Skills

P

pentest-config-hardening

jd-opensource / joysafeter

Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification.

P

pentest-evidence-structuring-report-synthesis

crtvrffnrt / skills

Evidence structuring and report synthesis for confirmed findings, severity ranking, remediation guidance, executive summaries, technical appendices, and unresolved evidence gaps. Hands off to live validation workflows when proof is incomplete.

P

pentest-race-conditions

jd-opensource / joysafeter

Concurrency exploitation — race conditions, TOCTOU vulnerabilities, and parallel request abuse in web applications.

P

performing-aws-privilege-escalation-assessment

mukul975 / anthropic-cybersecurity-skills

Performing authorized privilege escalation assessments in AWS environments

P

performing-log-analysis-for-forensic-investigation

mukul975 / anthropic-cybersecurity-skills

Collect, parse, and correlate system, application, and security logs

P

performing-purple-team-atomic-testing

mukul975 / anthropic-cybersecurity-skills

Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam

P

preflight

membranedev / application-skills

PreFlight integration. Manage data, records, and automate workflows. Use when the user wants to interact with PreFlight data.

P

privacy-notice-generator

borghei / claude-skills

Draft GDPR-compliant privacy notices for EU/EEA jurisdictions. Supports 6 notice types, 9 jurisdictions, multi-layer compliance verification. Use for privacy notice drafting, compliance checking, and jurisdiction mapping.

P

protocol-reverse-engineering

oimiragieo / agent-studio

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.

R

rust-service-security

lvtd-llc / skills

Use when adding, changing, testing, or reviewing security-sensitive Rust web service behavior, especially login flows, password hashing, credential checks, session cookies, flash messages, admin route protection, auth middleware, user enumeration defenses, or moving CPU-heavy password work off async executors.

S

scaled-access

membranedev / application-skills

Scaled Access integration. Manage data, records, and automate workflows. Use when the user wants to interact with Scaled Access data.

S

security-practices

miles990 / claude-software-skills

OWASP Top 10, authentication, and secure coding practices

T

tailscale

magnus919 / agent-skills

Deploy and manage the self-hosted Tailscale/Headscale ecosystem: a Headscale control server, tailscale clients, ACL policies, node lifecycle, subnet routing, DERP relays, backup/migration, and Tailworm security exposure triage. Use when the user mentions Tailscale, Headscale, tailnet, mesh VPN, WireGuard mesh, or self-hosted VPN infrastructure. Do not use this skill for unrelated requests; route to the nearest named specialist.

T

tauri-security-rules

oimiragieo / agent-studio

Security-related rules for Tauri application development.

T

terraform-patterns

borghei / claude-skills

This skill should be used when the user asks to "analyze Terraform modules", "scan IaC for security issues", "review Terraform configurations", "check infrastructure code for misconfigurations", or "audit cloud resources".

A

action-policy-coder

majesticlabs-dev / majestic-marketplace

Use proactively for authorization with ActionPolicy. Creates policies, scopes, and integrates with GraphQL/ActionCable. Preferred over Pundit for composable, cacheable authorization.

B

brazil-lgpd

mukul975 / privacy-data-protection-skills

Guides compliance with Brazil's Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018). Covers the 10 lawful bases under Art. 7, DPO appointment, ANPD enforcement, data subject rights under Arts. 17-22, and international transfer mechanisms. Keywords: LGPD, Brazil data protection, ANPD, lawful bases, data subject rights, international transfers.

B

bun-lockfile-update

laurigates / claude-plugins

Bun lockfile update (bun.lock): bun update, regeneration, security audits. Use when updating dependencies, resolving lockfile conflicts, or regenerating bun.lock.

C

container-security

julianobarbosa / claude-code-skills

Container image security scanning, Dockerfile hardening, and ACR image management. Use when scanning container images for vulnerabilities with Trivy, hardening Dockerfiles (pinning versions, non-root runtime, SSH config), importing images to Azure Container Registry to avoid Docker Hub rate limits, or analyzing CVE findings. Also trigger when the user mentions image security, vulnerability scanning, CVE remediation, container hardening, Trivy scan, Docker security, or ACR image import — even if they don't explicitly say "container security".

