One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
BuilderIOSkillBuilderIO/agent-native/.agents/skills/security/SKILL.md
Secure app data, actions, routes, and external input. Use when changing authentication, authorization, database access, uploads, untrusted content, or server-side requests to user-provided URLs.
Steady47 mentions in 2 weeks
117 projects use a version of this
Often used withcost-reduceralbert-dmscalability
parcadeiSkillparcadei/Continuous-Claude/.claude/skills/security/SKILL.md
Security audit workflow - vulnerability scan → verification
Often used withcost-reduceralbert-dmscalability
gridacoSkillgridaco/grida/.agents/skills/security/SKILL.md
How to handle `GRIDA-SEC-<id>` security boundaries in the Grida repo. Triggers when you encounter a `GRIDA-SEC` tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each `GRIDA-SEC-<id>` identifies a structural trust boundary documented in `/SECURITY.md`. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.
Often used withcost-reduceralbert-dmscalability
BankrBotSkillBankrBot/skills/ethskills-security/SKILL.md
Solidity vulnerabilities, defensive code patterns, and a pre-deployment audit checklist. Covers reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV.
Steady5 mentions in 2 weeks
117 projects use a version of this
Often used withcost-reduceralbert-dmscalability
boshu2Skillboshu2/agentops/skills/security/SKILL.md
Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked whether code is safe to ship, even one small handler.
Often used withcost-reduceralbert-dmscalability
austintgriffithSkillaustintgriffith/ethskills/security/SKILL.md
Solidity security patterns, common vulnerabilities, and pre-deploy audit checklist. The specific code patterns that prevent real losses — not just warnings, but defensive implementations. Use before deploying any contract, when reviewing code, or when building anything that holds or moves value.
Often used withcost-reduceralbert-dmscalability
serithemageSkillserithemage/serverless-openclaw/.agents/skills/security/SKILL.md
References Serverless OpenClaw security model. Covers Bridge 6-layer defense, IDOR prevention, secret management, Cognito authentication, and IAM least privilege. Use as a security checklist when writing or reviewing code.
Often used withcost-reduceralbert-dmscalability
OpenHandsSkillOpenHands/extensions/skills/security/SKILL.md
Security best practices for secure coding, authentication, authorization, and data protection. Use when developing features that handle sensitive data, user authentication, or require security review.
Often used withcost-reduceralbert-dmscalability
TheBeardedBearSASSkillTheBeardedBearSAS/claude-craft/.claude/skills/security/SKILL.md
Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities.
Often used withcost-reduceralbert-dmscalability
ilang-aiSkillilang-ai/autocode/skills/security/SKILL.md
Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.
Often used withcost-reduceralbert-dmscalability
AIBiz-AutomatyzacjeSkillAIBiz-Automatyzacje/claude-code-starter/.claude/skills/security/SKILL.md
Reguły bezpieczeństwa dla kodu React 19 + Supabase + Edge Functions (RLS, autoryzacja, walidacja wejścia, sekrety, XSS, SSRF) i protokół audytu bezpieczeństwa w resources. Używaj przy pisaniu kodu z auth/authz, RLS policies, walidacją inputów, Edge Functions i danymi osobowymi, a także przy review bezpieczeństwa, audycie przed deployem i OWASP Top 10.
Often used withcost-reduceralbert-dmscalability
davidmatousekSkilldavidmatousek/tachi/.claude/skills/security/SKILL.md
Claude-powered SAST and SCA security scan skill. Invoked automatically as the Security Scan step (Step 7) of /aod.build (after Design Quality Gate, before Code Simplification) or standalone via /security. Analyzes all code files and dependency manifests changed on the feature branch relative to main for OWASP Top 10 vulnerability patterns and known CVE findings. Produces a human-readable security-scan.md report and machine-readable .security/ compliance artifacts (scan-log.jsonl, vulnerabilities.jsonl, SARIF 2.1.0, CycloneDX 1.5 SBOM). Blocks build progression on CRITICAL/HIGH findings with an explicit acknowledgment gate. Use --no-security in /aod.build to skip. Invoke /security directly for standalone analysis outside the build pipeline.
Often used withcost-reduceralbert-dmscalability
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/.agents/skills/security-assistant/SKILL.md
引導安全審查與弱點評估，遵循 OWASP 標準。 Use when: 安全稽核、弱點檢查、安全程式碼審查、威脅建模。 Not for: 自動化的相依套件、CVE 與機密掃描——請用 /scan；處理正在發生的資安事件——請用 /incident。 Keywords: security, OWASP, vulnerability, authentication, authorization, 資訊安全, 弱點, 認證, 授權, 威脅建模.
Often used withcost-reduceralbert-dmscalability
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/skills/security-assistant/SKILL.md
Guide security review and vulnerability assessment following OWASP standards. Use when: security audit, vulnerability check, secure coding review, threat modeling. Not for: automated dependency, CVE, and secret scanning — use /scan; handling a breach in progress — use /incident. Keywords: security, OWASP, vulnerability, authentication, authorization.
Often used withcost-reduceralbert-dmscalability
korchard333Skillkorchard333/claude-power-platform-community/.claude/skills/security/SKILL.md
Dataverse Security Model. Use when: designing security roles, column-level security, business units, teams (owner/access/AAD group), record sharing, hierarchy security, minimum viable privileges, security role management via Web API.
Often used withcost-reduceralbert-dmscalability
rust-off-railsSkillrust-off-rails/rustoffrails/skills/security/SKILL.md
Deep security review of a Rust off Rails app or change: threat model, the full security checklist, scanners (cargo-deny, secret scan, ZAP baseline), header/CSP verification and WebSocket checks. Use before shipping, after auth/payments/uploads/realtime/API changes, or when the user asks about security, hardening or a pentest-style review.
Often used withcost-reduceralbert-dmscalability
galandoSkillgalando/piv-speckit/.claude/skills/security/SKILL.md
Enforces security best practices
Often used withcost-reduceralbert-dmscalability
nirholasSkillnirholas/AuditKit/.agents/skills/security/SKILL.md
Security Skill — AuditKit This skill is auto-included in the generated ZIP when the Security pillar score is below 90. ## HTTP Security Headers Add all of these to every response
Often used withcost-reduceralbert-dmscalability
LazyIsEfficientSkillLazyIsEfficient/agentic-os/.claude/skills/security/SKILL.md
Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.
Often used withcost-reduceralbert-dmscalability
manu14357Skillmanu14357/Zelaxy/.agents/skills/security/SKILL.md
Maintain and improve security across the Zelaxy platform. Use for: secret encryption boundaries, auth modes (session/API key/internal JWT/cron), CSP and middleware hardening, webhook verification, tenant isolation, and security test coverage.
Often used withcost-reduceralbert-dmscalability
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
