Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Deliver Acceptance Criteria

  by @product-on-purpose

  Generates structured Given/When/Then acceptance criteria for a user story or feature slice, covering the happy path, key failure scenarios, and non-functional expectations in testable form. Use when turning requirements into…

• Measure Instrumentation Spec

  by @product-on-purpose

  Specifies what analytics events to track, when they fire, and what properties to include, as a contract between product and engineering that prevents undertracked features. Use before engineering builds a feature or when…

• Terrashark

  by @LukasNiessen

  Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or…

• Ahrefs Python

  by @OpenClaudia

  Manages Ahrefs API usage in Python using `ahrefs-python` library. Use when working with SEO / marketing related tasks or with data including backlinks, keywords, domain ratings, organic traffic, site audits, rank tracking, and…

• Page Cro

  by @OpenClaudia

  Audit and optimize landing pages for conversion rate. Use when the user asks about conversion rate optimization, CRO, landing page audits, improving sign-ups or sales, reducing bounce rate, A/B test ideas for pages, form…

• Pricing Strategy

  by @OpenClaudia

  Optimize pricing pages, pricing models, and pricing strategy. Use when the user asks about pricing, pricing pages, how to price a product, tiered pricing, freemium vs. paid, price testing, pricing psychology, or pricing page…

• Nuxt Better Auth

  by @onmax

  Guides authentication in Nuxt apps using @nuxtjs/better-auth. Use when installing or configuring the module, using its client or server APIs, protecting routes, refreshing sessions, or integrating Better Auth plugins.

• Nuxt Studio

  by @onmax

  Configure and operate the self-hosted Nuxt Studio editor for Nuxt Content. Use when working with nuxt-studio installation, editor customization, OAuth or custom authentication, media, drafts, Git publishing, or production…

• Agent Teams

  by @alinaqi

  Claude Code Agent Teams - default team-based development with strict TDD pipeline enforcement

• Security Audit

  by @alinaqi

  Structured, adversarial, multi-phase security audit of a codebase — recon → coverage-led hunting → finder≠validator validation → machine-readable findings → target-neutral report

• Verify Cascade

  by @alinaqi

  Verification-gated model escalation — run a cheap model, verify its output with decomposed per-field checks, and escalate to a strong model only when a flag fires. Optional TypeSafe (jev) verifier.

• Dataforseo

  by @alinaqi

  Keyword & SERP research via the DataForSEO API — search volume, competition, CPC, keyword ideas for naming/SEO decisions

• Code Review

  by @alinaqi

  Mandatory code reviews via /code-review before commits and deploys

• Maggy

  by @alinaqi

  Maggy is a local AI engineering command center. AI-prioritized inbox across issue trackers (GitHub Issues/Asana), one-click TDD execute with iCPG context enrichment, daily competitor intelligence briefing.

• Icpg

  by @alinaqi

  Intent-Augmented Code Property Graph — tracks WHY code exists via ReasonNodes with formal contracts, 6-dimension drift detection, and 3 canonical pre-task queries for autonomous development

• Mnemos

  by @alinaqi

  Task-scoped memory lifecycle — typed MnemoGraph prevents lossy context compaction by treating facts/decisions/code-refs/handoffs as distinct node types with per-type eviction policies

• Cross Agent Delegation

  by @alinaqi

  Cross-agent task routing — Codex auto-review, Kimi delegation by complexity score (iCPG + Claude reasoning), iCPG + Mnemos mandatory for all agents

• Polyphony

  by @alinaqi

  Multi-agent orchestration with container-isolated workspaces — each agent session runs in its own Docker container with independent git branches

• Cpg Analysis

  by @alinaqi

  Deep code property graph analysis with Joern CPG (AST+CFG+PDG) and CodeQL for control flow, data flow, taint analysis, and security auditing

• Workspace

  by @alinaqi

  Dynamic multi-repo and monorepo awareness for Claude Code. Analyze workspace topology, track API contracts, and maintain cross-repo context.

• Council Review

  by @alinaqi

  Multi-model validation council — auto-validate plans, architecture changes, and PRs via validate-plan/review before executing

• Code Graph

  by @alinaqi

  AST-based code graph for fast symbol lookup, dependency analysis, and blast radius via codebase-memory-mcp MCP server

• Build In Public

  by @alinaqi

  Best practices for sharing engineering work publicly — what to post, what to withhold, and channel-specific guidance

• Iterative Development

  by @alinaqi

  TDD iteration loops using Claude Code Stop hooks - runs tests after each response, feeds failures back automatically

• Context Shunt

  by @alinaqi

  Offload large / multi-file reads to a cheap worker model so raw files never enter Claude's context (token savings)

• Autonomous Testing

  by @alinaqi

  AI-driven testing agent that auto-discovers, generates, executes, evaluates, and fixes tests for any project type

• External Model Delegation

  by @alinaqi

  UserPromptSubmit hook pattern that classifies prompts into six cost tiers and delegates to external model CLIs

