Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• 1password

  by @Tommy-yw

  Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

• Researchers Security

  by @bitwize-music-studio

  Researches malware analysis, CVEs, attribution reports, and hacker community sources. Use when the album subject involves cybersecurity incidents or threat actors.

• Researchers Gov

  by @bitwize-music-studio

  Researches DOJ/FBI/SEC press releases, agency statements, and government sources. Use when research needs official government records or agency documentation.

• Ops Orchestrate

  by @Lifecycle-Innovations-Limited

  OPS on-demand: This skill should be used when the user asks to "orchestrate projects", "dispatch…

• Ops Home

  by @Lifecycle-Innovations-Limited

  OPS on-demand: This skill should be used when the user asks to "homey", "smart home", or…

• Ops Aws Audit

  by @Lifecycle-Innovations-Limited

  OPS on-demand: This skill should be used when the user asks to "audit AWS", "unused AWS resources", or…

• Ops Credentials

  by @Lifecycle-Innovations-Limited

  OPS on-demand: This skill should be used when the user asks to "which keys are set", "missing…

• Ops Mac

  by @Lifecycle-Innovations-Limited

  OPS on-demand: This skill should be used when the user asks to "mac is slow", "macos fix", or…

• Huggingface Llm Trainer

  by @waybarrios

  Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.

• Sharp Edges

  by @waybarrios

  Identify error-prone APIs, dangerous configuration, and footgun designs that enable security mistakes. Use for API ergonomics, misuse resistance, secure defaults, or pit-of-success reviews; use code-review for general defects.

• Variant Analysis

  by @waybarrios

  Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after…

• Agentic Actions Auditor

  by @waybarrios

  Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.

• Fp Check

  by @waybarrios

  Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.

• Semgrep

  by @waybarrios

  Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis. Use when Semgrep or a static-analysis scan is requested; use security-review for a manual audit.

• Differential Review

  by @waybarrios

  Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates…

• Security Threat Model

  by @waybarrios

  Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.

• Insecure Defaults

  by @waybarrios

  Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable…

• Vuln Report

  by @waybarrios

  Turn one confirmed security finding into a disclosure-ready GitHub advisory with root cause, proof of concept, impact, and source evidence. Use for reporting an established vulnerability, not discovering or validating one.

• Supply Chain Risk Auditor

  by @waybarrios

  Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

• Security Review

  by @waybarrios

  Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit,…

• Journey Auth

  by @butterbase-ai

  Use as the auth build stage of the Butterbase journey, after journey-schema (and rls if separate). Implements the Auth section of 02-plan.md by delegating to auth-setup. Calls manage_oauth (configure) for providers and…

• Auth Setup

  by @butterbase-ai

  Use when configuring OAuth providers (Google/GitHub/Apple/X/etc.), setting up post-login auth hooks, tuning JWT lifetimes, or generating service API keys

• Google Analytics

  by @kwakseongjae

  Analyze Google Analytics data, review website performance metrics, identify traffic patterns, and suggest data-driven improvements. Use when the user asks about analytics, website metrics, traffic analysis, conversion rates,…

• Differential Review

  by @vibeeval

  Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs,…

• Fp Check

  by @vibeeval

  Systematic false positive verification for security findings. Provides structured methodology to confirm or dismiss scanner results, manual audit findings, and automated alerts. Adapted from Trail of Bits. Use when triaging…

• Codex Orchestration

  by @vibeeval

  OpenAI Codex CLI + Claude Code (Hizir) birlikte kullanim rehberi. Is dagitim pattern'leri, GitHub Actions workflow ornekleri, review dongusu ve iki AI yazilim asistaninin guclu yanlarini birlestiren orchestration stratejileri.

• Agent Benchmark

  by @vibeeval

  Framework for measuring and tracking agent response quality over time. Detects regressions before they reach production. Use when evaluating agent changes, auditing quality, or establishing performance baselines.

