The most comprehensive cybersecurity skill pack for AI coding agents — 741 skills spanning offense, defense, cloud, forensics, malware analysis, CTF, AppSec, DevSecOps, OT/ICS, and more. Drop-in compatible with Claude, Codex, Gemini CLI, Cursor, and 20+ platforms.
This repository also configures its own agents. See what AI-agent-master-cyber-skills-list tells them →
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Use when reviewing source code for security vulnerabilities, performing static analysis of a codebase, auditing code for injection flaws, authentication issues, cryptographic weaknesses, insecure deserialization, SSRF, path traversal, memory safety bugs, hardcoded secrets, or misconfigurations. Use when the user asks…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Comprehensive security scanning for CVE vulnerabilities, OWASP Top 10 code patterns, and dependency audits. Use when the user wants to check code security, find vulnerabilities, or audit dependencies.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude Code
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude Code
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude Code
Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Security assessment and exploitation methodology for Supabase-backed applications, focusing on PostgREST, RLS policies, and Edge Functions.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude Code
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if…
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.
Njones17/AI-agent-master-cyber-skills-list
Skill Claude CodeCodex
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: