Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Threejs Volumetric Clouds

  by @scottstts

  Implement volumetric cloud systems in Three.js. Use for weather-driven density, bounded raymarching, shape/detail erosion, vertical profiles, lighting cones, silver lining, temporal reconstruction, cloud shadows, multiple…

• Mcp Server Review

  by @pnp

  Review a Model Context Protocol (MCP) server implementation against the 2026-07-28 protocol revision, which removed the initialize handshake and Mcp-Session-Id and made the protocol stateless. Use when the user asks to review,…

• Api Docs Generator

  by @pnp

  Generate structured API reference documentation from source code, OpenAPI specs, or route definitions. Trigger phrases include "generate API docs", "document this API", "create API reference", "write endpoint docs", "scaffold…

• Code Audit

  by @3stoneBrother

  Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning,…

• Provider Configuration

  by @hashicorp

  Implement Terraform provider configuration and authentication with the Plugin Framework: provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential provider chains (static…

• Terraform Search Import

  by @hashicorp

  Discover existing cloud resources using Terraform Search queries and bulk import them into Terraform management. Use when bringing unmanaged infrastructure under Terraform control, auditing cloud resources, or migrating to IaC.

• Dep Auditor

  by @laolaoshiren

  审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报告时使用

• Aws Ami Builder

  by @hashicorp

  Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

• Changelog Gen

  by @laolaoshiren

  Changelog 生成器 - 从 Git 历史自动生成 CHANGELOG

• Env Manager

  by @laolaoshiren

  环境变量管理器：扫描、校验、同步 .env 文件，生成安全配置模板

• Security Audit

  by @laolaoshiren

  代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

• Db

  by @oracle

  Oracle Database guidance for SQL, PL/SQL, SQLcl, ORDS, Oracle Vector SDK, administration, app development, performance, security, migrations, and agent-safe database workflows. Use when the user asks to write, edit, rewrite,…

• Creating Agent Skills

  by @AgentWorkforce

  Use when creating Agent Skills packages (SKILL.md format) for Codex CLI, GitHub Copilot, or Amp - provides the agentskills.io specification with frontmatter constraints, directory structure, and validation rules

• Double Check

  by @mrtooher

  Automatic final verification pass on completed deliverables. Runs at the end of every fable-mode run — those skills invoke it before delivery. Also triggers when the user says "double check this". Uses a panel of fresh checker…

• Redteam

  by @agentscope-ai

  Use when the user wants to test their LLM/agent application for safety and security vulnerabilities — jailbreaks, prompt injection, PII extraction, harmful content generation, or evaluator gaming. Also use when the user mentions…

• Onboard

  by @poshan0126

  Get oriented in an unfamiliar codebase fast. An Explore-subagent-driven tour that goes from a one-paragraph overview down to architecture, data models, auth, conventions, and a glossary — without flooding your main context. Use…

• Claude Md

  by @poshan0126

  Keep CLAUDE.md current and lean — capture this session's durable learnings into it (default), or `audit` it for stale commands, drift, and bloat. Enforces the line budget either way.

• Test Pruner

  by @hex

  Tests in a named area duplicate stronger tests, re-assert the implementation, or keep test-only seams alive, and need pruning.

• Add Integration

  by @indranilbanerjee

  Add a custom MCP integration: scaffold the server, write .mcp.json, test it. "add a new MCP server"

• Telnetshell

  by @BrownFineSecurity

  Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with…

• Picocom

  by @BrownFineSecurity

  Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with…

• Chipsec

  by @BrownFineSecurity

  Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with…

• Jadx

  by @BrownFineSecurity

  Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior…

• Iotnet

  by @BrownFineSecurity

  IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT…

• Apktool

  by @BrownFineSecurity

  Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.

• Onvifscan

  by @BrownFineSecurity

  ONVIF device security scanner for testing authentication and brute-forcing credentials. Use when you need to assess security of IP cameras or ONVIF-enabled devices.

• Npm Security

  by @bodadotsh

  Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating dependencies or configuring package managers

• Dependency Auditor

  by @borghei

  Scan project dependencies for vulnerabilities, license issues, and upgrade opportunities across Python, Node.js, Go, and Rust. Use when auditing dependencies, checking licenses, planning upgrades, or assessing supply chain…

• Claude Code Mastery

  by @borghei

  Use when the user asks to "optimize CLAUDE.md", "create a new skill", "write a custom agent", "configure hooks", "manage context window", "set up MCP servers", "scaffold a skill package", "analyze token budget", "create…

• Cloud Security

  by @borghei

  Cloud posture security across AWS, Azure, and GCP — IAM least privilege, public exposure, encryption, logging coverage, landing-zone guardrails. Use when auditing a cloud account, before a production launch, or after a scan.

• Internal Comms

  by @borghei

  Plan, sequence, and pressure-test internal announcements before they send. Use when announcing a reorg, policy, or product change, drafting an all-hands or exec update, or deciding who hears what and in which order.

• Agent Protocol

  by @borghei

  Design AI agent communication protocols: MCP tool schemas, A2A, function calling, and inter- agent messaging. Use when building multi-agent systems, defining tool interfaces, or implementing agent-to-agent communication.

• Api Test Suite Builder

  by @borghei

  Generate API test suites from route definitions across frameworks: auth, input validation, contract, k6 load testing, mocking, and OpenAPI-driven generation. Use when adding new APIs, auditing test coverage, or building…

• Commercial Policy

  by @borghei

  Commercial policy: the governance framework defining what terms sales can offer and what triggers approval. Use when authoring a policy charter, defining discount/payment/liability rules, auditing deals, or generating a regional…

• Database Schema Designer

  by @borghei

  Design relational schemas from requirements with normalization, migrations, ERDs, RLS policies, and indexes for PostgreSQL, MySQL, and SQLite. Use when designing new features, reviewing schemas, or adding multi-tenancy.

• Docker Development

  by @borghei

  This skill should be used when the user asks to "analyze a Dockerfile", "optimize Docker layers", "validate docker-compose", "check container best practices", or "audit Docker configurations".

• Competitive Teardown

  by @borghei

  Systematic competitor analysis covering product teardowns, 12-dimension scoring rubric, feature comparison matrices, SWOT analysis, pricing model deconstruction, UX audits, and strategic action plans with stakeholder…

• Pdf Toolkit

  by @borghei

  Audit PDF files for metadata leakage, page count, encryption, JavaScript, embedded files, and version. Use before sending a PDF externally, when redacting sensitive metadata, or running a PDF security review.

• Signup Flow Cro

  by @borghei

  Signup and registration flow optimization covering SSO strategy, progressive profiling, field reduction, multi-step flow design, authentication UX, post-submit experience, and mobile registration patterns.

• Ciso Advisor

  by @borghei

  Security leadership for growth-stage companies. Use when building security programs, selecting compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR), managing incidents, or assessing vendor risk.

• Ai Security

  by @borghei

  This skill should be used when the user asks to "scan AI systems for security threats", "check for prompt injection vulnerabilities", "assess model security posture", "detect data poisoning risks", or "audit AI/ML pipeline…

• Eu Data Act Oliver Schmidt Prietz

  by @lawve-ai

  Practitioner skill for advising on EU Regulation 2023/2854 (Data Act). Covers Chapters II-VII (IoT data access, mandatory B2B sharing, unfair contract terms, public-sector exceptional need, cloud switching, third-country…

• Cookie Policy Malik Taiar

  by @lawve-ai

  Guide for drafting cookie policies compliant with GDPR and the ePrivacy Directive. Includes CNIL 2020 recommendations, a reference template, and best practices. Use when drafting or revising a cookie policy for a website or…

• Gdpr Breach Sentinel Oliver Schmidt Prietz

  by @lawve-ai

  Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal data breach?" triage, (2)…

• Agent Authority Charter Builder Arkadiy Miteiko

  by @lawve-ai

  Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted…

• Eu Ai Act

  by @lawve-ai

  EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5, including the nudification/CSAM prohibition from Dec 2, 2026), all 8 Annex III high-risk…

• Cmmc

  by @lawve-ai

  Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2,…

• Cra Vulnerability Obligations

  by @lawve-ai

  Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to…

• Security Compliance

  by @sangrokjung

  Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing…

• Review Loop

  by @sangrokjung

  Run the adversarial verification loop — implement, then hand the change to a fresh checker that did not write it, fix what it finds, and re-dispatch until APPROVE. Use before claiming any behavioural change is done, and on…

• Team Orchestrator

  by @sangrokjung

  Use when orchestrating Agent Teams for parallel development - team composition, task distribution, dependency management, and result aggregation. Triggers on /orchestrate, multi-agent coordination, parallel team work, task…

• Security Pipeline

  by @sangrokjung

  Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.