• Cto Advisor

  by @vibeeval

  CTO-level advisory - build vs buy decisions, tech debt quantification, team scaling, ADRs, technology evaluation (RICE), budget planning, TCO, vendor management, DORA/SPACE metrics

• Django Security

  by @vibeeval

  Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

• Achievements

  by @vibeeval

  Steam-style achievement system with XP, levels, streaks, and skill trees. Gamifies the development workflow. 25 achievements across 5 categories.

• Django Patterns

  by @vibeeval

  Django architecture patterns, REST API design with DRF, ORM best practices, caching, signals, middleware, and production-grade Django apps.

• Compliance Patterns

  by @vibeeval

  GDPR data handling, audit logging, data classification, retention policies, and consent management for regulatory compliance.

• Config Security Scan

  by @vibeeval

  Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions

• Ci Pipeline Patterns

  by @vibeeval

  GitHub Actions workflow templates, matrix builds, caching, and monorepo CI strategies

• Developer Relations

  by @vibeeval

  Developer relations - community building, documentation, DevRel metrics.

• Occ Diagnose

  by @ruvnet

  Diagnose Open Claude Code installation, provider authentication, skill discovery, and CLI failures. Use when OCC fails to start, returns errors, or cannot find an installed skill.

• Displaying Timelines

  by @ancoleman

  Displays chronological events and activity through timelines, activity feeds, Gantt charts, and calendar interfaces. Use when showing historical events, project schedules, social feeds, notifications, audit logs, or time-based…

• Architecting Security

  by @ancoleman

  Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001). Use when designing security for new systems,…

• Implementing Compliance

  by @ancoleman

  Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance,…

• Managing Vulnerabilities

  by @ancoleman

  Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines. Use when building DevSecOps workflows, ensuring compliance, or…

• Implementing Service Mesh

  by @ancoleman

  Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when…

• Security Hardening

  by @ancoleman

  Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles. Use when hardening production infrastructure, meeting compliance requirements, or implementing…

• Implementing Tls

  by @ancoleman

  Configure TLS certificates and encryption for secure communications. Use when setting up HTTPS, securing service-to-service connections, implementing mutual TLS (mTLS), or debugging certificate issues.

• Designing Apis

  by @ancoleman

  Design APIs that are secure, scalable, and maintainable using RESTful, GraphQL, and event-driven patterns. Use when designing new APIs, evolving existing APIs, or establishing API standards for teams.

• Securing Authentication

  by @ancoleman

  Authentication, authorization, and API security implementation. Use when building user systems, protecting APIs, or implementing access control. Covers OAuth 2.1/OIDC, JWT patterns, sessions, Passkeys/WebAuthn, RBAC/ABAC/ReBAC,…

• Revyl Cli Auth Bypass

  by @RevylAI

  Set up test-only auth bypass for Revyl runs across Expo, React Native, native iOS, native Android, and Flutter apps.

• Hunter

  by @codexstar69

  Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework…

• Skeptic

  by @codexstar69

  Adversarial code reviewer for Bug Hunter. Rigorously challenges each reported bug to determine if it's real or a false positive. Uses doc-lookup (Context Hub + Context7) to verify framework claims before disproval. The immune…

• Revyl Cli Cross Platform Review

  by @RevylAI

  Find meaningful visual differences between confidently matched iOS and Android app states in Revyl Atlas. Use for cross-platform reviews, not missing-screen or feature-coverage audits.

• Revyl Cli Figma Review

  by @RevylAI

  Guide a Figma frame or component review against observed app evidence in Revyl Atlas, with findings in chat, a local visual report, or explicitly requested Atlas annotations.

• Security Review

  by @codexstar69

  Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or…

• Threat Model Generation

  by @codexstar69

  Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs…

• Commit Security Scan

  by @codexstar69

  Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison…

• Vulnerability Validation

  by @codexstar69

  Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a…

• Signal Deploy

  by @nightly-labs

  Check and deploy Signal (the `remote-api` service in `remote/`) to production from a release tag. Use when asked to deploy, redeploy, update or roll back Signal, to check that a Signal deployment has all its secrets and no…

• Repository Threat Model

  by @nightly-labs

  Produce a repository-grounded application security threat model with assets, boundaries, abuse paths, priorities, and mitigations. Use only when threat modeling is explicitly requested.

