One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
BuilderIOSkillBuilderIO/agent-native/.agents/skills/security/SKILL.md
Secure app data, actions, routes, and external input. Use when changing authentication, authorization, database access, uploads, untrusted content, or server-side requests to user-provided URLs.
Steady47 mentions in 2 weeks
117 projects use a version of this
Often used withcost-reduceralbert-dmscalability
parcadeiSkillparcadei/Continuous-Claude/.claude/skills/security/SKILL.md
Security audit workflow - vulnerability scan → verification
Often used withcost-reduceralbert-dmscalability
gridacoSkillgridaco/grida/.agents/skills/security/SKILL.md
How to handle `GRIDA-SEC-<id>` security boundaries in the Grida repo. Triggers when you encounter a `GRIDA-SEC` tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each `GRIDA-SEC-<id>` identifies a structural trust boundary documented in `/SECURITY.md`. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.
Often used withcost-reduceralbert-dmscalability
static-web-serverReads credentialsSkillstatic-web-server/static-web-server/.agents/skills/security/SKILL.md
Review or implement security-sensitive code in the Static Web Server (SWS) project — path traversal defenses, symlink and hidden-file policy, TLS, security headers, CORS, basic auth, untrusted input parsing, and vulnerability handling. Use when touching fs/path.rs, static_files/security.rs, cors.rs, basic_auth.rs, tls.rs, security_headers.rs, redirects/rewrites, directory listing download, or any code that handles request paths or headers.
Steady7 mentions in 2 weeks
117 projects use a version of this
Often used withcost-reduceralbert-dmscalability
BankrBotSkillBankrBot/skills/ethskills-security/SKILL.md
Solidity vulnerabilities, defensive code patterns, and a pre-deployment audit checklist. Covers reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV.
Steady5 mentions in 2 weeks
117 projects use a version of this
Often used withcost-reduceralbert-dmscalability
alinaqiReads credentialsSkillalinaqi/maggy/skills/security/SKILL.md
OWASP security patterns, secrets management, security testing
Often used withcost-reduceralbert-dmscalability
boshu2Skillboshu2/agentops/skills/security/SKILL.md
Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked whether code is safe to ship, even one small handler.
Often used withcost-reduceralbert-dmscalability
notqueReads credentialsSkillnotque/vexjoy-agent/skills/review/security/SKILL.md
Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.
Often used withcost-reduceralbert-dmscalability
austintgriffithSkillaustintgriffith/ethskills/security/SKILL.md
Solidity security patterns, common vulnerabilities, and pre-deploy audit checklist. The specific code patterns that prevent real losses — not just warnings, but defensive implementations. Use before deploying any contract, when reviewing code, or when building anything that holds or moves value.
Often used withcost-reduceralbert-dmscalability
garagonReads credentialsSkillgaragon/nanostack/security/SKILL.md
Use before shipping to production. Performs OWASP Top 10 audit and STRIDE threat modeling against the codebase. Supports --quick, --standard, --thorough modes. Also use when the user asks to check security, audit code, or review for vulnerabilities. Triggers on /security.
Often used withcost-reduceralbert-dmscalability
serithemageSkillserithemage/serverless-openclaw/.agents/skills/security/SKILL.md
References Serverless OpenClaw security model. Covers Bridge 6-layer defense, IDOR prevention, secret management, Cognito authentication, and IAM least privilege. Use as a security checklist when writing or reviewing code.
Often used withcost-reduceralbert-dmscalability
kid-sidReads credentialsSkillkid-sid/claude-spellbook/skills/security/skill.md
Use when implementing authentication, authorization, input validation, or secrets management — or when auditing an existing service against OWASP Top 10 risks, configuring security headers, or running a STRIDE threat model.
Often used withcost-reduceralbert-dmscalability
OpenHandsSkillOpenHands/extensions/skills/security/SKILL.md
Security best practices for secure coding, authentication, authorization, and data protection. Use when developing features that handle sensitive data, user authentication, or require security review.
Often used withcost-reduceralbert-dmscalability
TheBeardedBearSASSkillTheBeardedBearSAS/claude-craft/.claude/skills/security/SKILL.md
Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities.
Often used withcost-reduceralbert-dmscalability
ilang-aiSkillilang-ai/autocode/skills/security/SKILL.md
Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.
Often used withcost-reduceralbert-dmscalability
travisjneumanReads credentialsSkilltravisjneuman/.claude/skills/security/SKILL.md
Information security expertise for cybersecurity frameworks (NIST, ISO 27001), security architecture, incident response, vulnerability management, identity management, and cloud security. Use when designing security programs, responding to incidents, or assessing vulnerabilities.
Often used withcost-reduceralbert-dmscalability
FilenCloudDiensteReads credentialsSkillFilenCloudDienste/filen-rs/.claude/skills/security/SKILL.md
Use when writing or reviewing code that handles: file uploads or filesystem paths, credentials/API keys/secrets, cryptography, user input, authentication or authorisation, outbound requests to user-supplied URLs, or dependency changes. Checks for: injection, path traversal, hardcoded secrets, insecure crypto, missing ownership checks, SSRF, mass assignment, and information leakage. Also flags security issues in adjacent code.
Often used withcost-reduceralbert-dmscalability
davidmatousekSkilldavidmatousek/tachi/.claude/skills/security/SKILL.md
Claude-powered SAST and SCA security scan skill. Invoked automatically as the Security Scan step (Step 7) of /aod.build (after Design Quality Gate, before Code Simplification) or standalone via /security. Analyzes all code files and dependency manifests changed on the feature branch relative to main for OWASP Top 10 vulnerability patterns and known CVE findings. Produces a human-readable security-scan.md report and machine-readable .security/ compliance artifacts (scan-log.jsonl, vulnerabilities.jsonl, SARIF 2.1.0, CycloneDX 1.5 SBOM). Blocks build progression on CRITICAL/HIGH findings with an explicit acknowledgment gate. Use --no-security in /aod.build to skip. Invoke /security directly for standalone analysis outside the build pipeline.
Often used withcost-reduceralbert-dmscalability
AIBiz-AutomatyzacjeSkillAIBiz-Automatyzacje/claude-code-starter/.claude/skills/security/SKILL.md
Reguły bezpieczeństwa dla kodu React 19 + Supabase + Edge Functions (RLS, autoryzacja, walidacja wejścia, sekrety, XSS, SSRF) i protokół audytu bezpieczeństwa w resources. Używaj przy pisaniu kodu z auth/authz, RLS policies, walidacją inputów, Edge Functions i danymi osobowymi, a także przy review bezpieczeństwa, audycie przed deployem i OWASP Top 10.
Often used withcost-reduceralbert-dmscalability
AsiaOstrichSkillAsiaOstrich/universal-dev-standards/.claude/skills/security-assistant/SKILL.md
引導安全審查與弱點評估，遵循 OWASP 標準。 Use when: 安全稽核、弱點檢查、安全程式碼審查、威脅建模。 Not for: 自動化的相依套件、CVE 與機密掃描——請用 /scan；處理正在發生的資安事件——請用 /incident。 Keywords: security, OWASP, vulnerability, authentication, authorization, 資訊安全, 弱點, 認證, 授權, 威脅建模.
Often used withcost-reduceralbert-dmscalability
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