• Stride Analysis Patterns

  by @sangrokjung

  Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

• Manage Skills

  by @sangrokjung

  세션 변경사항을 분석하여 검증 스킬 누락을 탐지합니다. 기존 스킬을 동적으로 탐색하고, 새 스킬을 생성하거나 기존 스킬을 업데이트한 뒤 프로젝트 CLAUDE.md를 관리합니다.

• Hol Guard Protection

  by @hashgraph-online

  Use HOL Guard to preview and protect AI-agent package installs, Cursor surfaces, CI, and automation workflows.

• Censys

  by @taracodlabs

  Censys lookups: hosts, certificates, services on the public internet

• Cveapi

  by @taracodlabs

  CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

• Crt.Sh

  by @taracodlabs

  Enumerate subdomains and TLS certs via CT logs (no API key needed)

• Urlscan

  by @taracodlabs

  Submit URLs to urlscan.io — safety verdict + screenshot retrieval

• Securityheaders

  by @taracodlabs

  HTTP security header audit (A+ to F) with fix recommendations

• Shodan

  by @taracodlabs

  Shodan lookups: internet-connected devices, ports, services

• Haveibeenpwned

  by @taracodlabs

  Check email/username against HIBP v3 breach database

• Status

  by @hashgraph-online

  Check HOL Guard local protection status for Claude Code without changing configuration. Use when the user asks whether Guard is installed, active, healthy, or protecting Claude Code.

• Setup

  by @hashgraph-online

  Install or initialize HOL Guard local runtime protection for Claude Code. Use when the user explicitly asks to install, enable, set up, or repair HOL Guard.

• Network Request Auditing

  by @spencerpauly

  After navigating and interacting in Cursor's built-in browser, use browser_network_requests to audit every fetch/XHR for failures, slowness, duplicate calls, and suspicious payloads. Use for API-heavy pages and after backend or…

• Parallel Exploring

  by @spencerpauly

  Explore a large codebase in parallel by launching multiple explore subagents that each investigate a different area simultaneously. Use when onboarding onto a new project, understanding architecture, or investigating a…

• Parallel Code Review

  by @spencerpauly

  Run four parallel read-only subagents that each review the same diff from a different lens — security, performance, correctness, and readability — then merge findings into one report. Use before merging large or risky PRs.

• Human Auth Oauth

  by @pockebot

  Handle account login credential delegation from Human Phone. Covers username/password entry, social sign-in walls, and multi-step login flows.

• Human Auth Sms 2fa

  by @pockebot

  Handle SMS verification codes and 2FA TOTP codes from Human Phone. Covers OTP entry, code verification, and multi-factor authentication flows.

• Auditing Security

  by @spencerpauly

  Perform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.

• Adding Api Docs

  by @spencerpauly

  Generate OpenAPI/Swagger documentation for an API, including endpoint schemas, request/response types, and interactive docs UI.

• Human Auth Payment

  by @pockebot

  Handle payment card delegation from Human Phone. Covers credit/debit card number, expiry, CVC entry in checkout flows.

• Suggesting Skills

  by @spencerpauly

  When the user struggles with a task that a known skill could handle, suggest installing it.

• Skylos

  by @duriantaco

  Run, interpret, or modify Skylos safely. Use when the user asks to scan code with Skylos, explain SKY-* findings, triage dead-code false positives, audit security/secrets/SCA/LLM behavior, update Skylos rules/docs/CI, benchmark…

• Skylos Security

  by @duriantaco

  Investigate and harden Skylos security behavior. Use when the user asks to validate a security finding, reproduce a scanner bypass, assess false negatives, review LLM evidence filters, analyze CI/cloud policy trust boundaries,…

• Use Link Identity

  by @stripe

  Use Link CLI's identity commands when a service requests a Link Agent Attestation Token (AAT) or signed user claims such as email. Covers acquiring and managing attestations, obtaining identity credentials, and presenting…

• Tapd Story Validate

  by @TencentBlueKing

  迭代执行流水线校验阶段。对 implement 产出的代码做四维度并行校验（架构 / 安全 / CodeReview / 测试覆盖）， 再按汇总结果原地修复（fullstack 需求按受影响文件路径分派 backend-developer / frontend-developer）。 每个维度通过独立 subagent 执行，日志写入独立 process-validate-*.log。 命令与报告模板详见…

