336 tagged appsec, measured the same way as everything else here.
Browse within: ai-security 374llm-security 195cybersecurity 160devsecops 94claude-code-plugin 78compliance 70owasp 60bug-bounty 55agentskills 51DAST 50cis 50ai-coding-agents 45blue-team 44sast 42
Skill Claude CodeCodex
Rigorous review of OWASP Cheat Sheet Series pull requests across security correctness, practicality, link and source verification, duplication, and language. Use for any pull request that touches cheatsheets/ or cheatsheetsdraft/, or that adds or changes external links or citations.
Skill Claude CodeCodex
Digital forensics and incident response toolbox. Load when the operator asks about a pcap, a binary, a memory dump, a suspicious file, malware triage, IOC hunting, or post-incident analysis. Covers network (tshark), binaries (radare2, strings, binwalk, file, exiftool), memory (volatility), and pattern matching (YARA).…
Eyadkelleh/awesome-skills-security
Skill Claude CodeCodex
Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.
Skill Claude CodeCodex
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification…
Skill Claude CodeCodex
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications…
CyberStrategyInstitute/ai-safe2-framework
Skill Claude CodeCodex
Apply AI SAFE2 v3.1 to design, build, audit, test, and govern AI agents, multi-agent systems, RAG, MCP/tool integrations, and AI infrastructure. Use the 161-control core taxonomy plus applicable profile overlays such as CP.5.MCP MCP-1 through MCP-19. Classify autonomy with ACT tiers, enforce HEAR and replication…
Skill Claude CodeCodex
Security audit for web apps, especially AI-built ("vibe coded") ones. Scans the running app for exposed .env/.git files, public source maps, weak CSP/HSTS/security headers, wildcard CORS, insecure cookies, and public debug/API-docs endpoints, then audits the codebase across 17 vulnerability categories (RLS, auth…
Skill Claude Code needs its repo
List, add, test, enable, disable, or remove Hacker Bob egress profiles from Codex.
Skill Claude Code
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on…
Skill Codex
Investigate and remediate exactly one user-selected CodeInspectus finding with evidence-gated reproduction, a separately approved minimal patch, focused regression testing, and an exact-prior-scan rescan. Use when a user asks an agent to examine, reproduce, fix, or verify one CodeInspectus finding without batching…
Robotti-io/copilot-security-instructions
Skill Claude CodeCodex
Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.
Skill Claude CodeCodex
Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings…
Skill Claude CodeCodex
Review Flutter Android APK/AAB release artifacts for manifest, permission, cleartext traffic, exported component, embedded secret, signing, size, WebView, deep link, and third-party service risks.
Skill Claude CodeCodex
Composes multi-step exploit chains by correlating vulnerabilities across domains, calculates real impact of chained findings, generates end-to-end PoC scripts, and produces bug bounty ready reports. Use when user asks to "chain vulnerabilities", "compose exploit chain", "correlate findings", "calculate real impact"…
FarzamHabibi/pre-production-checklist
Skill Claude CodeCodex
Review this codebase against the prodcheck pre-production checklists — security, performance, scale, integrations and post-launch readiness. Use when asked to check whether a project is ready to ship, to audit an area before launch, or to work through a specific checklist. Produces evidence with file:line citations…
Skill Claude CodeCodex
Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…
maxwellokumu/okaudit-claude-skills
Skill Claude CodeCodex
Guide Claude through a structured application security audit covering threat modeling, testing, pipeline review, dependency risk, and vulnerability management.
ch0ks/hackarandas-claude-toolbelt
Skill Claude Code
Triage security findings from Semgrep Pro and Claude security-code-review using IaC files as deployment context (Terraform, Kubernetes, Docker Compose, CloudFormation, Azure Pipelines). Detects whichever IaC files are present, extracts deployment facts, scores each finding with CVSS 4.0 with per-vector justification…
Skill Claude CodeCodex
Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".
Skill Claude Code
Convert existing tasks into actionable, dependency-ordered GitHub issues for the feature based on available design artifacts.
Skill Claude CodeCodex
Symfony / PHP webapp security review — Security Component (firewalls, voters, accesscontrol, role hierarchies), Doctrine ORM injection patterns (raw DQL, QueryBuilder, expr()), Twig auto-escape and |raw, CSRF + session, PHP-specific RCE classes (unserialize, include/require, system/exec, eval, type juggling)…
Skill Claude CodeCodex
Autonomous security audit and hardening that scans, exploits, fixes, and re-scans a codebase to zero findings, mapped to SOC 2.
Skill Claude CodeCodex
Elite full-codebase security auditor for any language or stack (JavaScript, TypeScript, Python, Java, Kotlin, PHP, Go, Rust, C/C++, Ruby, C#). Trigger this whenever the user asks to review, audit, scan, harden, or "check the security" of any project, before deploying/shipping/launching a site or app, after adding…
Skill Claude CodeCodex
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: