184 tagged static-analysis, measured the same way as everything else here.
Browse within: agent-security 73supply-chain-security 73formal-verification 72cli 53graph-database 39graphs 39vscode-extension 39reverse-engineering 37malware-analysis 25dfir 23malware 20mcp-server 20pdfid 19code-quality 16
Skill Claude CodeCodex
A procedure for auditing Java archive files for security problems using evidence stored in SQLite. A Java archive, or JAR, is a packaged file containing Java code and resources.
sssmmmwww/wxmini-security-audit
Skill Claude CodeCodex
A complete static security-audit workflow for WeChat Mini Programs, using several specialised agents and preliminary scripts.
Skill Claude CodeCodex ✓ vendor
Remediate a send/send call that reaches a private method, restoring a real public seam instead of bypassing visibility. Use when send is being used to invoke private functionality in a class.
Skill Claude CodeCodex
Transform a feature idea into an annotated story using a Domain Sketch or Constrained Option Tree. Use when asked to brainstorm, explore, or shape a feature before implementation.
Dicklesworthstone/ultimate_bug_scanner
Skill Claude CodeCodex
Ultimate Bug Scanner - Pre-commit static analysis for AI coding workflows. 13 languages, including bounded PHP request-flow analysis, with language-specific detection categories and native or ast-grep analysis. The AI agent's quality gate.
Skill Codex
Research external APIs and SDKs before coding. Identifies every external component in a requirements file, browses official sources, and produces a structured handoff report with facts, risks, and answered questions.
Skill Claude CodeCodex
Run prominent Agents Shipgate flows when a change touches what an AI agent can do: shipgate check, agents-shipgate verify, or shipgate audit --host. Use after adding or modifying MCP servers or tools, tool/function definitions (@tool, @functiontool), OpenAPI specs that describe agent tools, agent prompts, permission…
Skill Claude CodeCodex
Analyze the impact of changing or deleting a Markdown document by leveraging contextlint's Context Graph. Use this skill whenever the user asks "what breaks if I change X?", "what depends on this doc?", "is it safe to delete this file?", or wants to plan a refactor / understand cross-doc dependencies — even if they…
anthroos/claude-code-review-skill
Skill Claude CodeCodex
AI code review for PR or local changes. 280+ checks across security, architecture, performance, testing, and code quality. Posts findings as GitHub PR comments with confidence scores.
advanced-security/codeql-development-mcp-server
Skill Claude CodeCodex
This is an example SKILL.md file demonstrating how to add a team-specific skill via the --customizations-dir overlay feature.
Skill Claude Code
Use when the user wants to rename, extract, split, move, or restructure code safely. Examples: "Rename this function", "Extract this into a module", "Refactor this class", "Move this to a separate file".
Skill Claude CodeCodex
Analyze codebases using a graph database instead of reading source files. Use when understanding code architecture, finding functions or call patterns, tracing data flow, checking dependencies, or answering "where is X used?" questions. Grafema builds a queryable code graph from static analysis — prefer querying the…
Skill Claude CodeCodex
Set up svelte-vitals in a SvelteKit project: inspect what the project already uses, derive a svelte-vitals.config from its markuplint / eslint-plugin-check-file config and its actual directory conventions, measure each candidate rule before adopting it, and hand the remaining targets to svelte-vitals install. Use when…
Skill Claude CodeCodex
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
Skill Claude CodeCodex
Teaches the agent to use the state-memory-mcp MCP server to track workflow state, tasks, decisions, blockers, artifacts, plans, milestones, and their semantic relationships in a persistent graph database.
Skill Claude CodeCodex
Scan AI agent skills, MCP servers, and plugins for security vulnerabilities. Use when: user asks to check a skill/plugin for safety, audit security, scan for backdoors/data exfiltration/credential leaks, or evaluate trust of a third-party skill. Triggers: "is this skill safe", "scan for security issues", "audit this…
Vincent-crypto-coder/tech-debt-management-skill
Skill Claude CodeCodex
A skill for systematically finding, assessing, and paying down technical debt—the future cost created by quick fixes or neglected maintenance.
Skill Claude CodeCodex
Turn a large codebase into a short, ranked reading list of security-relevant code paths worth a human researcher's time, using the flyto-indexer MCP tools. Use when asked to find, prioritize, or triage potential vulnerabilities / taint flows / attack surface in a repository indexed (or indexable) by flyto-indexer …
Skill Claude CodeCodex
Run deterministic SwiftUI and multi-module analysis after editing Swift code, before review, or when an AI-generated change may have introduced performance, task-lifetime, or module-boundary risks.
Skill Claude CodeCodex
Analyze change impact using Ontoly dependency and dependent traversal. Use when asked what breaks if a symbol, service, route, package, or repository node changes or is removed.
Skill Claude CodeCodex
Query evidence-backed historical bugs before risky code changes and verify patches before completion.
tetracoralla/context-surface-analyzer
Skill Codex
Use Context Surface Analyzer when the user supplies one explicit Agent tool-catalog snapshot to measure or two ordered snapshots to compare, especially for exact catalog bytes, tool and schema counts, name collisions, exact duplicate schemas, declared budget checks, or fully labeled caller-supplied token measurements.…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: