain·pentest-tools·binary-diff

L-X-TSkill

ng-security

L-X-T/ng-agentic-skills/.agents/skills/ng-security/SKILL.md

Harden Angular applications against common web vulnerabilities. Use when reviewing or improving app security, preventing XSS, configuring Content Security Policy (CSP) or Trusted Types, working with sanitization / DomSanitizer / bypassSecurityTrust, securing HttpClient (XSRF/CSRF, XSSI), auth and token storage, SSR/SSRF (allowedHosts), or keeping dependencies patched.

aws-samplesSkill

ecs-security

aws-samples/sample-apex-skills/skills/ecs-security/SKILL.md

Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.

aws-samplesSkill

eks-security

aws-samples/sample-apex-skills/skills/eks-security/SKILL.md

Use whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS cluster", "Bottlerocket vs AL2023 vs RHEL/Ubuntu AMI", "EKS Pod Identity vs IRSA", "Access Entries vs aws-auth", "GuardDuty for EKS", "Pod Security Admission / Kyverno / OPA", "NetworkPolicy / Security Groups for Pods", "ECR scanning / image signing (Cosign / Notation)", "EKS audit logging", "etcd / secrets encryption", or regulated-workload / audit-prep guidance. Walks the discovery-driven 7-layer security stack (OS/AMI → identity → workload → image → runtime → audit → compliance accelerators), the compliance-regime scope view, the AWS-canonical baseline, and a 30/60/90 hardening roadmap. Trigger even if "compliance" is never said — any EKS hardening, audit-prep, or regulated-workload decision qualifies. Skip for non-EKS (ECS/ROSA), account-level security with no EKS angle, or GenAI-workload security (use eks-genai).

blockmaticSkill

w-security

blockmatic/basilic-skills/skills/workflow/w-security/SKILL.md

Review the change or tree against repository security docs and existing checks.

wekanSkill

meteor-security

wekan/wekan/.agents/skills/meteor-security/SKILL.md

Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow/deny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).

briiirussellReads credentialsSkill

cicd-security

briiirussell/cybersecurity-skills/skills/cicd-security/SKILL.md

Audit CI/CD pipelines, GitHub Actions first and GitLab CI and CircleCI briefly, for the paths that give an outsider code execution, secrets or a write token: pull_request_target and workflow_run running untrusted code, expression injection into run steps, missing or broad workflow permissions, third-party actions not pinned to a commit SHA, OIDC trust policies with wildcard subjects, self-hosted runners on public repos, secrets reaching forks, cache and artifact trust between workflows, and AI agents in CI that read issue or PR text while holding a write token. Runs zizmor and actionlint read-only and writes findings.json. Use when the user mentions 'pull_request_target,' 'pwn request,' 'workflow injection,' 'zizmor,' 'actionlint,' 'pin actions to SHA,' 'GITHUB_TOKEN permissions,' 'self-hosted runner,' 'claude-code-action,' 'AI agent in CI,' 'GitLab CI security,' 'CircleCI security,' 'is this workflow safe,' or needs to secure a build pipeline.

briiirussellReads credentialsSkill

security-start

briiirussell/cybersecurity-skills/skills/security-start/SKILL.md

Start here when a security ask is vague and no specific skill fits yet. Asks two or three questions about what you have (source code, a live site, a cloud setup, logs, a suspicious file, an auditor's request) and what's going on (building, shipping, an active incident, a compliance deadline), then hands off to the right skill or skills from this catalog, in order. It does no auditing itself. Use when the user says things like 'make this secure,' 'is this secure,' 'where do I start with security,' 'which security skill should I use,' 'security checkup,' 'what do we check,' 'secure my startup,' or 'help me with security' without naming a framework, a target or a tool. If the ask already names one (OWASP, a CVE, a workflow file, SOC 2, a phishing email, a pasted finding), use that skill directly instead.

MaxMiksaSkill

security-audit

MaxMiksa/Auto-Company/.claude/skills/security-audit/SKILL.md

Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.

Often used withcreate-stories·community-led-growth·story-done

marketcallsReads credentialsSkill

security-audit

marketcalls/openalgo/.claude/skills/security-audit/SKILL.md

Run OpenAlgo's periodic security audit across backend, frontend, database, cache, routes and dependencies, producing a dated xlsx report. Use for the monthly or twice-monthly review, before a release, after a dependency bump, or when the user asks for a security check, vulnerability scan, or audit report.

Often used withcreate-stories·community-led-growth·story-done