| # | Mod | Type | Stars | Scan | Tokens | Rating |
|---|---|---|---|---|---|---|
| 1 | diagnose-windows-sandbox-acldeepseek-ai/deepseek-harnessUse on Windows for unexpected DSH sandbox access denials: workspace writes or listing fail, or an ordinarily readable path cannot be read. One bundled command inspects the path and every ancestor and repairs the ACL problems it proves in that same run. Expected confinement denials need no ACL repair. | Skill | 275k | A | 67 | — |
| 2 | api-security-testingusestrix/strixSecurity-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object… | Skill | 74k | A | 144 | — |
| 3 | skill-inspectorNVIDIA/SkillSpectorReview AI agent skills before installation using NVIDIA SkillSpector and source-aware semantic review. Use when asked whether a skill or downloaded skill folder is safe, trustworthy, installable, over-permissioned, or malicious. | Skill | 25k | A | 47 | — |
| 4 | review-prsgoogleapis/mcp-toolboxReview a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks… | Skill | 17k | A | 162 | — |
| 5 | error-response-safetymicrosoft/data-formulatorPrevent information exposure through exception messages in HTTP responses. | Cursor rule | 18k | A | 0 | — |
| 6 | oauthvercel-labs/portlessConfigure OAuth providers (Google, Apple, Microsoft, Facebook, GitHub, etc.) to work with portless local dev URLs. Use when setting up OAuth redirect URIs, fixing "redirecturimismatch" or "invalid redirect" errors, configuring sign-in providers for local development, or when a provider rejects .localhost subdomains.… | Skill | 13k | A | 115 | — |
| 7 | edgeone-clawscanTencent/AI-Infra-GuardThe first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills, scans skills before installation, and performs a full OpenClaw security health check to prevent data leaks and privacy risks. Backed by Tencent Zhuque… | Skill | 7.4k | A | 236 | — |
| 8 | prowler-attack-paths-queryprowler-cloud/prowlerCreates Prowler Attack Paths openCypher queries using the Cartography schema as the source of truth for node labels, properties, and relationships. Covers Prowler-specific additions (Internet node, ProwlerFinding, internal isolation labels), $provideruid scoping, and list-property item nodes with typed HAS edges that… | Skill | 15k | A | 97 | — |
| 9 | deepsecvercel-labs/deepsecRun deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities. | Skill | 8.4k | A | 48 | — |
| 10 | skill-security-auditoreigent-ai/eigentSecurity auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files… | Skill | 16k | A | 114 | — |
| 11 | agui-tauri-windows-signingCopilotKit/OpenBotConfigure and troubleshoot Authenticode code signing for Tauri Windows builds (.exe / .msi) using the AG-UI organization's DigiCert code-signing certificate stored in Azure Key Vault (non-exportable RSA-HSM key), signed via AzureSignTool authenticated with GitHub OIDC. Covers tauri.conf.json signCommand wiring, the CI… | Skill | 10k | A | 202 | — |
| 12 | oss-fuzzapache/tikaRun Tika's OSS-Fuzz Jazzer targets locally against a working-tree checkout — build the image, build fuzzers from local source, fuzz a target, run a corpus as a regression pass, reproduce a crash, and add seeds. Use for "fuzz the OneNote parser", "run OneNoteParserFuzzer against these files", "reproduce an OSS-Fuzz… | Skill | 4.1k | A | 90 | — |
| 13 | security-auditcloudflare/security-audit-skillSecurity guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end… | Skill | 65k | A | 72 | — |
| 14 | attack-chainzhaoxuya520/reverse-skillUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill. | Skill | 44k | A | 43 | — |
| 15 | specialized-attack-playbooksEd1s0nZ/CyberStrikeAIA collection of cybersecurity playbooks for investigating and exploiting specific systems, including GoEdge CDN, ARP man-in-the-middle attacks, BT Panel, OCS, MinIO, and CDN-to-S3 access chains. | Skill | 8.3k | A | 91 | — |
| 16 | mantis-reproducegoogle/mantisGenerates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching. | Skill | 2.7k | A | 47 | — |
| 17 | watermarks-removerguillaumemeyer/watermarks-removerRemove multi-vendor AI provenance marks: invisible Unicode (Layer A), statistical text watermarks via rewrite (Layer B), and C2PA/EXIF/XMP/container metadata on images, documents, and media. Ships the remove-ai-marks skill (thin client over the repo's HTTP service) and the self-contained clean-user-facing-text skill. | Plugin | 27k | A | — | — |
