Find the best CLAUDE.md, AGENTS.md and Claude skills

kubesharkReads credentialsSkill

security-audit

kubeshark/kubeshark/skills/security-audit/SKILL.md

Kubernetes network security audit skill powered by Kubeshark MCP. Use this skill whenever the user wants to audit a cluster for security threats, detect compromised workloads, find malicious traffic patterns, hunt for indicators of compromise (IOCs), check for data exfiltration, identify C2 (command and control) communication, detect cryptomining, find lateral movement, discover credential theft attempts, assess network security posture, or perform threat hunting in Kubernetes. Also trigger when the user mentions security audit, threat detection, compromise assessment, vulnerability scan, "is my cluster compromised", "find malicious traffic", "check for threats", DNS exfiltration, DNS tunneling, port scanning, IMDS access, reverse shell, crypto miner, MITRE ATT&CK, IOC detection, anomaly detection, suspicious traffic, rogue workloads, unauthorized access, or any request to evaluate cluster security through network traffic analysis.

Often used withcreate-stories·community-led-growth·story-done

ResgridSkill

security-scan

Resgrid/Core/.agents/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

ResgridSkill

security-scan

Resgrid/Core/.claude/skills/security-scan/SKILL.md

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Often used withdjango-security·deployment-patterns·postgres-patterns

heliomarpmSkill

sk-security

heliomarpm/skills/skills/sk-security/SKILL.md

Audita e projeta a segurança de aplicações: autenticação e sessão (OAuth com PKCE, OIDC, JWT), autorização por recurso (RBAC/ABAC, BOLA/IDOR), entrada e injeções, criptografia e segredos, dependências, cabeçalhos web, logs e privacidade, com checklist baseado no OWASP, achados com severidade e plano de remediação. Use sempre que o usuário pedir 'audite a segurança', 'isto é seguro?', 'revise a autenticação', 'proteja este endpoint', 'vazou um segredo', 'vulnerabilidades', 'OWASP', 'hash de senha', 'CSP' ou 'permissões', mesmo sem a palavra 'segurança'. NÃO use para desenhar contratos de API (isso é sk-api-design), infraestrutura e pipelines (isso é sk-devops) nem para revisar um diff em geral (isso é sk-code-review).

vinayaklattheSkill

iac-security

vinayaklatthe/microsoft-security-skills/skills/iac-security/SKILL.md

Guidance for securing Infrastructure-as-Code (Bicep, ARM, Terraform, and ACI/Container) pipelines on Azure — shift-left scanning, policy-as-code, secret hygiene, identity for pipelines, drift detection, and supply chain. Covers Microsoft Defender for Cloud DevOps Security (GitHub / Azure DevOps connectors), Microsoft Security DevOps (MSDO) extension, Bicep linter and template specs, Terraform best practices on Azure (state management, backend hardening, provider versions), Azure Policy as deploy-time and CI-time gate, GitOps with Flux/ArgoCD on AKS, secret scanning and dependency review, signed commits / artifact signing, OIDC federation for pipeline identity (no client secrets), and integration with Defender for Cloud posture. WHEN: IaC security, Bicep security, Terraform Azure security, Defender for Cloud DevOps Security, MSDO, Microsoft Security DevOps, shift-left Azure, policy as code, OIDC GitHub Actions Azure, secrets in IaC, drift detection, signed Bicep, supply chain Azure. DO NOT USE for Kubernetes admission control alone (use defender-for-containers), generic CI/CD design, or app-layer security.

Strategic-AutomationSkill

llm-security

Strategic-Automation/violin/skills/llm-security/SKILL.md

Test LLM prompt injection and MCP tool/agent surfaces.

Often used withattack-chain·pentest-tools·binary-diff

luongnv89Reads credentialsSkill

security-setup

luongnv89/skills/skills/security-setup/SKILL.md

Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI. Use when hardening repos or adding security hooks. Don't use for incident response or cloud security reviews.

raroqueReads credentialsSkill

vibe-security

raroque/vibe-security-skill/vibe-security/SKILL.md

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

AnthropicSkill

claude-security

anthropics/claude-plugins-official/plugins/claude-security/skills/claude-security/SKILL.md

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.