• Strix•JWT 身份认证测试

  by @asdfgh1445

  Strix JWT 与 OIDC 安全测试手册,覆盖令牌伪造、算法混淆与声明篡改;触发名:strix-authentication-jwt

• Strix•Nuclei 用法

  by @asdfgh1445

  Strix Nuclei 命令手册,覆盖模板选择、高吞吐执行与自动化边界控制;触发名:strix-nuclei

• Bevy Mechanic Secrets

  by @thedivergentai

  Docs-first stub for Bevy secrets and discovery flags. Godot counterpart: godot-mechanic-secrets. Keywords: Bevy, secrets, discovery, flags, ECS.

• Bevy Genre Metroidvania

  by @thedivergentai

  Thin Bevy genre router for Metroidvania. Godot counterpart: godot-genre-metroidvania. Keywords: Bevy, Metroidvania, genre, ECS, router.

• Bevy Genre Horror

  by @thedivergentai

  Thin Bevy genre router for Horror. Godot counterpart: godot-genre-horror. Keywords: Bevy, Horror, genre, ECS, router.

• Web Sqli

  by @s0ld13rr

  SQL injection detection→exploitation→proof for web apps and APIs. Use when a parameter reaches a DB query, when input triggers a SQL error / boolean or time differential, or during VULN-ASSESSMENT/EXPLOITATION on a web target.…

• Web Lfi Traversal

  by @s0ld13rr

  Path traversal / Local File Inclusion detection→file-read→RCE for web apps. Use when a param names a file/path/page/template/lang/download, or a response embeds file contents. Triggers -…

• Svc Docker K8s

  by @s0ld13rr

  Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet…

• Playbook Webapp

  by @s0ld13rr

  Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class>…

• China Break Trace

  by @jwangkun

  Forensic financial analysis for A-share fund holdings and portfolio companies. Adapts the original break-trace skill for fund administration context and Chinese market standards. Triggers on "基金持仓核查", "持仓异常", "forensic fund…

• Svc Mobile Android

  by @s0ld13rr

  Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis. Use when target is an APK/Android app. Triggers - APK, Android, mobile app,…

• Playbook Ad

  by @s0ld13rr

  AD attack decision tree — which attacks need creds, delegation types, ADCS, key paths to DA. Load when a Windows domain / DC is found. Triggers - domain controller, Kerberos, LDAP, BloodHound, kerberoast, AS-REP, NTLM, ADCS…

• Playbook Cloud

  by @s0ld13rr

  Cloud IAM privesc paths and metadata endpoints per provider. Load when the target is cloud or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM, S3/blob, 169.254.169.254, access key.

• Svc Smb

  by @s0ld13rr

  SMB gotchas — DPAPI dump trap, relay when signing disabled, credential dump order. Use when SMB is found. Triggers - ports 445/139, signing:False, null session, EternalBlue MS17-010, PetitPotam.

• Svc Ssh

  by @s0ld13rr

  SSH version CVEs and post-auth tricks — regreSSHion, user enum, agent hijack. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, CVE-2018-15473.

• Svc Cicd

  by @s0ld13rr

  CI/CD gotchas — default creds, instant-RCE paths, secret leaks in logs. Use when a CI/CD service is found. Triggers - Jenkins, GitLab, ArgoCD, Vault, pipeline, runner token.

• Reporting Phase

  by @s0ld13rr

  Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.

• Seo Aeo Audit

  by @warpdotdev

  Optimize for search engine visibility, ranking, and AI citations. Use when asked to improve SEO, optimize for search, fix meta tags, add structured data, or improve AEO and AI visibility.

• Self Verification

  by @A-EVO-Lab

  Verification patterns to confirm task completion before submitting. Read this before calling submit().

• Export Pipeline

  by @jame581

  Use when exporting and distributing Godot games — export presets, platform settings, CI/CD with GitHub Actions

• Site Architecture

  by @AvdLee

  When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual sitemap," "site structure," "page…

• Secure Software

  by @suleimanodetoro

  Threat-model, design, implement, and verify security controls in web, API, backend, React, and React Native software. Use when building authentication, session management, authorization, sensitive-data handling, secrets,…

• Review Security

  by @suleimanodetoro

  Perform a read-only, evidence-based security review of web, API, backend, React, React Native, mobile, dependency, CI/CD, and infrastructure changes. Use when asked for a security review, secure code review, vulnerability…