Security skills

xiaowu89/skill-function

Skill Claude Code

An image-safety review skill that compresses local images and sends them to an API to check for sexual, political, and violent content.

ensingm2/AI-threat-modeling-rulesets

Skill Claude Code

Adversarial validation for all stages. Detects fabrications, identifies analytical flaws, challenges assumptions, makes approval decisions. Seeks problems rather than confirming quality. Does NOT complete deliverables or fix issues.

adamsjack711-ux/pkgxray

Skill Claude CodeCodex

Audit supplied evidence for AI coding-agent extensions, Codex plugins, Claude Code extensions, and MCP servers using concrete supply-chain security indicators.

harshith-vaddiparthy/outskill-owasp-security-review

Skill Claude CodeCodex

Launch-gate security review for the Vibe CRM Security Lab (NorthStar CRM) — a Next.js 16 App Router + Supabase + OpenAI app. Audits the codebase against the OWASP Top 10 2025, reports each issue in plain language with the exact file, severity, and the concrete fix (using the repo's own /api/fixed/ routes and…

guelfoweb/malware-analysis-static

Skill Claude CodeCodex

Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization…

Seldaek/zizmorify

Skill Claude CodeCodex

Add zizmor (GitHub Actions security analysis) CI to a repository and fix every finding it surfaces. Use when asked to "add zizmor", harden a repo's GitHub Actions workflows, pin actions to SHAs, or make workflows pass a security audit. Adds a zizmor workflow + a dependabot config (on the default branch; other branches…

XiangXtreme/yakit-hotpatch-skill

Skill Codex

Use when creating, fixing, or reviewing Yakit Web Fuzzer hotload or Yakit MITM hotpatch scripts in Yaklang. Covers custom fuzztag functions, beforeRequest/afterRequest hooks, mirrorHTTPFlow extraction, retry/failure/mock handlers, encrypted mini-program traffic decrypt-edit-reencrypt, bizContent-style JSON wrappers…

lucasviola/specwiki

Skill Claude CodeCodex

Audit Parcel Path changes for PII leaks in logs and error messages. Use before opening a PR, after adding verbose logging, or when touching carrier responses.

animaresearch/skills

Skill Claude CodeCodex

Pre-share leak scanner for Claude Code skills (or any folder). Scans BEFORE you publish for secrets (API keys, tokens, private keys, .env values, high-entropy strings), PII (emails/phones), local machine paths (C:\Users\ , /home/ , /Users/ , UNC, internal hostnames), and client/proper-noun names from a LOCAL private…

taoq-ai/ziran

Skill Claude CodeCodex

ZIRAN is an open-source security testing framework for AI agents. It discovers dangerous tool chain compositions via knowledge graph analysis, detects execution-level side effects (not just text output), and runs multi-phase trust exploitation campaigns that model real attacker behavior.

austintgriffith/evm-audit-skills

Skill Claude CodeCodex

Master index for EVM smart contract security audit skills. Load this FIRST for every audit to determine which specialized skills to load. Contains routing table and audit methodology.

ag2ai/ag2-skills

Skill Claude CodeCodex

Govern an AG2 multi-agent network — identity (Passport, Resume), per-agent Rule with two top-level blocks access (AccessBlock) and limits (LimitsBlock, which nests RateBlock + InboxBlock), the swappable HubArbiter / RuleBasedArbiter access-&-routing seam, AuthAdapter / AuthRegistry registration, channel-level…

sso-ss/vibe-ship-it

Skill Claude CodeCodex

Adds user authentication. Triggers: 'login', 'log in', 'sign in', 'sign up', 'register', 'authentication', 'auth', 'only I can see', 'protect this page', 'private page', 'admin area', 'user accounts', 'members only', 'password protect'.

muchiny/bridge-mcp

Skill Claude Code

This skill should be used when the user asks to "run a security scan", "check for vulnerabilities", "audit compliance", "check certificate expiry", "scan open ports", or mentions security reviews, CIS benchmarks, or compliance assessments on remote servers.

JayRHa/AgentSkills

Skill Claude CodeCodex

Generates and hardens production nginx configurations for reverse proxying with TLS termination, HTTP/2, response caching, rate limiting, gzip/brotli compression, and security headers. Use this skill when the user asks to "set up nginx as a reverse proxy", "add TLS/SSL to nginx", "configure nginx caching or rate…

mars-tw/ai-instruction-detox

Skill Claude CodeCodex

An auditing and organizing skill for an AI project's instructions, rules, skills, and supporting context. It finds duplication, conflicts, outdated information, and prompt injection, then creates reviewable, reversible change proposals or applies approved changes.

phinn/KinetAios

Skill Claude CodeCodex

A security-audit method for reviewing code and systems for confirmed vulnerabilities, attack paths, and failures at trust boundaries. It uses separate discovery and verification, and ties severity to real-world impact.

aws-samples/sample-pellier-agentic-search-apg

Skill Claude CodeCodex ✓ vendor

Review an agent tool that reads or writes PostgreSQL. Trace its permissions, caller identity, SQL and retry behavior; return source-backed findings and a verification plan that separates code evidence from tested behavior.

eugenepyvovarov/mcpbundler-agent-skills-marketplace

Skill Claude CodeCodex

Assess and enhance software projects for enterprise-grade security, quality, and automation. This skill should be used when evaluating projects for production readiness, implementing supply chain security (SLSA, signing, SBOMs), hardening CI/CD pipelines, establishing quality gates, reviewing code or PRs, writing…

mishahanin/heading-os

Skill Claude Code needs its repo

Second-opinion advisor. Default roster is Kimi k3 alongside Claude's own view; Gemini, Grok and ChatGPT are opt-in via --gemini / --grok / --chatgpt / --all. Two modes: independent (the models see the problem only, reason fresh) and critique (they stress-test a draft). Distinct from /deep-think (Claude reasoning…

vitormiziara/saas-security

Skill Claude CodeCodex

Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or…

SomeStay07/claude-doctor-skill

Skill Claude Code

Audits any project for security, test coverage, and Claude Code automation. 46 checks across 6 layers: secrets, CLAUDE.md, hooks, skills, agents, rules, MCP, CI, memory. Adaptive scoring — auto-detects project maturity (Starter/Growing/Mature/Pro). Diagnoses gaps, prescribes project-specific fixes, applies them.…

Luxuzhou/skill-monitor-plugin

Skill Claude Code

A management tool for installed Claude Code skills, which are reusable instructions that extend an AI coding assistant. It checks their security, cost, conflicts, usage, versions, and capability groupings.

lambert0529/skills

Skill Claude CodeCodex

A guide for adding JWT authentication to a Spring Boot application. JWT is a signed token used to identify a user between requests, while role-based access control limits what different users may do.