| 18 | offensive-vuln-classesSnailSploit/Claude-RedExploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit… | Skill | 10k | A | 0 | — |
| 19 | defense-evasionPurpleAILAB/DecepticonEndpoint defense bypass — AMSI/ETW patching, ScareCrow framework, custom loaders, direct/indirect syscalls, LOLBAS execution, process injection. | Skill | 6.5k | A | 40 | — |
| 20 | varlockdmno-dev/varlockSecure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminal, logs, or LLM context. Provides guidance around integrating varlock into a project, reading/editing .env.schema and other .env files… | Skill | 4.9k | A | 109 | — |
| 21 | top-web-vulnerabilitieszebbern/claude-code-guideThis skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand… | Skill | 4.7k | A | 114 | — |
| 22 | pm-ai-shippingphuryn/pm-skillsMoved to phuryn/product-engineering, which maintains the AI Shipping Kit in its ai-shipping plugin; the skills and commands here only say where each one went. | Plugin | 28k | A | — | — |
| 23 | ctf-cryptoljagiello/ctf-skillsProvides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses. | Skill | 3.6k | A | 78 | — |
| 24 | graph-db-writessamugit83/redamonWriting to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must be updated together. A MERGE missing the tenant key silently merges one project's data into another's. Trigger: editing… | Skill | 3.3k | A | 119 | — |
| 25 | agt-governancemicrosoft/agent-governance-toolkitAGT governance hooks and MCP tools for Claude Code sessions. | Plugin | 6.5k | A | — | — |
| 26 | hackeroneNetw0rkNoob/VulnClawHackerOne bounty program scope-guard workflow — reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow. | Skill | 3.9k | A | 36 | — |
| 27 | sui-move-security-reviewMystenLabs/suiUse when auditing, reviewing, or hunting for vulnerabilities in Move code on Sui. Applies equally to source code (.move files) and to disassembly of compiled bytecode (on-chain packages). A checklist of invariants whose VIOLATION causes exploitable bugs: access control & capabilities, struct abilities & type safety… | Skill | 7.8k | A | 174 | — |
| 28 | kunlun-m-generalLoRexxar/Kunlun-MA scripted workflow for Kunlun-M, a static security scanner that examines source code without running it. It supports PHP, JavaScript, Solidity smart contracts, and Chrome extensions, and can create scanner rules and tamper settings. | Skill | 2.4k | A | 85 | — |
| 29 | continuous-exposure-monitoringelementalsouls/Claude-OSINTTurns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved… | Skill | 3.0k | A | 408 | — |
| 30 | osmedeus-expertj3ssie/osmedeusExpert guide for the Osmedeus security automation workflow engine. Use when: (1) writing or editing YAML workflows (modules and flows), (2) running osmedeus CLI commands (scan, workflow management, installation, server), (3) configuring steps, runners, triggers, or template variables, (4) debugging workflow execution… | Skill | 6.6k | A | 113 | — |
| 31 | configuration-authorizationgreenpau/caddy-securityConfigure authorization policies, ACLs, static claims enrichment, required external decisions, bypasses, identity headers, JWT verification, remote Basic/API-key auth, SQLite/Consul API keys, and direct OAuth without a portal. | Skill | 2.3k | A | 48 | — |
| 32 | openmed-skillsmaziyarpanahi/openmedDe-identify PHI, run clinical NER, export FHIR, evaluate with leakage gates, and the healthcare workflows around them. | Plugin | 5.8k | A | — | — |
| 33 | implementing-data-loss-prevention-with-microsoft-purviewxalgorix/xalgorixImplements data loss prevention policies using Microsoft Purview to protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, endpoint devices, and Power BI. The analyst configures sensitivity labels with encryption and content marking, creates DLP policies using built-in and custom sensitive… | Skill | 1.3k | A | 148 | — |
| 34 | claude-authenticityagentscope-ai/OpenJudgeDetect whether an API endpoint is backed by genuine Claude (not a wrapper, proxy, or impersonator) using 9 weighted rule-based checks that mirror the claude-verify project. Also extracts injected system prompts from providers that override Claude's identity. Fully self-contained — copy the code below and run, no extra… | Skill | 1.1k | A | 121 | — |