C

create-auth-skill

connorads / dotfiles

Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

C

crowdsec

magnus919 / agent-skills

Deploy, configure, and operate CrowdSec Security Engine, cscli, remediation components, acquisition pipelines, and AppSec WAF. Use for Linux or Docker installation, detection-to-blocking design, incident review, and safe changes. Do not use for generic firewall, Kubernetes, or reverse-proxy design; route those to the named platform skill and use this skill for CrowdSec integration.

D

detecting-insider-threat-behaviors

mukul975 / anthropic-cybersecurity-skills

Detect insider threat behavioral indicators including unusual data access,

D

dotenvx

mizchi / skills

Use when working with the `dotenvx` env-var management tool — encrypting .env files, juggling multiple environments (.env.production / .env.staging / .env.ci), committing encrypted secrets to git with `.env.vault` / `.env.keys` / `.env.encrypted`, or wiring dotenvx into GitHub Actions. Trigger on `.env.vault` / `.env.keys` / `dotenvx` commands or symptoms (env-var leak risk, env per-stage management, encrypted secrets workflow) even if the user does not say "dotenvx" by name.

E

email-and-password-best-practices

midudev / autoskills

Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

F

flare-fcc

flare-foundation / flare-ai-skills

Provides domain knowledge and guidance for Flare Confidential Compute (FCC) and TEE extensions—how confidential extensions run inside a Trusted Execution Environment, the on-chain TeeExtensionRegistry and TeeMachineRegistry, the InstructionSender contract pattern, the OPType/OPCommand routing model, the instruction lifecycle, the extension action handler, attestation, and reproducible builds. Use when building, deploying, or reasoning about Flare confidential extensions, TEE machines, FCC, confidential compute, the fce-extension-scaffold, the fce-sign signing example, the fce-weather-insurance example, Confidential Space VMs, code-hash attestation, parametric insurance on TEE, or registering a TEE on Coston/Coston2.

H

hermes-traffic-guardian

prompt-security / clawsec

Hermes runtime traffic monitoring baseline for opt-in proxy inspection, egress detection, and attestation-aware traffic posture.

I

implementing-rbac-hardening-for-kubernetes

mukul975 / anthropic-cybersecurity-skills

Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, and integrating an external OIDC identity provider. Use when tightening cluster access control, removing excessive ClusterRoleBindings, or hardening service-account permissions against escalation and lateral movement. Keywords: RBAC, Role, ClusterRole, RoleBinding, least privilege, service account, OIDC, cluster-admin. Do not use for discovering existing escalation paths - use auditing-kubernetes-rbac-privilege-escalation.

I

implementing-zero-trust-network-access

mukul975 / anthropic-cybersecurity-skills

Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure.

I

infra-security-review

majesticlabs-dev / majestic-marketplace

Security patterns and checklists for reviewing Infrastructure-as-Code. Covers Terraform/OpenTofu state, secrets, network, compute, database, and storage security.

K

kintent

membranedev / application-skills

Kintent integration. Manage data, records, and automate workflows. Use when the user wants to interact with Kintent data.

L

laravel-permission

fusengine / agents

Use when implementing RBAC, role-based access control, or user authorization with Spatie Laravel Permission.

L

laravel-permission

fusengine / claude-plugins

Redefining development through cognitive automation and collaborative agent systems.

M

migrate-webapi-selectall

microsoft / power-platform-skills

Reviews and migrates deprecated wildcard (*) values in Power Pages Web API fields site settings to least-privilege explicit Dataverse columns. Use whenever a user mentions Web API wildcard or select-all remediation, fields settings containing *, data-exposure review, wildcard deprecation readiness, or Web API failures after wildcard retirement. Applies to both non-SPA sites using HTML, CSS, JavaScript, Liquid, and downloaded YAML, and SPA sites using React, Vue, Angular, Astro, or TypeScript. The agent must inspect every source Web API call and consumer, report exact fixes for every wildcard, report every already-explicit configuration, apply approved edits, and verify no wildcard remains.

