Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Hep Upload

  by @agentlas-ai

  Publish an Agentlas package to Agent Cloud or the public Hub.

• Skill Creator

  by @Prismer-AI

  Create, import, edit, validate, test, or publish a Prismer SS-01 Skill. Use whenever a user asks to turn a repeatable capability or external Skill repository into platform Skills, improve an existing Skill, or make Skills…

• Prismer Box

  by @Prismer-AI

  Box manages cloud files, sharing, search, and metadata.

• Prismer Google Workspace

  by @Prismer-AI

  Gmail, Calendar, Drive, Docs, Sheets via gws CLI or Python.

• Prismer Himalaya

  by @Prismer-AI

  Himalaya CLI: IMAP/SMTP email from terminal.

• Prismer Email Inbox Triage

  by @Prismer-AI

  Triage an inbox: prioritize threads, draft replies safely.

• Glue 09 10 Migration

  by @aws-samples

  Upgrade an AWS Glue ETL job from Glue version 0.9 or 1.0 to Glue 4.0. Runs the job against Glue 4.0, diagnoses failures against a known breaking-change catalogue, patches the job script and configuration, and iterates until the…

• A11y Audit

  by @plugin87

  Audit a UI or design against WCAG 2.2 AA/AAA and ARIA patterns, returning criterion-referenced findings with severity and specific fixes. Use when the user wants an accessibility check, contrast verification,…

• Find Skills

  by @rohitg00

  Discovers, searches, and installs skills from multiple AI agent skill marketplaces (400K+ skills) using the SkillKit CLI. Supports browsing official partner collections (Anthropic, Vercel, Supabase, Stripe, and more) and…

• Structured Code Review

  by @rohitg00

  Performs a structured five-stage code review covering requirements compliance, correctness, code quality, testing, and security/performance. Each stage uses targeted checklists and categorized feedback (Blocker/Major/Minor/Nit)…

• Burp Scan

  by @six2dez

  Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs. Use when the user has Burp…

• Azure Cost

  by @microsoft

  Azure cost management: query costs, forecast spending, optimize to reduce waste. WHEN: "Azure costs", "Azure bill", "cost breakdown", "how much am I spending", "forecast spending", "optimize costs", "reduce spending", "orphaned…

• Entra App Registration

  by @microsoft

  Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service…

• Azure Compliance

  by @microsoft

  Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security…

• Entra Agent Id

  by @microsoft

  Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra…

• Azure Kubernetes Automatic Readiness

  by @microsoft

  Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check…

• Azure Resource Visualizer

  by @microsoft

  Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. WHEN: create architecture diagram, visualize Azure resources, show resource relationships,…

• Azure Resource Lookup

  by @microsoft

  List, find, and show Azure resources across subscriptions or resource groups. Handles prompts like "list the websites in my subscription", "list my web apps", "show my app services", "list virtual machines", "list my VMs", "show…

• M13 Domain Error

  by @actionbook

  Use when designing domain error handling. Keywords: domain error, error categorization, recovery strategy, retry, fallback, domain error hierarchy, user-facing vs internal errors, error code design, circuit breaker, graceful…

• Domain Web

  by @actionbook

  Use when building web services. Keywords: web server, HTTP, REST API, GraphQL, WebSocket, axum, actix, warp, rocket, tower, hyper, reqwest, middleware, router, handler, extractor, state management, authentication, authorization,…

• Code Contracts

  by @dust-tt

  Define, use, and enforce @cc code-contracts across a codebase.

• Install Connectonion

  by @openonion

  Install and set up ConnectOnion on Windows, macOS, or Linux, initialize global credentials, and verify the requested CLI capabilities. Use for "install connectonion", "set up connectonion", "get me started with co", or missing…

• Review Pr

  by @openonion

  Review GitHub pull requests. Use when user says "review PR", "review pull request", or "/review-pr".

• Ghostty Use

  by @daymade

  Snapshots, restores and reconciles Claude Code / Codex sessions inside Ghostty tabs across reboots. Use when quitting the Mac for an update (保存终端会话 / 重启前备份终端), after restart to reopen tabs with their original session IDs…

• Qa Expert

  by @daymade

  Sets up QA testing processes: test strategies, Google Testing Standards test cases, P0-P4 bug tracking, quality metrics, progress reports, autonomous execution via master prompts, and OWASP security testing, with third-party QA…

• Github Review Pr

  by @daymade

  Reviews or re-reviews a contributor PR as repository maintainer — a closed PR reconsidered, or a sweep of open PRs — against the live base with immutable snapshots and three-way merges. Use for a PR URL/number, "main changed,…

• Product Analysis

  by @daymade

  Multi-path parallel product analysis with cross-model test-time compute scaling. Spawns parallel agents (Claude Code agent teams + Codex CLI) to explore product from multiple perspectives, then synthesizes findings into…

• Repomix Safe Mixer

  by @daymade

  Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security…

• Marketplace Health Check

  by @daymade

  Runs a 6-dimension evidence-based health audit of this skills marketplace repo — code safety, docs/SSOT, security/PII, PR/issue triage, manifest integrity — via a parallel workflow, then verifies findings by priority. Use for…

• Technical Debt Register

  by @mohitagw15856

  Documenta y prioriza un backlog de deuda técnica con impacto empresarial, estimaciones de esfuerzo y estrategia de resolución. Úsalo cuando se te pida auditar deuda técnica, crear un registro de deuda, priorizar deuda técnica…

• Skill Security Auditor

  by @mohitagw15856

  Audita un SKILL.md de Claude/Agent (o cualquier skill de IA / instrucción del sistema) para verificar su seguridad antes de instalarlo o fusionarlo. Úsalo cuando te pidan revisar un skill por seguridad, verificar una inyección…

• Example Internal Skill

  by @mohitagw15856

  An example private skill — replace me. Use when demonstrating that org-private skills load, override, and stay inside your network. Produces this description in /v1/skills with source:private.

• Stripe Link Wallet

  by @vellum-ai

  Agent wallet on the Stripe Link CLI (link-cli). Connect the wallet, then buy, purchase and pay for things on the user's behalf via approved spend requests, one-time-use cards, and 402 / Machine Payment Protocol (MPP) payments

• Security Patterns

  by @CloudAI-X

  Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT,…

• Vellum Skills Catalog

  by @vellum-ai

  Discover bundled skills and search/install community skills from the skills.sh registry

• Backend Reference

  by @agent0ai

  Read-only reference for the backend contracts that the frontend depends on, including routing, APIs, auth, layers, and module resolution.

• Marketplace Dev

  by @daymade

  Creates and maintains Claude Code plugin marketplaces, consolidates standalone skills into a new or existing suite, and moves skills between suites. Converts any Claude Code skills repository into an official plugin marketplace,…

• Cloudflare Troubleshooting

  by @daymade

  Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems. Focus on systematic…

• Skill Reviewer

  by @daymade

  Reviews and improves Claude Code skills against official best practices. Supports three modes - self-review (validate your own skills), external review (evaluate others' skills), and auto-PR (fork, improve, submit). Use when…

• Better Codex

  by @noobnooc

  Behavioral guardrails for Codex coding work based on common user complaints. Use when Codex is asked to implement, modify, debug, review, test, or operate on a codebase and should avoid unsafe scope expansion, stale edits, fake…

• Wtf

  by @noobnooc

  Pre-launch and pre-commit audit for vibe coding projects. Use when asked to check whether a project is ready to ship, deploy, merge, or commit, especially for common AI-built app mistakes: broken project structure, committed…

• Convex

  by @raroque

  Routes general Convex requests to the right project skill. Use when the user asks which Convex skill to use or gives an underspecified Convex app task.