| 35 | sc-auditaeonfun/aeonDeep security audit of a smart-contract repo OR a live on-chain contract by address - detect Solidity, model the protocol invariants and trust boundaries first, run Slither (best-effort) plus a bounded agentic pass that hunts for a path breaking each invariant, triage, adversarially verify, prove with a fuzzer, and… | Skill | 789 | A | 94 | — |
| 36 | mastgChiChou/grapefruitAutonomous mobile security audit aligned with OWASP MASTG v2. Performs checklist-driven analysis across MASVS categories: storage, crypto, network, platform, code, resilience, privacy. Exports structured markdown report with MASTG test references. | Skill | 1.4k | A | 53 | — |
| 37 | reverse-skillMouseww/anything-analyzerA collection of methods for analyzing websites, browser code, API behavior, and encryption or signing processes. It is intended for authorized investigation and produces findings and reports rather than launching attacks. | Skill | 3.8k | A | 89 | — |
| 38 | Claude-BugHunterelementalsouls/Claude-BugHunter83-skill bug-hunting & external red-team bundle for Claude Code — 58 hunt- web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands in. | Plugin | 5.4k | A | — | — |
| 39 | anti-cheat-systemsgmh5225/awesome-game-securityAnalyze layered anti-cheat architecture, detection evidence, telemetry, and enforcement tradeoffs. Use for system-level defense questions; use narrower skills for DMA, kernel, graphics, mobile, or server details. | Skill | 3.7k | A | 46 | — |
| 40 | sast-fileuploadutkusen/sast-skillsDetect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first).… | Skill | 1.4k | A | 92 | — |
| 41 | detection-signalsLinXiaoTao/FuckClaudeA set of rules for detecting signals that may suggest a browser user is in China. It scans browser information locally and also reuses scoring functions in a server endpoint called /api/check. | Skill | 1.2k | A | 69 | — |
| 42 | svc-mobile-androids0ld13rr/pentestcodeAndroid APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis. Use when target is an APK/Android app. Triggers - APK, Android, mobile app, decompiled, smali, jadx, apktool. | Skill | 930 | A | 66 | — |
| 43 | agentic-bug-hunterAwarexone/Agentic-Bug-HunterAI-powered bug bounty toolkit — recon, vulnerability hunting, validation gates, and submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi. | Plugin | 5.5k | A | — | — |
| 44 | workers-oauth-provider-migrate-1.xcloudflare/workers-oauth-providerUpgrade a Cloudflare Worker's @cloudflare/workers-oauth-provider from 0.x, 1.0 or 1.1 to the latest 1.x. Use when bumping that dependency, or when OAuthProvider / OAuthAuthorizationServer / OAuthResourceServer construction throws after an upgrade. | Skill | 1.9k | A | 70 | — |
| 45 | dep-auditorlaolaoshiren/claude-code-skills-zhA read-only audit of a project’s third-party packages for known security issues, version health, and license facts. It uses the versions actually selected by lockfiles, which record the exact packages installed, rather than relying only on version ranges. | Skill | 907 | A | 72 | — |
| 46 | hol-guardhashgraph-online/hol-guardRun HOL Guard scanner and guard operations via uv run hol-guard. Use when the user asks to scan plugins/MCP/skills for security, quality, or ecosystem compliance, or when they ask to run guard detect/install/protect workflows for local AI harnesses. | Skill | 1.1k | A | 58 | — |
| 47 | pentest-playbookSeaOf0/dsh-redteam-modelA penetration-testing playbook for examining authorized websites, applications, and services for real, verified security weaknesses. | Skill | 843 | A | 429 | — |
| 48 | kuna-decompilerNoelo-Lab/kunaUse the Kuna CLI to recover searchable C and assembly, trace program logic, and validate findings in CTF solving, vulnerability hunting, malware identification, and program repair. Covers using Kuna, not developing the decompiler. | Skill | 832 | A | 48 | — |
| 49 | code-reviewjuicesharp/rpiv-monoConduct comprehensive code reviews of pending changes, a branch, or a PR using parallel specialist agents that audit the diff, compare against peer code, and verify claims. Use when the user asks to 'review this', wants pending changes, a PR, a branch, or a diff reviewed, or asks for a code review. Produces review… | Skill | 947 | A | 100 | — |
| 50 | h5ih5i-dev/h5iSkill "h5i" from h5i-dev/h5i, covering h5i, choose the workflow, build and verify and use the development tools. | Skill | 898 | A | 47 | — |
