Skills

W

webflow-webhooks

hookdeck / webhook-skills

Receive and verify Webflow webhooks. Use when setting up Webflow webhook handlers, debugging signature verification, or handling Webflow events like form_submission, site_publish, ecomm_new_order, or collection item changes.

B

better-auth-setup

andrelandgraf / fullstackrecipes

Add user authentication using Better Auth with Drizzle ORM and Neon Postgres. Base setup with email/password authentication.

Expert-level code review focusing on quality, security, performance, and maintainability. Use this skill for conducting thorough code reviews, identifying issues, and providing constructive feedback.

No description yet

M

maxmind-geoip2

membranedev / application-skills

MaxMind GeoIP2 integration. Manage data, records, and automate workflows. Use when the user wants to interact with MaxMind GeoIP2 data.

P

powershell-security

josiahsiegel / claude-plugin-marketplace

Modern PowerShell security practices for 2025 — SecretManagement, JEA, WDAC, credential protection. PROACTIVELY activate for: (1) Microsoft.PowerShell.SecretManagement and SecretStore for credential storage, (2) Just Enough Administration (JEA) endpoints, (3) Windows Defender Application Control (WDAC) for PowerShell, (4) credential protection (PSCredential, SecureString, DPAPI), (5) module signing and Authenticode signatures, (6) ConstrainedLanguage mode, (7) audit logging (transcription, ScriptBlock logging, module logging), (8) AMSI integration, (9) AppLocker rules for PowerShell, (10) supply-chain security (PSGallery trust, package hash verification). Provides: SecretManagement setup, JEA configuration, WDAC policy templates, signing workflow, and audit-logging configuration.

S

sonarcloud-analysis

harshanandak / forge

SonarCloud deep dive via its REST API: pull open issues (bugs, vulnerabilities, code smells), coverage/duplication metrics, quality-gate pass/fail with failed thresholds, security hotspots, and measure/analysis history for a whole project, branch, or PR, then return a ranked summary. Use whenever the user names SonarCloud or asks about code-quality metrics, technical debt, a red/failing quality gate, or static-analysis vulnerabilities/hotspots — e.g. 'why is the SonarCloud gate failing on this PR' or 'pull every BLOCKER vulnerability with file and line'. NOT for: the thin `/sonarcloud <query> <project>` slash command for a quick lookup (sibling 'sonarcloud'); replying to/resolving PR review threads across Greptile, CodeRabbit, or GitHub Actions ('review'); running local lint/type-check/test/security scans pre-ship ('validate'); implementing or patching a flagged issue ('dev'); or an external market/competitor report on SonarSource or DevSecOps vendors ('parallel-deep-research').

S

supabase-admin

curiositech / some_claude_skills

Supabase administration, RLS policies, migrations, and schema design. Use for database architecture, Row Level Security, performance tuning, auth integration. Activate on “Supabase”, “RLS”,

U

understanding-tauri-ipc

dchuk / claude-code-tauri-skills

Teaches the assistant about Tauri IPC (Inter-Process Communication) patterns, including brownfield and isolation approaches for secure message passing between the frontend and Rust backend

B

building-soc-escalation-matrix

mukul975 / anthropic-cybersecurity-skills

Build a structured SOC escalation matrix defining severity tiers, response

B

building-vulnerability-exception-tracking-system

mukul975 / anthropic-cybersecurity-skills

Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance

H

huawei-cloud-ecs-passwordless-login

huaweicloud / huaweicloud-skills

Configure passwordless SSH login to Huawei Cloud ECS instances using COC (Cloud Operations Center). Automates IAM agency authorization, SSH key pair generation, COC script deployment to one or many target ECS instances (batch), SSH connection testing, and automatic security cleanup after 60 seconds (removing keys from both local and remote). 触发词: 免密登录, COC SSH, ECS key login, SSH key deployment, passwordless SSH

J

jfrog

jfrog / jfrog-skills

Interact with the JFrog Platform via the JFrog CLI, JFrog MCP server, and REST/GraphQL APIs. Use this skill when the user wants to manage Artifactory repositories, upload or download artifacts, manage builds, configure permissions, manage users and groups, work with access tokens, configure JFrog CLI servers, search artifacts, manage properties, set up replication, manage JFrog Projects, run security audits or scans, look up CVE details, query exposures scan results from JFrog Advanced Security, manage release bundles and lifecycle operations, aggregate or export platform data, or perform any JFrog Platform administration task. Also use when the user mentions jf, jfrog, artifactory, xray, distribution, evidence, apptrust, onemodel, graphql, workers, mission control, curation, advanced security, exposures, sast, or any JFrog product name. Do NOT use this skill to install, add, remove, list, or manage MCP servers.

