125 tagged sast, measured the same way as everything else here.
Browse within: appsec 41semgrep 38threat-modeling 33ai-security 31ide 18security-tools 17java 16kotlin 16spring 16code-editor 14electron 14ai-skill 11ai-skills 11code-quality 10
Skill Claude CodeCodex
Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first).…
Skill Claude CodeCodex
Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first).…
Skill Claude CodeCodex
Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires…
Skill Claude CodeCodex
Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries, classify severity, or add regression tests for security-sensitive analyzer behavior.
Skill Claude CodeCodex
Run, interpret, or modify Skylos safely. Use when the user asks to scan code with Skylos, explain SKY- findings, triage dead-code false positives, audit security/secrets/SCA/LLM behavior, update Skylos rules/docs/CI, benchmark analyzer behavior, or change this repository safely.
Skill Claude CodeCodex
Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks. Use when a dropped-external-methods.yaml needs classification for dropped method type.
Skill Claude CodeCodex
Author and verify an OpenTaint rule. Use whenever a rule creation is needed.
Skill Claude CodeCodex
Create an OpenTaint test project with positive/negative samples for verifying a rule or approximation. Use when a rule or approximation needs a test project to check against.
Skill Claude CodeCodexCursor
Prepare and commit code changes with full verification, pre-commit checks, and tests. Runs verification skill, fixes issues using TDD, executes all test suites, and creates atomic commits. Use when ready to commit changes, before committing, or when asked to prepare a commit.
Skill Claude CodeCodexCursor
Start an implementation task with proper planning, TDD workflow, and session hand-off. Use when beginning work on a Jira issue, starting a new feature, or resuming implementation work. Triggers on phrases like "start task", "begin implementation", "work on issue", or "implement feature".
Skill Claude CodeCodexCursor
Deep verification of code changes before committing. Traces code paths, detects semantic changes, identifies code smells and security issues. Reads GitHub PR reviews to propose implementation decisions. Use before commits, after implementation, or when asked to verify/review changes.
Skill Claude CodeCodex
Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity…
Skill Claude CodeCodex
This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key manipulation", "response caching", or needs to find cache-related vulnerabilities during whitebox security review.
Skill Claude CodeCodex
This skill should be used when the user is auditing a "polyglot monorepo", "multi-language codebase", "microservices with different languages", "Go + Python + TypeScript", or any codebase with services written in different programming languages. Provides strategies for cross-service security analysis and unified…
Skill Claude CodeCodex
This skill should be used when the user asks about "API security", "OWASP API Top 10", "BOLA", "broken object level authorization", "API authentication", "mass assignment", "GraphQL security", "gRPC security", "rate limiting", "API abuse", "REST API vulnerabilities", or needs to identify API-specific security issues…
DevSwat-ResonantGenesis/RG_IDE
Skill Claude CodeCodex
Launch and automate VS Code (Code OSS) using agent-browser via Chrome DevTools Protocol. Use when you need to interact with the VS Code UI, automate the chat panel, test UI features, or take screenshots of VS Code. Triggers include 'automate VS Code', 'interact with chat', 'test the UI', 'take a screenshot', 'launch…
DevSwat-ResonantGenesis/RG_IDE
Skill Claude CodeCodex
Primary accessibility skill for VS Code. REQUIRED for new feature and contribution work, and also applies to updates of existing UI. Covers accessibility help dialogs, accessible views, verbosity settings, signals, ARIA announcements, keyboard navigation, and ARIA labels/roles.
DevSwat-ResonantGenesis/RG_IDE
Skill Claude CodeCodex
Agent Sessions window architecture — covers the sessions-first app, layering, folder structure, chat widget, menus, contributions, entry points, and development guidelines. Use when implementing features or fixing issues in the Agent Sessions window.
Skill Claude CodeCodex
Elite manual security code review skill for deep, adversarial vulnerability hunting and exploit-chain discovery. Trigger when the user asks to: "do a deep security audit", "manual code review", "find exploit chains", "hunt for logic bugs", "red-team this codebase", "do an offensive security review", "review this like…
Skill Claude CodeCodex
Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP…
Skill Claude CodeCodex
Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code".…
Onome-AJ/security-sweep-plugin
Skill Claude CodeCodex
Scan codebase for security vulnerabilities, hardcoded secrets, injection flaws, misconfigurations, and attack surfaces. Use when user wants a security audit, vulnerability scan, or to find security issues.
Skill Claude CodeCodex
Multi-agent deep security audit — 6 expert personas (pentester, architect, code auditor, supply chain, data privacy, forensics) + CISO synthesis + optional fix implementation.
ch0ks/hackarandas-claude-toolbelt
Skill Claude CodeCodex
Full security code review with Semgrep Pro scan, taint analysis, CWE mapping, OWASP Top 10 coverage, and generation of a formal Security Code Review Report saved to /security-review/ in the repository root. Use when reviewing code for vulnerabilities, auditing a file for security issues, or before merging…