| 51 | integrate-arcjet-guard-agentsarcjet/arcjet-jsIntegrate Arcjet security into a Vercel AI SDK (v7) application using @arcjet/guard — wrap agent tools with guard checks, enforce rules on risky app actions, and emit audit events joined by one correlation ID. Use when asked to add Arcjet to an AI SDK app, protect or rate limit agent tool calls, guard AI agent… | Skill | 698 | A | 91 | — |
| 52 | beaconAsymptote-Labs/agent-beaconCross-harness memory from Beacon traces: recall reviewed project lessons, distill agent sessions into approved memory, promote memory to Agent Skills, build dashboard lenses, and share sessions to beacon.sh. | Plugin | 3.4k | A | — | — |
| 53 | deep-security-scanCoWork-OS/CoWork-OSUse when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide Codex Security scan. Run repeated independent repository-wide discovery passes with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation… | Skill | 537 | A | 97 | — |
| 54 | cybersecurity-skillsmukul975/Anthropic-Cybersecurity-Skills818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. | Plugin | 36k | A | — | — |
| 55 | secops-setup-antigravitygoogle/mcp-securityHelps the user configure the Google SecOps Remote MCP Server for Antigravity. Use this when the user asks to "set up" or "configure" the security tools for Antigravity. | Skill | 538 | A | 48 | — |
| 56 | owasp-auditbriiirussell/cybersecurity-skillsAudit application source code against the OWASP Top 10:2025 categories — broken access control (incl. SSRF), security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software and data integrity, logging and alerting failures, mishandling of… | Cursor rule | 507 | A | 197 | — |
| 57 | pr-council-reviewffroliva/gflow-cliMulti-dimensional LLM council review of an open PR (default) or a local feature branch (§ 8 branch mode, invoked via /gflow:branch-review). Five baseline dimensions (correctness, quality, security, tests, memory-hygiene) plus adaptive dimensions per surface (transports / data / CLI / docs / auth / BDD / scripts /… | Skill | 366 | A | 125 | — |
| 58 | sponsioSponsioLabs/SponsioInstall, observe, tune, and enforce Sponsio: a runtime contract layer for LLM agents that blocks unsafe tool calls and scores output quality against declared rules. Use when the user wants to set up / add / install Sponsio, add guardrails or runtime safety to an LLM agent, generate or refine a sponsio.yaml, audit tool… | Skill | 454 | A | 0 | — |
| 59 | Home Security AI BenchmarkSharpAI/DeepCameraLLM & VLM evaluation suite for home security AI applications. | Skill | 3.1k | A | 17 | — |
| 60 | business-logic-vulnerabilitiesyaklang/hack-skillsBusiness logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps. | Skill | 2.6k | A | 37 | — |
| 61 | cc-safety-netkenryu42/cc-safety-netBlock destructive commands and secret access. | Plugin | 1.9k | A | — | — |
| 62 | vulnhunter-fixcapitalone/VulnHunterAutomate vulnerability remediation from VulnHunter scan results using TDD. Parses VulnHunter findings, writes exploit demos proving each vulnerability, writes security tests that define correct behavior (RED), implements fixes to pass those tests (GREEN), and delivers via PR or fallback GitHub issue. Each PR includes… | Skill | 1.2k | A | 135 | — |
| 63 | bug-huntercodexstar69/bug-hunterPrecision-first adversarial bug hunting for runtime, logic, data, concurrency, and security defects. Uses deterministic risk triage, evidence-bounded retrieval, Hunter/Skeptic/Referee review, optional hybrid verification, and explicit immutable Fixer scope. Scan-only and single-pass by default; complete-coverage… | Skill | 550 | A | 105 | — |
| 64 | fastapi-guardrennf93/fastapi-guardProduction-ready security middleware for FastAPI. Use when adding IP filtering, rate limiting, per-route security decorators, route-resolution strict mode, global behavior rules, passive/log-only mode, or Guard Agent SaaS telemetry to a FastAPI app. Covers SecurityMiddleware setup, SecurityConfig tuning, and the… | Skill | 825 | A | 72 | — |
| 65 | evm-bytecode-analysiscdump/evmoleAnalyze supplied deployed EVM runtime bytecode with EVMole or guide a separate application in integrating a published EVMole Rust, Go, Python, or JavaScript binding. Use for unverified-contract inspection, ABI reconstruction from runtime code, selector discovery, storage-access analysis, EVM control-flow inspection… | Skill | 473 | A | 135 | — |