M

mp-webhooks

mercadopago / mercadopago-claude-marketplace

Configure and validate Mercado Pago webhooks. Wraps the MCP webhook tools (save_webhook, notifications_history) and provides the HMAC-SHA256 signature validation pattern that every receiver must implement. Use when adding, debugging, or hardening notification handling.

O

open-policy-agent

membranedev / application-skills

Open Policy Agent integration. Manage data, records, and automate workflows. Use when the user wants to interact with Open Policy Agent data.

O

osint-methodology

elementalsouls / claude-osint

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.

P

pentest-gemini-az

crtvrffnrt / skills

Azure, Microsoft 365, Microsoft Graph, and Entra ID operator skill using the current Azure CLI session and `az rest` for scoped read, list, create, update, delete, and evidence collection tasks.

P

performing-aws-account-enumeration-with-scout-suite

mukul975 / anthropic-cybersecurity-skills

Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI)

P

pr-review

onekeyhq / app-monorepo

Security-first PR review checklist for this repo. Use when reviewing diffs/PRs, especially changes involving auth, networking, sensitive data, or dependency/lockfile updates. Focus on secret/PII leakage risk, supply-chain risk (npm + node_modules inspection), cross-platform architecture (extension/mobile/desktop/web), and React performance (hooks + re-render hotspots). Avoid UI style nitpicks. PR Review.

R

reversing-unity-il2cpp

trilwu / secskills

Reverse engineer Unity games and apps built with IL2CPP or Mono, using Il2CppDumper, Il2CppInspector, and dnSpy. Use when an APK or IPA contains global-metadata.dat, libil2cpp.so, UnityFramework, or Assembly-CSharp.dll, when jadx shows only UnityPlayerActivity, or when the target is described as a Unity build.

S

saaspass

membranedev / application-skills

SAASPASS integration. Manage data, records, and automate workflows. Use when the user wants to interact with SAASPASS data.

S

secrets-vault-manager

borghei / claude-skills

This skill should be used when the user asks to "generate Vault configurations", "plan secret rotation", "analyze vault audit logs", "manage secrets lifecycle", or "set up HashiCorp Vault".

S

securitytrails

membranedev / application-skills

SecurityTrails integration. Manage data, records, and automate workflows. Use when the user wants to interact with SecurityTrails data.

S

signing-entitlements

openai / plugins

Inspect macOS signing, entitlements, and Gatekeeper issues. Use when diagnosing code signing, sandbox, hardened runtime, or trust failures.

S

solidity-checklist

0xlayerghost / solidity-agent-kit

[AUTO-INVOKE] MUST be invoked BEFORE any on-chain operation (cast send, forge script --broadcast). Systematic 6-layer verification checklist: permissions, dependencies, parameters, security, testing, and knowledge capture. Trigger: any task involving sending transactions, deploying contracts, or interacting with on-chain state.

S

static-analysis

gmh5225 / awesome-llvm-security

Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.

T

the-media-trust

membranedev / application-skills

The Media Trust integration. Manage data, records, and automate workflows. Use when the user wants to interact with The Media Trust data.

T

threat-detection

borghei / claude-skills

This skill should be used when the user asks to "analyze logs for threats", "detect suspicious activity", "scan for brute force attempts", "identify injection attacks", or "audit access patterns for anomalies".

W

web-auth

agent-sh / agentsys

Authenticate to websites with human-in-the-loop browser handoff. Use when user needs to log into a website, complete 2FA, or solve CAPTCHAs for agent access.

W

wp-rest-api-development

jorgerosal / wordpress-skills

WordPress REST API review and development guidance. Use when reviewing custom REST routes, permission_callback logic, schema design, WP_REST_Request handling, response structure, versioning, controller classes, nonce or auth usage, or when user mentions "REST API review", "register_rest_route", "permission_callback", "WP_REST_Request", "REST endpoint", "custom API", "API schema", "REST controller", "headless WordPress", or "API auth". Detects route registration issues, authorization mistakes, schema drift, input validation gaps, and response design problems in WordPress REST API code.