• Visual Validation

  by @alinaqi

  Autonomous screenshot verification — captures, compares, and AI-evaluates UI changes for visual regressions

• Ticket Craft

  by @alinaqi

  Create Jira/Asana/Linear tickets optimized for Claude Code execution - AI-native ticket writing

• Aeo Optimization

  by @alinaqi

  AI Engine Optimization - semantic triples, page templates, content clusters for AI citations

• Flutter

  by @alinaqi

  Flutter development with Riverpod state management, Freezed, go_router, and mocktail testing

• Model Routing

  by @alinaqi

  9-tier model routing system with cascading classifier fallback and result auto-evaluation

• Existing Repo

  by @alinaqi

  Analyze existing repositories, maintain structure, setup guardrails and best practices

• Gemini Review

  by @alinaqi

  Google Gemini CLI code review with Gemini 2.5 Pro, 1M token context, CI/CD integration

• Android Kotlin

  by @alinaqi

  Android Kotlin development with Coroutines, Jetpack Compose, Hilt, and MockK testing

• Code Deduplication

  by @alinaqi

  Prevent semantic code duplication with capability index and check-before-write

• Azure Cosmosdb

  by @alinaqi

  Azure Cosmos DB partition keys, consistency levels, change feed, SDK patterns

• Database Schema

  by @alinaqi

  Schema awareness - read before coding, type generation, prevent column errors

• Ms Teams Apps

  by @alinaqi

  Microsoft Teams bots and AI agents - Claude/OpenAI, Adaptive Cards, Graph API

• Pwa Development

  by @alinaqi

  Progressive Web Apps - service workers, caching strategies, offline, Workbox

• Ai Models

  by @alinaqi

  Latest AI models reference - Claude, OpenAI, Gemini, Eleven Labs, Replicate

• Aws Dynamodb

  by @alinaqi

  AWS DynamoDB single-table design, GSI patterns, SDK v3 TypeScript/Python

• Reddit Ads

  by @alinaqi

  Reddit Ads API - campaigns, targeting, conversions, agentic optimization

• Firebase

  by @alinaqi

  Firebase Firestore, Auth, Storage, real-time listeners, security rules

• User Journeys

  by @alinaqi

  User experience flows - journey mapping, UX validation, error recovery

• Android Java

  by @alinaqi

  Android Java development with MVVM, ViewBinding, and Espresso testing

• Web Content

  by @alinaqi

  SEO and AI discovery (GEO) - schema, ChatGPT/Perplexity optimization

• Cloudflare D1

  by @alinaqi

  Cloudflare D1 SQLite database with Workers, Drizzle ORM, migrations

• Klaviyo

  by @alinaqi

  Klaviyo email/SMS marketing - profiles, events, flows, segmentation

• Medusa

  by @alinaqi

  Medusa headless commerce - modules, workflows, API routes, admin UI

• Agentic Development

  by @alinaqi

  Build AI agents with Pydantic AI (Python) and Claude SDK (Node.js)

• Base

  by @alinaqi

  Universal coding patterns, constraints, TDD workflow, atomic todos

• Codex Review

  by @alinaqi

  OpenAI Codex CLI code review with GPT-5.2-Codex, CI/CD integration

• Ui Testing

  by @alinaqi

  Visual testing - catch invisible buttons, broken layouts, contrast

• Aws Aurora

  by @alinaqi

  AWS Aurora Serverless v2, RDS Proxy, Data API, connection pooling

• Playwright Testing

  by @alinaqi

  E2E testing with Playwright - Page Objects, cross-browser, CI/CD

• Python

  by @alinaqi

  Python development with ruff, mypy, pytest - TDD and type safety

• Shopify Apps

  by @alinaqi

  Shopify app development - Remix, Admin API, checkout extensions

• Site Architecture

  by @alinaqi

  Technical SEO - robots.txt, sitemap, meta tags, Core Web Vitals

• Commit Hygiene

  by @alinaqi

  Atomic commits, PR size limits, commit thresholds, stacked PRs

• Project Tooling

  by @alinaqi

  gh, vercel, supabase, render CLI and deployment platform setup

• Llm Patterns

  by @alinaqi

  AI-first application patterns, LLM testing, prompt management

• Security

  by @alinaqi

  OWASP security patterns, secrets management, security testing

• Ui Mobile

  by @alinaqi

  Mobile UI patterns - React Native, iOS/Android, touch targets

• Posthog Analytics

  by @alinaqi

  PostHog analytics, event tracking, feature flags, dashboards

• Woocommerce

  by @alinaqi

  WooCommerce REST API - products, orders, customers, webhooks

• Nodejs Backend

  by @alinaqi

  Node.js backend patterns with Express/Fastify, repositories

• Ui Web

  by @alinaqi

  Web UI - glassmorphism, Tailwind, dark mode, accessibility

• Web Payments

  by @alinaqi

  Stripe Checkout, subscriptions, webhooks, customer portal

• Session Management

  by @alinaqi

  Context preservation, tiered summarization, resumability

• React Web

  by @alinaqi

  React web development with hooks, React Query, Zustand

• React Native

  by @alinaqi

  React Native mobile patterns, platform-specific code

• Reddit Api

  by @alinaqi

  Reddit API with PRAW (Python) and Snoowrap (Node.js)