K

kanidm-expert

martinholovsky / claude-skills-generator

Expert in Kanidm modern identity management system specializing in user/group management, OAuth2/OIDC, LDAP, RADIUS, SSH key management, WebAuthn, and MFA. Deep expertise in secure authentication flows, credential policies, access control, and platform integrations. Use when implementing identity management, SSO, authentication systems, or securing access to infrastructure

P

pci-compliance

sickn33 / agentic-awesome-skills

Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification

A

authentication-patterns

rohitg00 / awesome-claude-code-toolkit

Authentication and authorization patterns including OAuth2, JWT, RBAC, session management, and PKCE flows

B

better-auth-protected-routes

andrelandgraf / fullstackrecipes

Add server-side route protection to enforce authentication on specific pages while keeping others public

C

cognito

itsmostafa / aws-agent-skills

AWS Cognito user authentication and authorization service. Use when setting up user pools, configuring identity pools, implementing OAuth flows, managing user attributes, or integrating with social identity providers.

D

deobfuscating-javascript-malware

mukul975 / anthropic-cybersecurity-skills

Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.

D

dev-toolbar-review

supabase / supabase

Safety rules for the dev toolbar, PostHog client, and feature flags. Use

A

adjudicate-regression

trailofbits / skills

Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion

A

android-reverse-engineering

simoneavogadro / android-reverse-engineering-skill

Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows.

Expert-level security auditing, compliance, code review, and vulnerability assessment. Use when the user mentions compliance, security review, code review, vulnerability assessment, SOC 2, or GDPR, or when the task involves Audit Types, Audit Frameworks, Audit Process, or Authentication Review.

A

authentication-authorization-clerk

harperaa / secure-claude-skills

Implement secure authentication and authorization using Clerk. Use this skill when you need to authenticate users, protect routes, check permissions, implement subscription-based access control, or integrate Clerk with your application. Triggers include "authentication", "auth", "authorization", "Clerk", "protect route", "check user", "sign in", "session", "permissions", "subscription access".

B

birdeye

starchild-ai-agent / official-skills

Token and wallet analytics on Solana plus EVM: security checks, holders, networth. Use when vetting a token, scanning a wallet, or checking honeypot risk (e.g. is $X safe, top holders, this wallet's portfolio).

C

clawsec-nanoclaw

prompt-security / clawsec

Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot

C

cloud-containers

transilienceai / communitytools

Cloud and container security testing — AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

F

fix-review

sickn33 / agentic-awesome-skills

Verify that fix commits address audit findings without introducing new bugs

G

gitlab-code-review

dedalus-erp-pas / foundation-skills

Conduct comprehensive code reviews of GitLab merge requests, analyzing code quality, security, performance, and best practices. Use when the user says “review” or “code review,” or asks to review merge requests or analyze branch changes before merging

M

mcp-server-review

owasp / secure-agent-playbook

Security review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.

A

agentforce-secure

salesforceairesearch / agentforce-adlc

Run OWASP LLM Top 10 security assessments against live Agentforce agents. TRIGGER when: user asks for security testing, OWASP scan, red-teaming, penetration testing, security grade, vulnerability assessment, prompt injection test, data leakage test, excessive agency test, security posture check, or hardening recommendations. DO NOT TRIGGER when: user runs functional smoke tests or batch tests (use agentforce-test); performs static safety review of .agent file content (use agentforce-generate Section 15); analyzes production session traces (use agentforce-observe); writes or modifies .agent files.

B

browser-tools

yonatangross / orchestkit

Safety rules for the upstream agent-browser skill (scraping ethics, authentication, request pacing, local URLs). URL policy is the Claude Code sandbox's responsibility when the operator enables it. Use for browser automation.

B

building-threat-intelligence-platform

mukul975 / anthropic-cybersecurity-skills

Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.

C

coordination

transilienceai / communitytools

Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.

D

dfir

transilienceai / communitytools

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files

P

Privilege Escalation Methods

davila7 / claude-code-templates

This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.

S

SMTP Penetration Testing

davila7 / claude-code-templates

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

A

angular-guards

oguzhan18 / angular-ecosystem-skills

ALWAYS use when working with Angular Route Guards, CanActivate, CanDeactivate, CanLoad, or route protection in Angular applications.

C

citadel-id

membranedev / application-skills

Citadel ID integration. Manage data and records, and automate workflows. Use when the user wants to interact with Citadel ID data.

D

deal-with-security-advisory

paperclipai / paperclip

Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.

M

mcp-patterns

yonatangross / orchestkit

MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, choosing a transport, adding OAuth authentication, wiring MCP Apps UI with @mcp-ui, hardening MCP security, or debugging MCP integrations.

O

offensive-iot

snailsploit / claude-red

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.

P

proxyman-certificates-recovery

proxymanapp / proxyman-skill.md

Safely manage Proxyman certificates and destructive recovery workflows on macOS. Use for generated or custom root certificates, custom server or client certificates, Copy Debug Info, Debug Mode, Reset Network Proxy, or Factory Reset. Do not use for ordinary display preferences or device-specific CA setup.

S

safe-sql-execution

supabase / supabase

Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database—even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint that builds/returns SQL for database objects (tables, views, functions, DB triggers, indexes, RLS policies); interpolating a schema/table/column/search/route-param value into SQL text; storing, fetching, or re-running SQL that round-trips from the database (a policy's definition, a function/view definition, a snippet's saved content); and any "Run"/"Apply"/"Execute" action that sends SQL to a project's database (SQL editor run-selection, policy editor apply, snippet runner). Load this BEFORE writing such code, not only when reviewing a finished diff. Skip only for changes that never touch SQL text or execution—styling, unrelated data hooks, non-SQL form validation, or UI layout work.