Google CloudSkill

security-scan

GoogleCloudPlatform/cloud-solutions/projects/build-with-gemini-demo/build-with-antigravity/.agents/skills/security-scan/SKILL.md

Performs a security audit of the project source code and dependencies to identify vulnerabilities and recommend remediations. Use when scanning the codebase for security issues. Don't use for functional unit testing or style-only code formatting.

Often used withdjango-security·deployment-patterns·postgres-patterns

GitHubReads credentialsSkill

security-review

github/awesome-copilot/skills/security-review/SKILL.md

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

Hassaan146Skill

ai-security

Hassaan146/claude-skills/ai-security/SKILL.md

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

monoSkill

security-audit

mono/SkiaSharp/.agents/skills/security-audit/SKILL.md

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline. Read-only investigation that produces a status report with recommendations.

Often used withcreate-stories·community-led-growth·story-done

RTFM-IT-Services-LLCSkill

msp-security

RTFM-IT-Services-LLC/msp-claude-skills/skills/msp-security/SKILL.md

Use this skill for security standards at your managed IT services (MSP) business, in both directions: the baseline every managed client must meet (MFA, endpoint protection, email security, backups, admin access, offboarding) and how the MSP secures itself (RMM hardening, the credential vault, admin separation, partner-delegated admin access into client tenants, our own devices). Trigger on "security baseline", "security standard", "harden this tenant", "is this client secure enough", "security assessment", "cyber insurance questionnaire", "can we say we're compliant", HIPAA, FTC Safeguards, WISP, CMMC, PCI, CIS Controls, "lock down our RMM", or any question about what controls a client or our MSP should have. msp-helpdesk owns incident response; msp-maintenance owns patch and backup cadence; this skill owns the standard they deliver against. Apply alongside msp-onboarding, msp-qbr, msp-legal, msp-pricing, msp-client-comms, and msp-sales.

langfuseSkill

security-review

langfuse/langfuse/.agents/skills/security-review/SKILL.md

Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy. Use when a design or change accepts URLs or host fields, handles secrets or cross-tenant data, makes outbound requests, adds an integration, follows redirects, widens permissions, or can send customer-controlled UI data through analytics, monitoring, or session replay.

Often used withlinkerd-patterns·dependency-cve-sweep·project-guidelines-example

symfonySkill

security-triage

symfony/symfony/.agents/skills/security-triage/SKILL.md

Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter). Assigns severity and affected maintained branches, and routes to the next step. Use when the user says "does this need a CVE", "CVE or hardening", "triage this report", "is this a security issue", "classify this finding", or "how should we disclose this".

hardw00tSkill

api-security

hardw00t/ai-security-arsenal/skills/api-security/SKILL.md

Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.

Often used withbinary-diff·pentest-tools·js-reverse

hardw00tSkill

iac-security

hardw00t/ai-security-arsenal/skills/iac-security/SKILL.md

Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep. Orchestrates Checkov, tfsec, Terrascan, KICS, kubesec, kube-linter, Polaris, cfn-lint/cfn-nag, and OPA/Conftest. Use when auditing IaC for misconfigurations, scanning Terraform plans, validating K8s security policies, checking cloud infrastructure compliance, or authoring custom policy-as-code (Rego).

hardw00tSkill

llm-security

hardw00t/ai-security-arsenal/skills/llm-security/SKILL.md

LLM and AI application security testing skill for prompt injection (direct, indirect, multimodal), system-prompt extraction, RAG poisoning, memory poisoning, MCP server injection, skill-file injection, agentic tool misuse, computer-use UI injection, and excessive agency. Authorization required — this skill tests AI systems you are explicitly permitted to assess. Triggers on requests to test LLM / AI-agent / RAG / MCP / computer-use security, perform prompt injection, extract system prompts, poison RAG or memory, audit agent tool use, or evaluate AI guardrails.

Often used withattack-chain·pentest-tools·binary-diff

aws-samplesSkill

ecs-security

aws-samples/sample-apex-skills/skills/ecs-security/SKILL.md

Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.