devsecops skills

MingyiSecLab/Mingyi-Atlas

Skill Claude CodeCodex

Automate browser interactions, test web pages and work with Playwright tests.

MingyiSecLab/Mingyi-Atlas

Skill Claude CodeCodex

Nuclei CLI parameter reference and usage patterns - YAML-template vulnerability scanning, target input modes, template filters, output formats, rate limits, ProjectDiscovery dashboard upload, and common scan commands.

MingyiSecLab/Mingyi-Atlas

Skill Claude CodeCodex

Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.

aryaminus/controlkeel

Skill Claude CodeCodex

Verify AI agent code for dangerous patterns including infinite loops, unbounded retries, tool hallucinations, and context overflow. Use before deploying agent workflows or when reviewing agent code.

aryaminus/controlkeel

Skill Claude CodeCodex

Enable ControlKeel governance for Cloudflare Agents with policy gates, budget enforcement, PII detection, and secure execution.

aryaminus/controlkeel

Skill Claude CodeCodex

Learn, record, audit, and apply codebase patterns consistently across a repo by comparing current code to canonical local examples stored in CK memory. Use when asked to preserve continuity, learn a pattern, check drift, fix inconsistent implementations, or enforce local conventions.

tr4m0ryp/shor

Skill Claude CodeCodex

Skill "jwt_tool" from tr4m0ryp/shor, covering jwttool — jwt analysis & attacks, when to reach for it, key flags / modes, safe invocation and form field (oidc-style).

tr4m0ryp/shor

Skill Claude CodeCodex

Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…

tr4m0ryp/shor

Skill Claude CodeCodex

A small recipe over the already-cloned repo. It runs git log --grep for security/CVE/fix patterns, maps the touched files into ranked hot files, and emits historicalsignal.json. It optionally folds in two signals you may have ALREADY produced this phase — osv-scanner JSON (dependency CVEs) and gitleaks JSON (history…

CaseyLabs/kc-secure-repo-template

Skill Claude CodeCodex

Use when updating or reviewing GitHub-side hardening guidance for derived repositories, including required settings, rulesets, scanning, review protections, and workflow permissions. Use terraform-hardening instead for Terraform-backed changes under config/infra. Do not use for ordinary in-repo implementation changes…

CaseyLabs/kc-secure-repo-template

Skill Claude CodeCodex

Use when adapting or customizing this repository to meet the needs of the source code under src/, including language and framework needs, dependencies, runtime behavior, Docker, Makefile targets, and customization surfaces. Do not use for routine bug fixes, small refactors, pure workflow validation…

CaseyLabs/kc-secure-repo-template

Skill Claude CodeCodex

Use when changing or reviewing the Terraform-backed GitHub repository hardening workspace under config/infra, including provider pins, rulesets, default branch protection, required checks, secret scanning, Dependabot security updates, token handling, plan/apply behavior, and infra documentation. Do not use for…

CarbeneAI/Forge

Skill Claude CodeCodex

Structured 7-phase execution engine for systematic problem-solving with effort classification and rigorous methodology. USE WHEN user mentions algorithm, systematic approach, structured execution, step-by-step methodology, rigorous framework, OR wants disciplined problem-solving process.

CarbeneAI/Forge

Skill Claude CodeCodex

Comprehensive catalog of 570+ annual security reports and threat intelligence sources for CISO consulting, threat landscape analysis, and security research. USE WHEN user mentions annual reports, threat landscape, security reports, industry reports, DBIR, Verizon, Mandiant, CrowdStrike, threat briefing, threat…

CarbeneAI/Forge

Skill Claude CodeCodex

AI image generation for blog posts, presentations, and content creation. USE WHEN user mentions generate image, create artwork, blog image, header image, presentation visual, AI art, Replicate, DALL-E, Midjourney, OR wants visual content for publications and marketing materials.

Mocinjay/immunogen

Skill Claude CodeCodex

Scan an AI-built ("vibe-coded") repo for launch-blocking issues — leaked secrets, exposed API keys, broken auth, missing row-level security, unsafe payment wiring, vulnerable dependencies, and risky AI-layer surface (skills/MCP servers/agent prompts). Returns a 0-100 Ship Score with a banded verdict and ranked…

FarzamHabibi/pre-production-checklist

Skill Claude CodeCodex

Review this codebase against the prodcheck pre-production checklists — security, performance, scale, integrations and post-launch readiness. Use when asked to check whether a project is ready to ship, to audit an area before launch, or to work through a specific checklist. Produces evidence with file:line citations…

cfgaudit/cfgaudit

Skill Claude CodeCodex

Explain a cfgaudit rule (what it checks, why, and how to fix it).

cfgaudit/cfgaudit

Skill Claude CodeCodex

Scaffold a project-aware .claude/settings.json deny list with cfgaudit.

cfgaudit/cfgaudit

Skill Claude CodeCodex

Run cfgaudit to scan this project's AI-agent configuration files for security issues.

samartomar/ai-harness

Skill Claude CodeCodex

Create, edit, and review ai-harness public documentation with BetterDoc's claim-first, evidence-aware workflow. Use for README and website copy, quickstarts, reference docs, architecture and ADRs, security and assurance docs, runbooks, migration guides, changelogs, release notes, PR summaries, or any other public…

samartomar/ai-harness

Skill Claude CodeCodex

Structured decision-closing sessions for the ai-harness / aih product. Use whenever the user says "decision session" or "close decisions", asks "should we do A or B" about aih's product, governance, packaging, or roadmap direction, wants open questions triaged into decidable-now vs parked-on-evidence, wants a past…

samartomar/ai-harness

Skill Claude CodeCodex

Scan open PRs and generated ECC/agent artifacts for high-coverage review risks before they are accepted. Use when a PR adds or changes agent bootloaders, Codex or Claude skills, MCP config, generated workflow commands, auto-learning instincts, repository review runbooks, or multi-agent review configuration; also use…

jlevy/supply-chain-hardening

Skill Claude CodeCodex

Git-native issue tracking (beads), coding guidelines, knowledge injection, and spec-driven planning for AI agents. Drop-in replacement for bd/Beads with simpler architecture. Use for: tracking issues/beads with dependencies, creating bugs/features/tasks, planning specs, implementing features from specs, code reviews…