• Ai Ethics Review

  by @mohitagw15856

  Conduct a structured ethical review of an AI or ML feature, model, or product. Use when preparing to deploy an AI system, assessing algorithmic risk, auditing a model for bias, or producing a responsible AI impact assessment.…

• Ponytail Audit

  by @marmelab

  Whole-repo audit for over-engineering. Like ponytail-review, but scans the entire codebase instead of a diff: a ranked list of what to delete, simplify, or replace with stdlib/native equivalents. Use when the user says "audit…

• Backend Dev

  by @marmelab

  Coding practices for backend development in Atomic CRM. Use when deciding whether backend logic is needed, or when creating/modifying database migrations, views, triggers, RLS policies, edge functions, or custom dataProvider…

• Webvuln

  by @PentesterFlow

  Web vulnerability hunting playbook. Use after recon, when you have specific hosts/endpoints to test for IDOR/BAC, injection, auth flaws, SSRF, and known CVEs. Emphasizes real PoC + concrete impact.

• Memory Audit Discoverability

  by @Dataojitori

  可发现性审计。当disclosure写法有问题、parent放错、alias缺失、子节点过多时使用。

• Memory Audit Pattern Extraction

  by @Dataojitori

  模式提取与失效解药分析。当发现多条记忆在讲同一个教训，或发现自己在一而再再而三地犯同样的错误时使用。

• Memory Audit Node Decomposition

  by @Dataojitori

  节点分解。当一个节点体积过大、或塞了多个不相关概念导致disclosure无法覆盖时使用。

• Memory Audit

  by @Dataojitori

  记忆审计入口。当我主动决定审视记忆质量时，先读此文件判断应使用哪个子技能。

• Memory Audit Belief Duel

  by @Dataojitori

  信念对决。当父子节点内容冲突、或两条你都认可的记忆逻辑上不能并存时使用。

• Memory Audit Dead Data Purge

  by @Dataojitori

  死数据清洗。当一条记忆读不读你的行为都不会变、感悟没有现实锚点时使用。

• Running Meetings

  by @RefoundAI

  Help users master the art of facilitating productive, decision-oriented meetings that unblock teams, strengthen interpersonal bonds, and accelerate shipping velocity.

• Home Assistant

  by @Anil-matcha

  Read entity states and call services on your Home Assistant instance. Service calls are confirmed first. Trigger phrases: home assistant, smart home, turn on the light.

• Calcom

  by @Anil-matcha

  Read and write Cal.com: list bookings and event types, create bookings. Trigger phrases: cal.com, my bookings, schedule a call.

• Oma Security

  by @first-fluke

  Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for…

• Enterprise Sales Motion

  by @RefoundAI

  Help users build a robust enterprise sales engine by mastering founder-led discovery, navigating complex procurement cycles, and designing products that meet organizational governance needs.

• Competitive Strategy

  by @RefoundAI

  Help users identify sources of durable competitive power, evaluate market threats, and design products that are uniquely differentiated rather than just better versions of existing tools.

• Personal Brand Network

  by @RefoundAI

  Help users build a strategic professional network and public audience by transitioning from passive learning to active, value-driven contribution.

• Sast Jwt

  by @utkusen

  Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each…

• Sast Missingauth

  by @utkusen

  Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel…

• Sast Businesslogic

  by @utkusen

  Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge…

• Sast Idor

  by @utkusen

  Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge…

• Sast Sqli

  by @utkusen

  Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge…

• Sast Ssrf

  by @utkusen

  Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and…

• Sast Analysis

  by @utkusen

  Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before…

• Sast Report

  by @utkusen

  Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all…

• Yao Doctor Skill

  by @yaojingang

  Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report. Use…

• Yao Websecurity Skill

  by @yaojingang

  Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic review, active validation, or…

• Yao Techselect Hskill

  by @yaojingang

  帮助开发团队进行技术选型决策，提供框架对比、架构评估和最佳实践建议。适用于需要在多个技术方案中做出选择的场景。

• Thinking Red Team

  by @tjboudreaux

  For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.

• Thinking Thought Experiment

  by @tjboudreaux

  When a real test is too rare, large, or irreversible, run a controlled counterfactual: isolate one variable, fix conditions, trace the mechanistic chain, and bound what the result implies.

• Oma Design

  by @first-fluke

  Define or review a visual system, DESIGN.md, or redesign direction. Use for typography, layout, color, motion, and interaction design decisions.

• Oma Backend

  by @first-fluke

  Implement server APIs, authentication, and application data access. Schema modeling and query tuning use oma-db.