| 66 | openosintOpenOSINT/OpenOSINTPassive OSINT and external exposure checks for domains, IPs and organizations: skills /osint and /exposure plus the OpenOSINT MCP server (passive mode). | Plugin | 1.9k | A | — | — |
| 67 | beaconing-reviewVigil-SOC/vigilGrade a periodic outbound flow as c2, suspicious, or benign-periodic. Read this when rawdata shows a repeating connection and you must separate a beacon from NTP, an update check, a monitoring agent, or telemetry. | Skill | 423 | A | 51 | — |
| 68 | skill-release-gatefancyboi999/ai-engineering-from-scratch-zhA release-checking skill for evaluating whether an agent skill bundle is complete, safe, correctly triggered, and portable to its target host. | Skill | 1.3k | A | 49 | — |
| 69 | publish-findingsvlinx-io/VelaTermRequires explicit opt-in with CODEXSECURITYENABLEEXTERNALIMPORTS=1. Preview and import scanner findings into the local workbench or Codex Security Cloud. Use the selected provider's documented export format. | Skill | 336 | A | 44 | — |
| 70 | akto-core-rulesakto-api-security/aktoAkto is the fastest growing AI Security platform for your teams to secure AI agents, MCPs, LLMs, Agent skills, Gen AI apps in your organization. | Cursor rule | 1.5k | A | 129 | — |
| 71 | unifi-accesssirkirby/unifi-mcpUniFi Access MCP server — manage door locks, credentials, visitors, and access policies. | Plugin | 1.0k | A | — | — |
| 72 | reviewerduckbugio/flockRead-only adversarial reviewer. Pre-PR it returns a verdict for the arbiter; on an open PR it posts true line-anchored INLINE comments via the git-host API, written in the PR's own language. Scores risk and checks cross-service compatibility. Never edits code. | Agent | 495 | A | 60 | — |
| 73 | Security Code Reviewkousen/claude-code-trainingIdentify security vulnerabilities and suggest secure coding practices. | Skill | 343 | A | 12 | — |
| 74 | extendscriptleancoderkavy/premiere-pro-mcpES3 ExtendScript generation and string escaping for CEP/AE host scripts. | Cursor rule | 494 | A | 0 | — |
| 75 | agentic-securitymsoedov/agentic_securityDrive the agesec security harness through a policy-constrained CLI loop. | Plugin | 2.0k | A | — | — |
| 76 | authtableau/tableau-mcpAuth architecture, middleware chain, and auth-specific coding standards. | Cursor rule | 368 | A | 0 | — |
| 77 | cyberowlaikarimhabush/cyberowlCheck if recent cybersecurity alerts from 10 international CERTs affect your current project. Use when the user asks about security vulnerabilities, CVEs, "is my project affected", "any new security alerts", "check for vulnerabilities", "cyberowlai", or "/cyberowlai". Also trigger when the user is working on… | Skill | 264 | A | 155 | — |
| 78 | vulnerability-triageprovos/ironcurtainReference vocabulary for interpreting vulnerability findings — detector-vs-impact distinction, severity anchoring on demonstrated evidence, the eleven-item interpretation rubric, delegation transparency, primitive-extent scaling, the disqualifier taxonomy (D-0..D-4), CVSS Achievable / Environmental framing… | Skill | 640 | A | 121 | — |
| 79 | netwatchsepivip/SeekerClawNetwork monitoring and security audit. Use when: user asks to scan network, check open ports, network audit, who's on wifi, check connection, port scan, firewall check, network status, or network security. Don't use when: user asks about crypto transactions (use solana tools) or web search (use research skill). | Skill | 319 | A | 68 | — |
| 80 | llm-sandboxvndee/llm-sandboxLLM Sandbox is a lightweight and portable sandbox environment designed to run large language model (LLM) generated code in a safe and isolated mode. Runs locally from the llm-sandbox Python package. Needs 12 environment variables to run. | MCP server | 1.1k | A | — | — |
| 81 | mcp-scannercisco-ai-defense/mcp-scannerSecurity scanning for MCP servers using YARA rules, LLM analysis, and Cisco AI Defense. Detect prompt injection, tool poisoning, and other threats in MCP tools, prompts, and resources. | Plugin | 1.1k | A | — | — |
| 82 | screen_lockAIOSAI/AIPassPassword-lock the machine's screen while every process keeps running, and read whether it is locked. | Skill | 312 | A | 21 | — |
