Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Auvik Lifecycle

  by @automateyournetwork

  Auvik device end-of-life posture, warranty/service coverage, and configuration backup history for refresh and renewal planning. Use when identifying devices past or approaching end-of-life, auditing warranty and service contract…

• Cisco Psirt Advisories

  by @automateyournetwork

  Check whether a running Cisco software version is affected by a published PSIRT security advisory - by OS version, CVE, or advisory ID, with severity and CVSS. Covers IOS, IOS-XE, NX-OS, ASA, FTD, FMC and ACI. Use when asked if…

• Clab Lab Management

  by @automateyournetwork

  ContainerLab network lab lifecycle management — authenticate, list, deploy, inspect, execute commands on, and destroy containerized network labs via the ContainerLab API. Use when deploying containerized network labs, spinning…

• Evpn Vxlan Fabric

  by @automateyournetwork

  EVPN/VXLAN fabric audit and troubleshooting — VTEPs, VNIs, route types, multihoming, underlay/overlay validation. Use when troubleshooting VXLAN overlay reachability, auditing leaf-spine fabric health, debugging silent hosts or…

• Fmc Firewall Ops

  by @automateyournetwork

  Cisco Secure Firewall FMC — access policy search, rule inspection, FTD device targeting, multi-FMC profile management. Use when searching firewall rules by IP or FQDN, checking if host A can reach host B through the firewall,…

• Aci Fabric Audit

  by @automateyournetwork

  Comprehensive Cisco ACI fabric health audit - node status, tenant/VRF/BD/EPG policy review, contract analysis, fault triage, and endpoint learning verification. Use when auditing ACI fabric health, checking for faults, reviewing…

• Gcp Compute Ops

  by @automateyournetwork

  Google Cloud Compute Engine — VM instances, disks, templates, instance groups, reservations, project discovery. Use when listing GCP VMs, troubleshooting a Compute Engine instance, checking disk attachments, planning capacity…

• Gait Session Tracking

  by @automateyournetwork

  GAIT session lifecycle management - branch creation, turn recording, audit logging for every NetClaw operation. Use when starting a new NetClaw session, recording a health check or config change, pinning a pre-change baseline,…

• Github Ops

  by @automateyournetwork

  GitHub repository operations — issues, PRs, code search, and config-as-code workflows. Use when creating a GitHub issue for a network finding, opening a pull request for a config change, searching repos for IP or VLAN…

• Aap Lint

  by @automateyournetwork

  ansible-lint playbook and role validation — syntax checking, best practice enforcement, project-wide analysis, rule filtering. Use when validating Ansible playbooks, checking code quality, or enforcing automation best practices…

• Aws Network Ops

  by @automateyournetwork

  AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN…

• Aws Architecture Diagram

  by @automateyournetwork

  AWS architecture diagrams — generate visual network topology diagrams from live AWS infrastructure. Use when drawing AWS network diagrams, visualizing VPCs, mapping Transit Gateway topology, or generating architecture…

• Aws Security Audit

  by @automateyournetwork

  AWS security auditing — IAM users/roles/policies, CloudTrail API events, security posture analysis. Use when auditing IAM permissions, investigating security incidents, checking MFA compliance, or tracing API activity in…

• Aap Eda

  by @automateyournetwork

  Event-Driven Ansible (EDA) — activation lifecycle, rulebook management, decision environments, event stream monitoring. Use when managing event-driven automation triggers, enabling/disabling activations, or reviewing EDA…

• Aws Cloud Monitoring

  by @automateyournetwork

  AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance. Use when checking AWS alarms, analyzing VPC flow logs, investigating network latency, or monitoring VPN and NAT Gateway metrics.

• Forward

  by @automateyournetwork

  Forward snapshot assurance, path search, app-aware path search, NQE, checks, vulnerabilities, diffs, configuration, lifecycle, collection, and topology workflows through the upstream forward-mcp server.

• Claroty Risk Triage

  by @automateyournetwork

  Triage Claroty xDome alerts and vulnerabilities, compute blast radius, correlate with NVD CVE data, and drive ITSM-gated workflow actions (acknowledge, label, assign, set relevance).