• Oma Db

  by @first-fluke

  Design schemas and migrations, tune queries, or plan vector retrieval and database operations. Application API implementation uses oma-backend.

• Oma Tf Infra

  by @first-fluke

  Create or review Terraform infrastructure and plans. Use for cloud resources, IAM, networking, state management, and infrastructure changes.

• Oma Deepsec

  by @first-fluke

  Set up and run Deepsec vulnerability scans, triage, and CI gates. Use for Deepsec work or an explicitly requested agent-powered vulnerability scan.

• Oma Qa

  by @first-fluke

  Review changes for correctness, security, accessibility, and performance. Use for scoped quality reviews or verification plans; bug fixes use oma-debug.

• Oma Scm

  by @first-fluke

  Manage Git branches, merges, conflicts, commits, and release baselines. Use for repository history and change-management operations.

• Hunt Llm Ai

  by @uphiago

  Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous…

• Hunt Api Misconfig

  by @uphiago

  Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly…

• Hunt Auth Bypass

  by @uphiago

  Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify…

• Hunt Nestjs

  by @uphiago

  Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.

• Agent Learning Coach

  by @hashgraph-online

  中文学习教练技能。用于学习编程、英语、设计、产品、AI、数学或任何技能时，先诊断水平，再用讲解、练习、反馈、复习的循环推进。触发语包括"进入学习模式""我想学""带我练""帮我制定学习计划""像教练一样教我"。

• Review Work

  by @hashgraph-online

  Quality gate: verify each acceptance criterion of a completed task/work unit, run quality checks, and create follow-up tasks for gaps. Use before merging or to audit delivered work. Invoked as /agiflow:review-work…

• Seo Technical

  by @hashgraph-online

  Technical SEO audit across 9 categories: crawlability, indexability, security, URL structure, mobile, Core Web Vitals, structured data, JavaScript rendering, and IndexNow protocol. Use when user says "technical SEO", "crawl…

• Seo Audit

  by @hashgraph-online

  Full website SEO audit with parallel subagent delegation. Crawls up to 500 pages, detects business type, delegates to 10 specialists (7 core + 3 conditional), generates health score. Use when user says audit, full SEO check,…

• Ontoly Software Graph

  by @hashgraph-online

  Use Ontoly Software Graph evidence, CLI reports, MCP, and official Ontoly Agent Skills before searching source files when reviewing architecture, dependencies, request flows, configuration, impact, or security-sensitive ownership.

• Aident Loadout

  by @hashgraph-online

  Coordinate multi-step work across services the user has authorized through Aident Loadout, using live action schemas, connection checks, cost preflight, and explicit approval for side effects.

• Solution Architect

  by @hashgraph-online

  Используй только внутри активного Codex Project Autopilot-проекта после discovery или approval, а не для обычных архитектурных вопросов вне автопилота.

• VibeSec Skill

  by @BehiSecc

  This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

• Acp

  by @vellum-ai

  Set up, authenticate, and run external coding agents (Claude Code, Codex) via the Agent Client Protocol

• Notion

  by @vellum-ai

  Read and write Notion pages and databases using the Notion API

• System Storage Cleanup

  by @vellum-ai

  Handle disk pressure, critically low storage, safe storage limits, and storage cleanup mode by inspecting disk usage and proposing safe cleanup steps.

• Wordpress Full Compromise

  by @uphiago

  Use when verified WordPress findings may combine into an authorized path to administrative or server control.

• Bug Bounty

  by @uphiago

  Master bug bounty orchestrator — full pipeline: recon, pre-hunt learning, vulnerability hunting (30+ classes), A-to-B chaining, AI/LLM testing (ASI01-ASI10), language-specific grep, bypass tables, and reporting (7-question gate,…

• Bb Local Toolkit

  by @uphiago

  Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning, vuln hunting (30+ classes), A-to-B chaining, AI/LLM testing, bypass tables,…

• Recon Playbook

  by @uphiago

  Use when starting or restructuring an authorized external web and API assessment.

• Email Security

  by @uphiago

  DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

• Hardcoded Credential Hunt

  by @uphiago

  Detect hardcoded passwords in HTML forms, JavaScript, and API responses.