One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
BankrBotSkillBankrBot/skills/ethskills-security/SKILL.md
Solidity vulnerabilities, defensive code patterns, and a pre-deployment audit checklist. Covers reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV.
alinaqiSkillalinaqi/maggy/skills/security/SKILL.md
OWASP security patterns, secrets management, security testing
boshu2Skillboshu2/agentops/skills/security/SKILL.md
Review code or scan for security vulnerabilities, secrets, dependencies and prompt risks. Use when: concrete exposure needs assessment; never silently change policy.
notqueSkillnotque/vexjoy-agent/skills/review/security/SKILL.md
Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.
garagonSkillgaragon/nanostack/security/SKILL.md
Use before shipping to production. Performs OWASP Top 10 audit and STRIDE threat modeling against the codebase. Supports --quick, --standard, --thorough modes. Also use when the user asks to check security, audit code, or review for vulnerabilities. Triggers on /security.
TheBeardedBearSASSkillTheBeardedBearSAS/claude-craft/.claude/skills/security/SKILL.md
Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities.
ilang-aiSkillilang-ai/autocode/skills/security/SKILL.md
Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.
travisjneumanSkilltravisjneuman/.claude/skills/security/SKILL.md
Information security expertise for cybersecurity frameworks (NIST, ISO 27001), security architecture, incident response, vulnerability management, identity management, and cloud security. Use when designing security programs, responding to incidents, or assessing vulnerabilities.
davidmatousekSkilldavidmatousek/tachi/.claude/skills/security/SKILL.md
Claude-powered SAST and SCA security scan skill. Invoked automatically as the Security Scan step (Step 7) of /aod.build (after Design Quality Gate, before Code Simplification) or standalone via /security. Analyzes all code files and dependency manifests changed on the feature branch relative to main for OWASP Top 10 vulnerability patterns and known CVE findings. Produces a human-readable security-scan.md report and machine-readable .security/ compliance artifacts (scan-log.jsonl, vulnerabilities.jsonl, SARIF 2.1.0, CycloneDX 1.5 SBOM). Blocks build progression on CRITICAL/HIGH findings with an explicit acknowledgment gate. Use --no-security in /aod.build to skip. Invoke /security directly for standalone analysis outside the build pipeline.
AIBiz-AutomatyzacjeSkillAIBiz-Automatyzacje/claude-code-starter/.claude/skills/security/SKILL.md
Systematyczny audyt bezpieczeństwa dla React 19 + Supabase + Edge Functions. Używaj przy review bezpieczeństwa, przed deployem, przy pracy z auth/authz, walidacją inputów, RLS policies, XSS, OWASP Top 10.
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/.claude/skills/security-assistant/SKILL.md
引導安全審查與弱點評估，遵循 OWASP 標準。 Use when: 安全稽核、弱點檢查、安全程式碼審查、威脅建模。 Not for: 自動化的相依套件、CVE 與機密掃描——請用 /scan；處理正在發生的資安事件——請用 /incident。 Keywords: security, OWASP, vulnerability, authentication, authorization, 資訊安全, 弱點, 認證, 授權, 威脅建模.
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/skills/security-assistant/SKILL.md
Guide security review and vulnerability assessment following OWASP standards. Use when: security audit, vulnerability check, secure coding review, threat modeling. Not for: automated dependency, CVE, and secret scanning — use /scan; handling a breach in progress — use /incident. Keywords: security, OWASP, vulnerability, authentication, authorization.
korchard333Skillkorchard333/claude-power-platform-community/.claude/skills/security/SKILL.md
Dataverse Security Model. Use when: designing security roles, column-level security, business units, teams (owner/access/AAD group), record sharing, hierarchy security, minimum viable privileges, security role management via Web API.
DGouronSkillDGouron/review-flow/.claude/skills/security/SKILL.md
Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data.
flavien-iaSkillflavien-ia/hypervibe-harness/skills/security/SKILL.md
Audit the security of a Next.js/T3 project. Checks for exposed secrets, unprotected routes, input validation, dependency vulnerabilities, headers, CORS, and common web security issues. Use when the user wants to verify their app is safe before going live.
galandoSkillgalando/piv-speckit/.claude/skills/security/SKILL.md
Enforces security best practices
LazyIsEfficientSkillLazyIsEfficient/agentic-os/.claude/skills/security/SKILL.md
Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.
manu14357Skillmanu14357/Zelaxy/.agents/skills/security/SKILL.md
Maintain and improve security across the Zelaxy platform. Use for: secret encryption boundaries, auth modes (session/API key/internal JWT/cron), CSP and middleware hardening, webhook verification, tenant isolation, and security test coverage.
kpbraySkillkpbray/power-bi-agent-skills/.github/skills/security/SKILL.md
Implements Row-Level Security (RLS) and Object-Level Security (OLS) for Power BI models. Use for data access control, dynamic security, and multi-tenant scenarios.
tartinerlabsSkilltartinerlabs/skills/skills/security/SKILL.md
Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. Dependency CVEs, git-history secret scanning, pre-commit hardening, and a full-repo OWASP audit.
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
