638 tagged appsec, measured the same way as everything else here.
Browse within: ai-security 232cybersecurity 162devsecops 93compliance 69llm-security 59bug-bounty 57owasp 55agentskills 51cis 50DAST 47blue-team 44sast 41code audit 40ai-coding-agents 39
Skill Claude CodeCodex
Guides authorized penetration testing with PentestingEverything as the source-grounded knowledge base. Use when scoping an engagement, building domain checklists, hunting a vulnerability class, choosing tools/commands, or drafting evidence-based findings from this repository's Markdown.
Skill Claude CodeCodex
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace…
Skill Claude CodeCodex
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this…
Skill Claude CodeCodex
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session…
Skill Claude CodeCodex
Digital forensics and incident response toolbox. Load when the operator asks about a pcap, a binary, a memory dump, a suspicious file, malware triage, IOC hunting, or post-incident analysis. Covers network (tshark), binaries (radare2, strings, binwalk, file, exiftool), memory (volatility), and pattern matching (YARA).…
Skill Claude CodeCodex
Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, or chat applications. Covers Agent class, state management, callable RPC, Workflows integration, and React hooks.
Skill Claude CodeCodex
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task.
Eyadkelleh/awesome-skills-security
Skill Claude CodeCodex
Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.
Eyadkelleh/awesome-skills-security
Skill Claude CodeCodex
Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.
Eyadkelleh/awesome-skills-security
Skill Claude CodeCodex
Top password lists for authorized security testing: common passwords, darkweb leaks, worst passwords. Curated essentials (<10MB).
Skill Claude CodeCodex
Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, LLM Top 10 (2025), and Agentic AI security (2026).
Skill Claude CodeCodex
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification…
AgriciDaniel/claude-cybersecurity
Skill Claude CodeCodex
Ultimate AI-powered cybersecurity code review skill. Performs comprehensive security audit across 8 dimensions: vulnerability detection (OWASP Top 10:2021, CWE Top 25:2024), secret scanning, dependency/supply chain analysis, IaC security, threat intelligence (malware/backdoor/C2 detection, MITRE ATT&CK mapping)…
Skill Claude CodeCodex
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications…
Skill Claude CodeCodex
Fast, template-based vulnerability scanning using ProjectDiscovery's Nuclei with extensive community templates covering CVEs, OWASP Top 10, misconfigurations, and security issues across web applications, APIs, and infrastructure. Use when: (1) Performing rapid vulnerability scanning with automated CVE detection, (2)…
CyberStrategyInstitute/ai-safe2-framework
Skill Claude CodeCodex
Apply AI SAFE2 v3.1 to design, build, audit, test, and govern AI agents, multi-agent systems, RAG, MCP/tool integrations, and AI infrastructure. Use the 161-control core taxonomy plus applicable profile overlays such as CP.5.MCP MCP-1 through MCP-19. Classify autonomy with ACT tiers, enforce HEAR and replication…
Skill Claude CodeCodex
Debug a completed or stuck Hacker Bob session — pipeline quality, drift, failures, improvements.
Skill Claude CodeCodex
Headless Bob diff-review pipeline — invoked by bob-runner.ts via 'claude --dangerously-skip-permissions --print "/bob-diff-review -- ..."'. Ingests a unified diff, initializes a Bob repo session, builds the symbol surface index, maps changed hunks to impacted surfaces, spawns per-surface evaluator agents, and…
Skill Claude CodeCodex
Hacker Bob orchestrator runtime — invoked by /bob-evaluate. Do not call directly.
Skill Claude CodeCodex
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on…
Skill Claude CodeCodex
Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity…
Skill Claude CodeCodex
Reviews DAST tool configurations against OWASP Top 10:2021 and OWASP Testing Guide v4.2. Auto-invoked when reviewing OWASP ZAP configurations, DAST CI/CD integration, scan policies, or authenticated scanning setups. Produces a DAST maturity assessment covering scan policy configuration, active vs passive scanning, API…
Skill Claude CodeCodex
Investigate and remediate exactly one user-selected CodeInspectus finding with evidence-gated reproduction, a separately approved minimal patch, focused regression testing, and an exact-prior-scan rescan. Use when a user asks an agent to examine, reproduce, fix, or verify one CodeInspectus finding without batching…
Skill Claude CodeCodex
Orchestrate an optional bounded multi-agent review of selected CodeInspectus findings while separating deterministic findings, agent interpretations, hypotheses, reproduction evidence, and exact-prior rescan proof. Use only when a user explicitly requests multi-agent security review.