• Checkpoint

  by @automateyournetwork

  Inspect Check Point security policies, threat intelligence, gateways, and SASE through its MCP integrations. Use for Check Point platform questions or workflows.

• Defenseclaw Ops

  by @automateyournetwork

  Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails

• Cloudflare Zerotrust

  by @automateyournetwork

  Inspect Cloudflare Zero Trust access applications, policies, tunnels, and CASB findings.

• Cloudflare Security

  by @automateyournetwork

  Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.

• Datadog Logs

  by @automateyournetwork

  Search and analyze logs in Datadog Log Management.

• Plan Architecture

  by @coleam00

  Interactively explore HOW to approach an intent (a PRD, epic, brief, or free-form idea) and decide the high-level architecture — the approach, stack, libraries, data shape, and risks the intent left open. A working session with…

• Plan Create Prd

  by @coleam00

  Interactive, problem-first PRD generator — interviews the user to surface the thesis (the problem, and WHY build it) and a falsifiable hypothesis, then writes a focused PRODUCT-level PRD (problem · evidence · hypothesis · users…

• Piv Review Pr

  by @coleam00

  Full pull-request review — fetch the PR, run the project's validation, review the diff with fresh eyes (dispatching the code-reviewer agent), categorize issues by severity, post the review to GitHub (approve / request-changes /…

• Feature Planning

  by @mhattingpete

  Break down feature requests into detailed, implementable plans with clear tasks. Use when user requests a new feature, enhancement, or complex change.

• Codebase Documenter

  by @mhattingpete

  Generates comprehensive documentation explaining how a codebase works, including architecture, key components, data flow, and development guidelines. Use when user wants to understand unfamiliar code, create onboarding docs,…

• Code Auditor

  by @mhattingpete

  Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess…

• Dependency Update Bot

  by @Varnan-Tech

  Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch, minor, major). Includes…

• Pricing Page Psychology Audit

  by @Varnan-Tech

  Audits any SaaS pricing page URL against 12 pricing psychology principles and outputs a ranked improvement report with specific rewrite suggestions and quick wins.

• Agent Registry

  by @sundial-org

  MANDATORY agent discovery system for token-efficient agent loading. Claude MUST use this skill instead of loading agents directly from ~/.claude/agents/ or .claude/agents/. Provides lazy loading via search_agents and get_agent…

• Bluesky

  by @sundial-org

  Read, post, and interact with Bluesky (AT Protocol) via CLI. Use when user asks to check Bluesky, post to Bluesky, view their Bluesky timeline, search Bluesky, or check Bluesky notifications. Supports timeline, posting, profile…

• Aws Infra

  by @sundial-org

  Chat-based AWS infrastructure assistance using AWS CLI and console context. Use for querying, auditing, and monitoring AWS resources (EC2, S3, IAM, Lambda, ECS/EKS, RDS, CloudWatch, billing, etc.), and for proposing safe changes…

• Api Credentials Hygiene

  by @sundial-org

  Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability). Use when integrating services or preparing production deployments where secrets must be managed safely.

• Apple Notes

  by @sundial-org

  Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks Clawdbot to add a note, list notes, search notes, or manage note folders.

• Auth Checker

  by @sundial-org

  Audit authentication flows for security vulnerabilities

• Code Review

  by @evanca

  Use when asked to review a PR, MR, branch, or diff, audit changed files, or check code quality.

• Firebase Data Connect

  by @evanca

  Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.

• Firebase Ai

  by @evanca

  Use when setting up firebase_ai, generating text/chat with Gemini, streaming AI output, building multimodal prompts, or handling AI errors.

• Firebase Auth

  by @evanca

  Use when setting up auth, managing auth state, implementing email/password or social sign-in, handling auth errors, or managing users.

• Firebase Storage

  by @evanca

  Use when setting up Storage, uploading/downloading files, managing metadata, handling errors, or applying security rules.

• Chisle Audit

  by @JayPokale

  One-shot efficiency audit of a file, diff, or whole repo across BOTH axes at once: over-engineered code (reinvented stdlib, needless abstractions, speculative config) AND bloated prose (verbose comments, padded docstrings,…

• Chisle Help

  by @JayPokale

  Quick-reference card for Chisle commands. One-shot display, not a persistent mode. Use when the user says "chisle help", "how do I use chisle", "what chisle commands", or invokes /chisle-help.

• Swamp

  by @swamp-club

  Swamp CLI — create and run models, build and validate workflows, query and manage data, store and retrieve vault secrets, develop and publish extensions, initialize repos, run reports, file issues, and troubleshoot errors.…

• Agent Browser

  by @EXboys

  Browser automation CLI for AI agents. Requires Node.js with agent-browser. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data,…

• Issue Lifecycle

  by @swamp-club

  Drive the @swamp/issue-lifecycle model for interactive issue triage and plan iteration against swamp-club lab issues. Use when the user wants to triage a swamp-club issue, generate an implementation plan, or iterate on a plan…

• Firecrawl

  by @firecrawl

  Any live-web task via the Firecrawl CLI — including ordinary web research: searching the web, reading or extracting pages, gathering sources, discovering site URLs, bulk extraction, downloading a site, change alerts, or pages…

• Firecrawl Map

  by @firecrawl

  Discover and list a site's URLs, with search filtering. Use for "map the site" or "find the URL for" requests — when the user knows the site but not the exact page, or wants site structure.

• Firecrawl Crawl

  by @firecrawl

  Bulk-extract many pages from one site or section. Use for "crawl", "everything under /docs", or content spanning linked pages.

• Light Software Copyright

  by @Light0305

  Prepare China software copyright registration material drafts from a real software project: application-field worksheet, source-code deposit material, user/operation manual, screenshots when needed, consistency checks and local…

• TRIP Compact

  by @PiLastDigit

  Compact ARCHI.md when it exceeds recommended size - smart compression without losing relevance; --sync audits it against the codebase instead

• Refactoring Analysis

  by @pedronauck

  Audit code quality and architectural health or plan refactoring using Fowler code smells and techniques; write prioritized findings to docs/_refacs/. Excludes formatting, performance, and security audits.

• Architectural Analysis

  by @pedronauck

  Audit architecture, dead code, duplication, type confusion, and code smells across a codebase. Excludes formatting, performance profiling, security audits, and feature-level reviews.

• Electron Dev

  by @pedronauck

  Expert guide for Electron development with Electron Vite and Electron Builder. Use when developing Electron applications, working with main/renderer processes, IPC communication, preload scripts, security configuration, native…

• Sec Check

  by @waynesutton

  Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Use when reviewing code that touches user data, PII, or access control.

• Tech Debt Audit

  by @ksimback

  Thorough, user-invoked tech debt and architecture audit of the current codebase. Produces TECH_DEBT_AUDIT.md with file-cited findings, severity, effort estimates, and a required "looks bad but is actually fine" section. Use when…

• Nw Architecture Patterns

  by @nWave-ai

  Comprehensive architecture patterns, methodologies, quality frameworks, and evaluation methods for solution architects. Load when designing system architecture or selecting patterns.

• Nw Po Review Dimensions

  by @nWave-ai

  Requirements quality critique dimensions for peer review - confirmation bias detection, completeness validation, clarity checks, testability assessment, and priority validation

• Nw Par Critique Dimensions

  by @nWave-ai

  Platform design review critique dimensions and severity levels. Load when reviewing CI/CD pipelines, infrastructure, deployment strategies, observability, or security designs.

• Nw Cicd And Deployment

  by @nWave-ai

  CI/CD pipeline design methodology, deployment strategies, GitHub Actions patterns, and branch/release strategies. Load when designing pipelines or deployment workflows.

• Nw Production Safety

  by @nWave-ai

  Agent safety boundaries - input validation, output filtering, scope constraints, and document creation policy

• Nw Der Review Criteria

  by @nWave-ai

  Evaluation criteria and scoring for data engineering artifact reviews

• Beads

  by @ynulihao

  Tracks complex, multi-session work using the Beads issue tracker and dependency graphs, and provides persistent memory that survives conversation compaction. Use when work spans multiple sessions, has complex dependencies, or…

• 11 Thiet Lap Kenh

  by @minhnv0807

  Dung khi can MO va thiet lap kenh marketing tu con so khong — TikTok Brand, Zalo OA, Fanpage, Instagram Business, Google Business Profile, TikTok Shop, tai khoan email: checklist setup 4 giai doan, thong so ky thuat, lien ket…

• Json Schema Emails

  by @provos

  Canonical shape of the .workflow/emails/emails.json file passed between the fetch and summarize states — required fields (sender, recipient, subject, date, body), types, and field semantics. Read this whenever you write or read…

• Semia

  by @berabuddies

  Audit an agent skill with Semia inside Claude Code. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", or audit a skill/plugin for behavior risk.

• Harness Design Fuzzing

  by @provos

  Reference vocabulary for designing instrumented harnesses that drive vulnerability discovery — design classes (trigger-driven vs coverage-driven), tiered scope (T1 isolated function / T2 multi-component / T3 full build),…

• Vulnerability Triage

  by @provos

  Reference vocabulary for interpreting vulnerability findings — detector-vs-impact distinction, severity anchoring on demonstrated evidence, the eleven-item interpretation rubric, delegation transparency, primitive-extent…

• Memory Safety C Cpp

  by @provos

  Reference vocabulary for memory-safety vulnerabilities in native C/C++ code — bug-class taxonomy, common arithmetic patterns that lead to corruption, dispatch-family discipline, type-confusion idioms, use-after-free patterns,…

• Gmail Query Syntax

  by @provos

  Reference for Gmail's search query syntax — operators like is:sent, newer_than:, from:, has:attachment, label:, and how they compose. Read this when constructing a Gmail search query string for the…

• Fabric

  by @ynulihao

  Intelligent pattern selection for Fabric CLI. Automatically selects the right pattern from 242+ specialized prompts based on your intent - threat modeling, analysis, summarization, content creation, extraction, and more. USE…

• Email Formatting

  by @provos

  Markdown formatting conventions for email summary documents — heading depth, list style, line length, emoji policy, and a mandatory provenance footer. Read this when producing a markdown report that summarizes one or more email…

• Summary Style Guide

  by @provos

  Tone and length conventions for email summaries — voice, verb tense, what to include vs omit, and target sentence count. Read this when writing the prose Summary line for each email so the voice is consistent across the report.

• Openqodex

  by @openqodex

  Code review for the current change, before it is pushed. One command runs the security, secret, dependency and lint scanners that fit the changed files, a separate reviewer that checks every scanner finding and is given every…

• Bggg Data X

  by @binggandata

  Collect auditable public X/Twitter posts by controlling the user's already logged-in Chrome, searching X's rendered web interface, scrolling visible results, and extracting original post text and metadata from DOM into…

• Bggg Data Reddit

  by @binggandata

  Collect auditable Reddit search results and full comment trees at scale, preserve the source JSON, and normalize posts and comments into analysis-ready JSONL. Use for VOC, market research, community discovery, keyword…

• Pdca Fast Track

  by @ww-w-ai

  Daniel-mode fast-track auto-approves Checkpoint 1-8 when Trust ≥ 80, fastTrack on, Design doc exists. Else L2 + manual gates. Triggers: pdca fast-track, skip checkpoints, auto approve

• Pdca Watch

  by @ww-w-ai

  Live PDCA dashboard ticking every 30s — reads pdca-status.json + token-ledger.ndjson tail, renders fixed-width panel via CC /loop. Triggers: pdca watch, live dashboard, watch progress

• Bkit Explore

  by @ww-w-ai

  Browse installed bkit skills, agents, and evals via lib/discovery/explorer.js (filesystem scan, no subprocess). Triggers: bkit explore, list skills, skill discovery, browse skills

• Bkend Auth

  by @ww-w-ai

  bkend.ai authentication — email/social login, JWT tokens, RBAC, session management. Triggers: bkend auth, bkend login, bkend signup, bkend JWT, bkend RBAC

• Code Review

  by @ww-w-ai

  Code review — analyze quality, detect bugs, ensure best practices with actionable feedback. Triggers: code review, quality check, bug detection

• Phase 2 Convention

  by @ww-w-ai

  Define coding rules, conventions, and standards for AI collaboration. Triggers: convention, coding style, lint, rules

• Validate Changes Match Specs

  by @warpdotdev

  Validate that a branch or pull request implementation matches introduced product, technical, security, and related specs. Use when reviewing or finishing a spec-driven change and resolving mismatches between checked-in specs and…

• Seo Answer Visibility

  by @markfulton

  Observe answer visibility for approved buyer questions, audit discoverability and file evidence-backed improvement cards.

• Gmgn Contract Dd

  by @GMGNAI

  Contract due-diligence score for one token address — contract safety, holder structure and price action combined into a single 0-100 composite, capped by GMGN's own rug label, where every deduction names the field it read and an…

• Gmgn Token

  by @GMGNAI

  Research any crypto or meme token by address — real-time price, market cap, liquidity, holder list, trader list, top Smart Money and KOL positions, security audit (honeypot, rug pull risk, dev wallet, renounced status), social…

• Angular Routing

  by @analogjs

  DEPRECATED - this skill is unmaintained. Use the official Angular skills at https://github.com/angular/skills instead. Implement routing in Angular v20+ applications with lazy loading, functional guards, resolvers, and route…

• Specialize

  by @sharpdeveye

  Use when the user wants to tailor a workflow for a specific industry, domain, or vertical with specialized expertise, terminology, and guardrails.

• Guard

  by @sharpdeveye

  Use when deploying to production, handling sensitive data, or the workflow needs safety constraints, input validation, and security boundaries.

• Fortify

  by @sharpdeveye

  Use when the workflow lacks error handling, has been failing in production, or needs retry logic, fallback strategies, and circuit breakers.

• Ai Answer Gap

  by @unifapi-agent

  When the user wants to find the prompts where their brand should be cited in AI answers but isn't — and who owns the answer instead — prioritized by AI search volume so content can attack the biggest gaps first. Also use on "AI…

• Cloud Provisioning

  by @elastic

  Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects (Elasticsearch, Observability, Security); manage traffic filters (IP and AWS PrivateLink network security); and…

• Kibana Alerting Rules

  by @elastic

  Create and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.

• Cloud Onboarding

  by @elastic

  Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default region, then invite users, assign predefined or custom Serverless project roles, and create or revoke Cloud API…

• Elasticsearch Cluster Health

  by @elastic

  Diagnose a non-green Elasticsearch cluster and surface the single most likely cause with remediation. Use when an operator reports yellow or red status, unassigned shards, allocation failures, or wants read-only triage before…

• Cavecrew

  by @stevesolun

  Decision guide for delegating to caveman-style subagents. Tells the main thread WHEN to spawn `cavecrew-investigator` (locate code), `cavecrew-builder` (1-2 file edit), or `cavecrew-reviewer` (diff review) instead of doing the…

• Toolbox

  by @stevesolun

  Pre/post dev toolbox — named bundles of skills/agents loaded before development work and councils of experts invoked after. Run /toolbox or the toolbox.py CLI to list, activate, initialize, export, import, and validate…

• Agents Md Protocol

  by @stevesolun

  Create or review an AGENTS.md file so coding agents get stable repo-local instructions: environment setup, testing, style, security boundaries, PR policy, and handoff rules. Use when a repo lacks durable agent guidance or when a…

• Find Skills

  by @stevesolun

  Discover installable agent skills from ctx's shipped Skills.sh catalog, the Skills.sh search API, and the npx skills CLI. Use when a user asks whether a skill exists, wants to add/update a skill, or needs a repeatable procedure…

• Baoyu Post To Wechat

  by @ECNU-ICALK

  Posts content to WeChat Official Account (微信公众号) via API or Chrome CDP. Supports article posting (文章) with HTML, markdown, or plain text input, and image-text posting (贴图, formerly 图文) with multiple images. Use when user…