access
649Skill Claude Code
Manage WeChat channel access — edit allowlists and set DM policy. Use when the user asks to add/remove users, check who's allowed, or change policy.
not rated 6 today A 34 tokens
original MIT
TabletopExercise
650Skill Claude CodeCodex needs its repo
Comprehensive cybersecurity tabletop exercise design and facilitation framework. USE WHEN designing incident response scenarios, creating executive or technical tabletops, generating atomics for exercise runners, identifying missing SOPs/playbooks, or evaluating organizational preparedness. Includes threat model…
not rated 6 25d ago A 64 tokens
original MIT
qa-e2e-security
651Skill Codex needs its repo
Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy…
not rated 6 2d ago A SkillSpector: warn 116 tokens
original Apache-2.0
Skill Codex
A workflow for reconstructing calculations in web JavaScript from their final outputs, such as request parameters, cookies, headers, or WebSocket messages. It covers signatures, encryption, verification challenges, WebAssembly, and heavily obfuscated code.
not rated 6
+1 yesterday A 226 tokens
copy · 100% MIT
wtf-approve
653Skill Claude CodeCodex
Use when presenting shell commands or tool calls for user approval. Adds a human-readable explanation of intent, scope, and risk before the approval prompt.
not rated 6 5mo ago C ✓ AI review 34 tokens
original MIT
sentinela
654Skill Claude CodeCodex
Realiza uma auditoria de segurança completa em um projeto de código (web, API, backend, mobile etc), cobrindo OWASP Top 10 e CWE, dependências desatualizadas com CVEs, segredos expostos (incluindo histórico do git), CORS, TLS/HSTS, rate limiting, WAF, autenticação e cookies, controle de acesso, exposição excessiva de…
not rated 6 12d ago A 219 tokens
envskill
655Skill Claude CodeCodex
Use when a command needs API keys or environment secrets. Inject only named variables through envskill without reading or printing values.
not rated 6
+1 16d ago A 27 tokens
original MIT
secure-browser
656Skill Claude CodeCodex
Fill stored secrets (passwords, card numbers, API keys) into web pages through the secure-browser MCP server without ever seeing the secret values. Use when a task needs a login, checkout, payment form, or any credential entered into a website and the credentials live in a secret store rather than in the conversation.
not rated 6 8d ago A 66 tokens
scan-site
657Skill Claude CodeCodex
Full site triage workflow: init → crawl → classify → security audit → synthesize → generate project → KCP manifest → report. Use when triaging a new website end-to-end, re-running a scan, or debugging pipeline failures.
not rated 6
+1 today A 51 tokens
agent-workflow
658Skill Claude CodeCodex
Use when an agent must decide whether to proceed autonomously, ask for clarification, request approval, or select an appropriate verification scope for a coding or documentation task.
not rated 6
+1
changed today A 35 tokens
Skill Claude CodeCodex
CVE vulnerability lookup via NIST NVD, CISA KEV, EPSS scores, and MITRE ATT&CK. 7 tools for real-time cybersecurity intelligence.
not rated 5 5mo ago A 41 tokens
original MIT
api-scam-hunter
660Skill Claude CodeCodex
Detects whether a purchased AI API key/endpoint (Claude/Anthropic, OpenAI, etc.) — often bought cheap from a reseller or marketplace like GamsGo — is actually a man-in-the-middle proxy that intercepts, rewrites or degrades traffic. Trigger when the user says things like "I bought a third-party API key", "is this…
not rated 5 2mo ago A 167 tokens
original MIT
1password
661kcmadden/claude-code-1password-skill
Skill Claude CodeCodex
Integrate 1Password secrets management into Claude Code workflows. Use when the user wants to: store API keys or credentials in 1Password, read secrets from 1Password into scripts or config, set up .env files using 1Password secret references, rotate or update credentials, manage developer secrets across projects, use…
not rated 5 1mo ago A 155 tokens
original MIT
Skill Claude Code
Use when scoping allow/ask rules for a command family (kubectl, oc, terraform, aws, gcloud, docker, etc.) to one repository so routine invocations stop prompting only inside that repo. Triggers include "allow kubectl in this repo", "stop asking about X commands", "add longline rules for this project", "allowlist…
not rated 5 1mo ago B 102 tokens
original MIT
hardening
663Cholulaa/claude-code-hardening-skill
Skill Claude Code
Complete security hardening of a Linux server based on CIS Benchmarks, NIST 800-123, and ANSSI BP-028. Smart service discovery to avoid disruption. 4 hardening levels (minimal/standard/enhanced/paranoid). Installs open-source security tools, hardens SSH/kernel/firewall/systemd/permissions, runs all scans, generates a…
not rated 5 5mo ago B 80 tokens
original MIT
Newmcpe/ida-reverse-engineering-skill
Skill Claude CodeCodex
Drive IDA Pro through the IDA Pro MCP like a senior reverse engineer: don't just narrate decompiler output, transform the database. Use this whenever the user is reverse engineering, analyzing malware, working a crackme or CTF, or doing binary/firmware analysis with IDA Pro over an MCP connection (mrexodia/ida-pro-mcp…
not rated 5 3mo ago A 243 tokens
WTFPL
agent-security
665olanokhin/agent-security-skill
Skill Codex
Use when reviewing or writing LLM, RAG, MCP, tool, or agent code for OWASP-aligned security issues; triggered by "owasp my code", "owasp this PR", AI security review, PR review, or changes to AI system code.
not rated 5 2mo ago A 57 tokens
original MIT
ch0ks/hackarandas-claude-toolbelt
Skill Claude Code
Triage security findings from Semgrep Pro and Claude security-code-review using IaC files as deployment context (Terraform, Kubernetes, Docker Compose, CloudFormation, Azure Pipelines). Detects whichever IaC files are present, extracts deployment facts, scores each finding with CVSS 4.0 with per-vector justification…
not rated 5 4mo ago A 168 tokens
original MIT
secure-flow
667Skill Claude CodeCodex
A comprehensive security skill that integrates with Secure Flow to help AI coding agents write secure code, perform security reviews, and implement security best practices. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
not rated 5 9mo ago A 51 tokens
srs-domain-recon
668MrCl0wnLab/Skill-SimpleReconSubdomain
Skill Claude CodeCodex
Coleta o máximo de informação (recon/OSINT) sobre um ou mais domínios usando a ferramenta local SimpleReconSubdomain, entregando a saída em JSON por domínio. Use SEMPRE que o usuário quiser investigar um domínio do ponto de vista de segurança — mesmo que diga só "investiga o domínio X" ou cole uma lista de domínios.…
not rated 5 2mo ago A 227 tokens
goingli0324/web-security-reviewer
Skill Claude CodeCodex
A defensive review of web application code for security weaknesses, data-leak risks, performance risks, and code-quality problems. It covers Google Apps Script, browser code, and server APIs written in languages such as Node, Python, or PHP.
not rated 5 1mo ago A 441 tokens
original MIT
audit
670Skill Claude CodeCodex
Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".
not rated 5 2mo ago A 51 tokens
original MIT
TheSethRose/Vulnerability-Scanning
Skill Claude CodeCodex
Local vulnerability scans: dependencies, secrets, GitHub Actions, SAST, SBOM, package intake, cron/predeploy.
not rated 5 3mo ago A 30 tokens
original MIT
Skill Claude CodeCodex
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run…
not rated 5 today A SkillSpector: warn 97 tokens
original CC0-1.0
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: