Security skills

xataio/nextjs-claude-code-starter

Skill Claude Code

Clone a production database with automatic PII anonymization.

Noorkhalel/saas-ai-skills

Skill Claude CodeCodex

Conduct a security-led audit of code, systems, APIs, infrastructure, dependencies, and AI workflows with threat modeling and exploitability-backed remediation. Use when security risk is the primary concern. Do not use for a generic code review, database design, or non-security debugging.

Sube-py/awesome-skills

Skill Codex

Install, update, secure, daemonize, expose through Cloudflare Tunnel, and enable speech input for the open-source Open Codex UI application. Use when a user asks to install or enable Open Codex UI, configure its login daemon, set its access password, install or manage the sherpa-onnx bilingual speech model…

pashki975/thm-claude-kit

Skill Claude Code

The core decision loop for driving any TryHackMe room. Use at the START of every room, whenever the user asks "what next", and whenever progress stalls. Teaches classify -> observe -> hypothesize -> test -> decide, so the approach is chosen from what the room is actually teaching rather than defaulting to…

smiladinov/claude-saas-readiness

Skill Claude CodeCodex

Audits any SaaS / web application codebase for production readiness and delivers a prioritized report covering security, scalability, reliability, performance, testing, observability, data, APIs, CI/CD, infrastructure, cost, and compliance. Use when the user asks to "make my project production-grade", wants a final…

ronalships/claude-devops-skill

Skill Claude CodeCodex

Opinionated production-grade DevOps defaults for Terraform, Kubernetes, CI/CD, Docker, cloud security, observability, cost, and disaster recovery. ALWAYS use when generating, reviewing, or modifying any infrastructure code, Kubernetes manifests (Deployment, Service, StatefulSet, Helm, Kustomize), Terraform (.tf…

Nordic-AI/production-readiness-skills

Skill Claude CodeCodex

Production readiness review for applications incorporating AI / ML — covering classical ML models, generative models, LLM-powered applications, RAG systems, and agentic workflows. Checks AI system inventory, EU AI Act classification, training data governance, model supply chain, evaluation harness, prompt injection…

elliottwaves-20/agent-guard

Skill Codex

Scan AI agent skills, plugins, and MCP servers for malicious code BEFORE installation — catches prompt injection, credential theft, data exfiltration, and backdoors. Skills and the static MCP source scan use NVIDIA SkillSpector (static patterns + taint tracking + YARA + live OSV.dev CVE lookup + LLM semantic analysis…

grcwarlock/compliance-as-code

Skill Claude Code

Use when the user asks about ISO/IEC 27001:2022 from an engineering perspective — building an ISMS that runs on systems and code rather than spreadsheets, instrumenting Annex A controls, designing risk registers as data, and producing evidence pipelines that hold up to a certification audit. Engineer-voice, not…

jorgealves/agent_skills

Skill Claude CodeCodex

Scans source code, configuration files, and git history for hardcoded credentials, API keys, and tokens. Use when auditing repositories for security leaks or ensuring sensitive data is not committed to version control.

scalekit-inc/skills

Skill Claude CodeCodex

Adds MCP OAuth so an agent can protect the user's MCP server. Use when the user wants MCP OAuth or to protect their MCP server. It does not add API keys or client credentials (that's add-api-auth) or expose AgentKit tools over MCP (that's expose-agentkit-mcp).

pedromneto97/custom-skills

Skill Claude Code

Cryptographic best practices for secure system design. Use when: choosing encryption algorithms, implementing password hashing, selecting key lengths, using secure random number generation, implementing digital signatures, designing TLS deployments, key management, or avoiding common cryptographic pitfalls.

lroolle/ihme-cli

Skill Claude CodeCodex

Manage iCloud Hide My Email addresses — list, create, edit, deactivate, export.

nanxiaoyao/network-huawei-skills

Skill Claude CodeCodex

This skill should be used when the user asks to configure or troubleshoot AAA (Authentication / Authorization / Accounting) on Huawei S / CE / USG series devices — including 802.1X, MAC authentication, Portal authentication, RADIUS, HWTACACS (TACACS+), local authentication, authentication profiles, free-rule, NAC…

ski043/kinde-agent-skills

Skill Claude CodeCodex

Kinde authorization: designs, provisions, assigns, enforces, refreshes, and verifies permission-first RBAC for organizations. Use when designing roles or permissions; provisioning or assigning organization access; enforcing permission checks in APIs or application code; troubleshooting claims or stale access; or when…

download4you/n2-fieldops

Skill Codex

Reverse engineering of compiled, packed, virtualized, or obfuscated targets for authorized CTF challenges. Use when the task is to understand, decompile, disassemble, or unpack an unknown executable across ELF, PE, Mach-O, APK, WASM, firmware, bytecode, or custom-VM targets.

yu-iskw/skill-inspector

Skill Claude Code

Set up the development environment for the project. Use when starting work on the project, when dependencies are out of sync, or to fix environment setup failures.

yhny1001/dsh-security-audit

Skill Claude CodeCodex

A read-only security audit for DeepSeek Harness extensions, settings, dependencies, and runtime exposure. It looks for risks such as exposed secrets, unsafe file mounts, data leaving the system, persistence, and malware indicators.

Pwnote/skills

Skill Claude CodeCodex

Create or validate a pwnote engagement import/export JSON file. Use when the user wants to generate, edit, or verify a pwnote engagement file for data transfer between pwnote instances. The file bundles an entire pentest engagement — metadata, notebook documents, code/host/credential blocks, findings with…

emekdahl/skills

Skill Claude CodeCodex

Battle-hardened senior engineer who reviews plans and code before they cause a 3 AM incident. Stress-tests architecture, catches data-pipeline fragility, flags security gaps, and calls out missing error handling, then signs off with a severity summary and grudging approval if earned. Use when reviewing new or existing…

Ljhhhhhh/user-facing-only-skill

Skill Codex

Keep finished deliverables limited to what their intended users need. Use when demo instructions, mock details, implementation rationale, temporary shortcuts, or superseded requirements might leak into user-facing pages, reports, exports, documentation, APIs, or CLI output. Do not use for general UX or code-quality…

Arnosdeus/agent-toolkit

Skill Claude CodeCodex

Review application changes for evidence-based security vulnerabilities and hardening opportunities across authentication, authorization, input handling, APIs, dependencies, and data protection.

kalt-sit/theseus

Skill Claude CodeCodex

Audit third-party agent skills for prompt injection, unsafe commands, downloads, permissions, and persistence before installation.

kanoniv/auth-action

Skill Claude Code

Cryptographic delegation for AI agents. Scope-confines what Claude Code can do in this session using Ed25519 delegation tokens. Every action is verified before execution and signed for the audit trail. Use when asked to "delegate", "restrict scope", "authorize", or "sudo mode".