S

soroban

stellar / stellar-dev-skill

Stellar smart contract development (Rust, soroban-sdk). Entry point with project setup, contract anatomy, and build/deploy workflow, routing to three companion files in this directory — development.md (storage, auth, cross-contract calls, events, errors, upgrades, factories, troubleshooting), testing.md (unit, fuzz, property, fork, mutation, integration), and security.md (vulnerability classes, checklists, tooling, audits). Use when writing, testing, securing, or shipping Stellar smart contracts (formerly branded Soroban).

A

azure-web-application-firewall

microsoftdocs / agent-skills

Expert knowledge for Azure Web Application Firewall development, including best practices, decision-making, limits and quotas, security, configuration, integrations and coding patterns, and deployment. Use when configuring Front Door/App Gateway WAF rules, rate limits, bot challenges, Sentinel logging, IaC deployments, or other Azure Web Application Firewall development tasks. Not for Azure Application Gateway (use azure-application-gateway), Azure Front Door (use azure-front-door), Azure Firewall (use azure-firewall), or Azure DDoS Protection (use azure-ddos-protection).

B

better-auth-emails

andrelandgraf / fullstackrecipes

Add email verification, password reset, and account management emails to Better Auth using Resend.

B

better-auth-profile

andrelandgraf / fullstackrecipes

Add a complete account settings page with profile editing, password changes, email updates, session management, and account deletion.

I

implementing-devsecops-security-scanning

mukul975 / anthropic-cybersecurity-skills

'Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for

I

implementing-semgrep-for-custom-sast-rules

mukul975 / anthropic-cybersecurity-skills

Write custom Semgrep SAST rules in YAML to detect application-specific

M

maxmind-minfraud

membranedev / application-skills

MaxMind minFraud integration. Manage data, records, and automate workflows. Use when the user wants to interact with MaxMind minFraud data.

O

offensive-active-directory

snailsploit / claude-red

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

S

soc2-prep

shawnpang / startup-founder-skills

When the user needs to prepare for SOC 2, build a compliance roadmap, assess security posture, quantify security risk, or says “we need SOC 2”, “security audit”, “compliance”, “enterprise customer wants SOC 2”, “CISO advice”

S

system

transilienceai / communitytools

System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development

H

huawei-cloud-swr-image-governance

huaweicloud / huaweicloud-skills

Huawei Cloud SWR (Software Repository for Container) image governance skill using hcloud CLI. Use when the user wants to: (1) manage SWR namespace permissions—grant/query/modify/revoke; (2) manage repository permissions—grant/query/modify/revoke; (3) manage image retention rules—create/list/update/delete; (4) manage shared download domains—create/list/update/delete; (5) manage image sharing—list shared repos/query feature gates; (6) check SWR agency status and create agency delegation; (7) list repo accessories and references. Trigger: user mentions “SWR image governance,” “SWR 镜像治理,” “SWR 权限管理,” “SWR retention,” “SWR 保留策略,” “SWR 共享域名,” “SWR 共享镜像,” “SWR 委托,” “SWR agency,” “namespace permissions,” “repository permissions,” “镜像权限,” “保留规则,” “共享下载,” or “镜像分享.”

O

offensive-bluetooth-ble

snailsploit / claude-red

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.

O

offensive-mobile

snailsploit / claude-red

Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.

P

payment-security-clerk-billing-stripe

harperaa / secure-claude-skills

Implement secure payments using Clerk Billing and Stripe without ever touching card data. Use this skill when you need to set up subscription payments, handle webhooks, implement payment gating, understand PCI-DSS compliance, or integrate Stripe Checkout. Triggers include "payment", "Stripe", "Clerk Billing", "subscription", "PCI-DSS", "credit card", "payment security", "checkout", "webhook", "billing".

S

signing

aibtcdev / skills

Message signing and verification — SIP-018 structured Clarity data signing (on-chain verifiable), Stacks plain-text message signing (SIWS-compatible), Bitcoin message signing (BIP-137 for legacy/wrapped-SegWit, BIP-322 for native SegWit bc1q and Taproot bc1p), BIP-340 Schnorr signing for Taproot multisig, and Nostr event signing using NIP-06 key derivation. All signing requires an unlocked wallet; hash and verify operations do not

A

azure-ddos-protection

microsoftdocs / agent-skills

Expert knowledge for Azure DDoS Protection development including troubleshooting, best practices, decision making, architecture & design patterns, security, configuration, and integrations & coding patterns. Use when enabling DDoS IP/Network Protection, tuning policies, analyzing logs/metrics, or integrating NVAs and Azure Policy, and other Azure DDos Protection related development tasks. Not for Azure Firewall (use azure-firewall), Azure Firewall Manager (use azure-firewall-manager), Azure Web Application Firewall (use azure-web-application-firewall), Azure Virtual Network (use azure-virtual-network)