• Credentials

  by @alinaqi

  Centralized API key management from Access.txt

• Supabase Python

  by @alinaqi

  FastAPI with Supabase and SQLAlchemy/SQLModel

• Typescript

  by @alinaqi

  TypeScript strict mode with eslint and jest

• Supabase Node

  by @alinaqi

  Express/Hono with Supabase and Drizzle ORM

• Supabase Nextjs

  by @alinaqi

  Next.js with Supabase and Drizzle ORM

• Owasp Security Code Review

  by @SpecterOps

  Perform evidence-driven security code reviews across application repositories, services, libraries, and pull requests. Use when Codex needs to audit source code for security flaws, map trust boundaries, verify authentication or…

• Cwe Code Review

  by @SpecterOps

  Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema semantics. Use when Codex needs to…

• Openssf Python Review

  by @SpecterOps

  Perform adversarial Python security code reviews grounded in the OpenSSF Secure Coding Guide for Python. Use when Codex needs to audit large Python repositories, recovered or decompiled Python source, Python services or scripts…

• Mythic Translation Containers

  by @SpecterOps

  Develop Mythic translation containers for custom agent wire formats, custom encryption/decryption, and Mythic-to-agent message conversion. Use when a payload type sets translation_container, when mythic_encrypts is false with…

• Linux Process Injection

  by @SpecterOps

  Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection, PTRACE_POKETEXT, GOT overwrite,…

• Openhound Okta

  by @SpecterOps

  Use for OpenHound Okta/OktaHound OpenGraph BloodHound work when the user clearly means Okta semantics such as Okta users, groups, apps, role assignments, super-admin or delegated-admin exposure, API clients and client secrets,…

• Ssh Ops

  by @SpecterOps

  Establish and operate scoped SSH sessions for authorized remote command execution with full evidence capture. Use when the operator provides SSH-accessible targets/credentials and Codex must execute commands on a remote host as…

• Source Research

  by @SpecterOps

  Fast topic research with source discovery, source quality evaluation, and concise synthesis. Use when looking up recent information, comparing sources, or producing a quick/detailed summary with citations.

• Webapp Review

  by @SpecterOps

  Web application security testing workflow and checklist generation. Use when planning or executing web app assessment steps, including auth, API, injection, and configuration testing.

• Security Review

  by @SpecterOps

  Perform a security-focused review of current git changes. Use when reviewing staged/unstaged diffs, checking for vulnerabilities, and deciding merge readiness.

• Finding Report

  by @SpecterOps

  Generate a structured pentest finding report in markdown. Use when documenting a vulnerability, writing up a finding, or creating engagement notes.

• Code Review

  by @SpecterOps

  Security-focused code review of current git changes. Use when reviewing code diffs, checking for vulnerabilities, or before merging branches.

• Go Review

  by @SpecterOps

  Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Covers authentication and authorization, request parsing, SSRF, SQL and command…

• Runtime Provisioner

  by @nealbridges

  VulnHunter sandbox-depth decision procedure. For each confirmed finding, classify its proof requirements, choose the cheapest sufficient sandbox (Docker container by default), record the runtime on the finding, and ensure…

• Vulnhunter Run

  by @nealbridges

  Unattended VulnHunter operator. Clone a repo, run the vulnhunt skill with this harness's own tools and subagents, then write and check the scan manifest. Does not call a model SDK and does not name a harness.

• Hermes Security Review

  by @OnlyTerp

  Review Hermes settings for security risks.

• Safe Project Organizer

  by @ananddtyagi

  Safely analyze and reorganize project structure with multi-stage validation, dry-run previews, and explicit user confirmation. Use when projects need cleanup, standardization, or better organization.

• Plugin Creator

  by @ananddtyagi

  Create, validate, and publish Claude Code plugins and marketplaces. Use this skill when building plugins with commands, agents, hooks, MCP servers, or skills.

• Supergoal

  by @robzilla1738

  Plan and autonomously build a software task end-to-end. Triggered by `/supergoal`, "plan and ship X", "supercharged plan", "autonomous build", "plan it out and don't stop until it's done", "I don't want to babysit this", or any…

• Desktop Gui Inspect

  by @automateyournetwork

  Full-desktop automation for targets that have no browser and no API at all — a legacy Java-based NMS client, a vendor's Windows-only configuration utility, a terminal emulator with no scriptable interface. Drives OpenClaw's…

• Azure Network Ops

  by @automateyournetwork

  Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets,…

• Azure Security Audit

  by @automateyournetwork

  Azure NSG compliance auditing and security posture assessment. CIS Azure Foundations Benchmark rules, effective security rule analysis, orphaned NSG detection. Use when auditing Azure NSGs for CIS compliance, checking for overly…