A

acl-security

serac-labs / serac

Create and debug ServiceNow ACLs (record, field, REST, script-include). Covers role/condition/script patterns, which ACL names can apply to a table or field, field-level visibility, and impersonation testing for row- and field-level security.

A

actions-pinning

paulnsorensen / git-gouda

Inventory, classify, and pin every `uses:` reference in GitHub Actions workflows, composite actions, and reusable workflows to a verified commit SHA, then keep those pins fresh with Dependabot. Use when the user says "pin actions", "unpinned actions", "SHA pin", "supply chain for workflows", or invokes /actions-pinning. Do NOT use for permissions and injection hardening of workflow files (route to /oss-hygiene) or for CI run-time speed (route to /ci-optimize).

A

ag2-network-governance

ag2ai / ag2-skills

Govern an AG2 multi-agent network — identity (`Passport`, `Resume`), per-agent `Rule` with two top-level blocks `access` (`AccessBlock`) and `limits` (`LimitsBlock`, which nests `RateBlock` + `InboxBlock`), the swappable `HubArbiter` / `RuleBasedArbiter` access-&-routing seam, `AuthAdapter` / `AuthRegistry` registration, channel-level `Expectation`s with `audit` / `notify_channel` / `auto_close` violation handlers, the hub's append-only audit log and `AUDIT_KIND_*` constants, live `HubListener` / `BaseHubListener` observability plus `Hub` `on_*` hooks and `register_sweeper`, and task observation via `agent.task(...)` + `TaskMirror` (updates `Resume.observed` for peer ranking). Use when the user needs rate limits, access policy, SLAs, compliance trails, live metrics/alerting, capability-driven peer ranking, or to inspect what actually happened on the network. Load this after `ag2-network-quickstart`. For the agent-side surface (custom handlers, views, LLM tools, `HumanClient`) see `ag2-network-tools-and-views`.

A

aikido-security

membranedev / application-skills

Aikido Security integration. Manage data, records, and automate workflows. Use when the user wants to interact with Aikido Security data.

A

alibabacloud-waf-security-monitor

aliyun / alibabacloud-aiops-skills

Perform security inspection and monitoring for Alibaba Cloud WAF (Web Application Firewall), covering CNAME-based domain access, hybrid cloud access, and cloud product access assets. Supports querying Web attacks, CC attacks, Bot attacks, API security events, traffic analysis (QPS/bandwidth), HTTP status code anomalies (4xx/5xx period-over-period), protection status, certificate expiry, and instance asset inventory. Use this Skill when users need WAF security inspection, protection status checks, attack event queries, traffic anomaly investigation, or to confirm whether WAF products are provisioned. Triggers: "WAF inspection", "WAF security check", "Web attack query", "traffic anomaly", "certificate check"

A

auditing-pre-release-security

onekeyhq / app-monorepo

Audits security and supply-chain risk between two git refs, 预发布安全审计

A

awesome-dependency-audit

khasky / awesome-agent-skills

Read-only supply-chain audit of packages and agent extensions: lockfiles, typosquats, dependency confusion, install scripts, licenses, CVEs. Use when asked if a package, manifest change or bot bump is safe.

A

azure-identity-java

sickn33 / agentic-awesome-skills

Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).

A

azure-keyvault-keys-rust

sickn33 / agentic-awesome-skills

Azure Key Vault Keys SDK for Rust. Use for creating, managing, and using cryptographic keys. Triggers: "keyvault keys rust", "KeyClient rust", "create key rust", "encrypt rust", "sign rust".

B

baseline-security-audit

enigmatry / agent-skills

Ensures baseline security practices are followed in the project. Use this when asked to perform a security audit on the codebase. Can create Jira stories for selected security findings.