| 83 | dynamic-instrumentationgmh5225/awesome-llvm-securityExpertise in LLVM-based dynamic binary instrumentation, runtime tracing, and program monitoring. Use this skill when implementing runtime analysis tools, code coverage systems, profilers, or dynamic security monitors. | Skill | 891 | A | 42 | — |
| 84 | breakJDArmy/BREAKA Chinese-language business-security knowledge base covering risks, defenses, attack tools, threat actors, terms, business areas, and documented cases. | Skill | 388 | A | 50 | — |
| 85 | ebctf-decodeHenglie/EBCTFCodeBoxA local text decoder for identifying and reversing encodings and simple ciphers, such as Base64, hexadecimal, Caesar shifts, and Morse code. CTF means capture the flag, a type of security puzzle where hidden messages and clues must be solved. | Skill | 333 | A | 100 | — |
| 86 | vet-packagessafedep/vetAlways use vet-mcp to vet any open source library package suggested by AI generated code before installation. Follow the rules below to use vet-mcp. | Cursor rule | 1.1k | A | 74 | — |
| 87 | elastic-cloudelastic/agent-skillsElastic Cloud skills - project setup, access management, network security, and Serverless project lifecycle. | Plugin | 603 | A | — | — |
| 88 | lyrikgebruder/wirkenSecurity assessment of a codebase, minimal mode for runner validation. | Skill | 195 | A | 15 | — |
| 89 | triage-securityvalory-xyz/open-autonomyTriage open security alerts on the current GitHub repo — both Dependabot (dependency CVEs) and Code Scanning (CodeQL / SnykCode / other tools that emit to GitHub's code-scanning API). For each alert, decide whether the bug's threat model is actually exploitable given this codebase's archetype, calling code, and… | Skill | 137 | A | 141 | — |
| 90 | js-reverse-automationFausto-404/js-reverse-automation--skillA workflow for examining JavaScript in a real browser to find where login data, API requests, form fields, or responses are encrypted or signed. It then produces code and connection documentation for using that logic elsewhere. | Skill | 610 | A | 48 | — |
| 91 | agent-accessbitwarden/agent-accessRetrieve login credentials, API keys, and secrets (username, password, TOTP) from the user's Bitwarden vault via aac. Use when you need credentials to sign into a website or service, or need an API key. | Skill | 220 | A | 49 | — |
| 92 | coralogix-ai-centeraws/tools-for-devops-agentCoralogix AI Center — observe, evaluate, and guard GenAI/LLM applications and agents. Use for questions or actions about the user's AI/GenAI applications or agents — their behavior, prompts/responses, chats, quality, hallucinations, guardrails, cost/tokens, evaluations/policies, model pricing or comparing or tracking… | Skill | 137 | A | 123 | — |
| 93 | pentest-ai-agents marketplace0xSteph/pentest-ai-agentsMarketplace for pentest-ai-agents — specialist Claude Code subagents for authorized penetration testing. | Plugin | 2.4k | A | — | — |
| 94 | npm-securitybodadotsh/npm-security-best-practicesPrevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating dependencies or configuring package managers. | Skill | 859 | A | 43 | — |
| 95 | terrasharkLukasNiessen/terrasharkPrevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines. | Skill | 703 | A | 56 | — |
| 96 | agentsecretsThe-17/agentsecretsZero-knowledge secrets infrastructure — AI agents manage the complete credential lifecycle without ever seeing values. | Skill | 197 | A | 21 | — |
| 97 | smart-contract-auditforefy/.contextComprehensive smart contract security audit framework with multi-expert analysis. Use for full audits of Ethereum / EVM Solidity and Vyper, Solana / SVM Anchor Rust, TON / FunC / Tact, or Sui / Move projects. | Skill | 153 | A | 55 | — |
| 98 | auditing-skillsdbt-labs/dbt-agent-skillsUse when checking skills for security or quality issues, reviewing audit results from skills.sh or Tessl, or remediating findings across published skills. | Skill | 757 | B | 34 | — |
| 99 | ssh-mcptufantunc/ssh-mcpPolicy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log. Runs locally from the ssh-mcp npm package. Needs 4 environment variables to run. | MCP server | 861 | A | — | — |
| 100 | hunt-race-conditionuphiago/recon-skillsHunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card… | Skill | 1.3k | A | 140 | — |
Want everything, not just what passes the gates? Browse the full category from any type hub, or search it. This shelf recomputes nightly from the measurements.