• Flounder

  by @adshao

  Operates Flounder, an autonomous white-hat security auditor. Use when a user asks for a security audit, bug-bounty review, vulnerability investigation, or exploit proof for a public-source or authorized repository, source tree,…

• Heartbeat

  by @MagicCube

  Proactive intelligence pulse — scans user's memory files (USER.md, SOUL.md) to identify current interests, investments, projects, and concerns, then performs targeted web searches to find noteworthy updates. Returns a concise…

• 04 Audit

  by @ai-driven-dev

  Audit a codebase read-only across seven quality pillars into one ranked report. Use when the user wants to assess, health-check, or audit a codebase or one pillar. Not for fixing findings, reviewing a change, or checking a…

• 07 Refactor

  by @ai-driven-dev

  Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove code. Not for read-only…

• Crypto Report

  by @claude-office-skills

  Analyze cryptocurrency projects with tokenomics, on-chain metrics, and market analysis. Generate comprehensive crypto research reports.

• Changelog Generator

  by @claude-office-skills

  Generate release notes from git commits, updates, or feature lists

• Wooyun Legacy

  by @trailofbits

  Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws,…

• Ghidra Headless

  by @trailofbits

  Reverse engineers binaries using Ghidra's headless analyzer. Use when decompiling executables, extracting functions, strings, symbols, or analyzing call graphs from compiled binaries without the Ghidra GUI.

• Openai Security Ownership Map

  by @trailofbits

  Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly…

• Openai Security Threat Model

  by @trailofbits

  Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat…

• Ffuf Web Fuzzing

  by @trailofbits

  Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis.…

• Security Awareness

  by @trailofbits

  Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense. Use when building or operating agents that…

• Broken Authentication Testing

  by @Dokhacgiakhoa

  This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session…

• Burp Suite Web Application Testing

  by @Dokhacgiakhoa

  This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or…

• Browser Extension Builder

  by @Dokhacgiakhoa

  Expert in building browser extensions that solve real problems - Chrome, Firefox, and cross-browser extensions. Covers extension architecture, manifest v3, content scripts, popup UIs, monetization strategies, and Chrome Web…

• Agent Security Review

  by @Dokhacgiakhoa

  Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

• Api Patterns

  by @Dokhacgiakhoa

  API design principles and decision-making.

• Api Documenter

  by @Dokhacgiakhoa

  Master API documentation with OpenAPI 3.1.

• Clerk Auth

  by @Dokhacgiakhoa

  Expert patterns for Clerk auth implementation, middleware, organizations, webhooks, and user sync Use when: adding authentication, clerk auth, user authentication, sign in, sign up.

• Agent Orchestration

  by @Dokhacgiakhoa

  Multi-agent orchestration and state management.

• Cds Rn To Compose

  by @coinbase

  Guide for porting CDS React Native components to Jetpack Compose in packages/cds-android, and for auditing existing Android ports for completeness and quality. USE THIS whenever the user asks to port, migrate, or bring a CDS…

• Ci Orchestrator

  by @pilinux

  Run a CI-like pipeline locally (format, lint, vet, static-analysis, tests) and summarize per-step results with remediation guidance.

• Logs Repro Harness

  by @pilinux

  Reduce flaky or environment-dependent failures to a minimal, reproducible script and capture the exact logs and error lines.

• Dependency Auditor

  by @pilinux

  Inspect Go module dependencies, detect outdated or vulnerable modules, and recommend safe updates or pinning strategies.

• Fix Suggester

  by @pilinux

  Diagnose failures and propose minimal, test-backed fixes with verification and rollback instructions.

• Safe Edit Simulator

  by @pilinux

  Produce a dry-run diff plus a risk checklist and rollback plan for any potentially disruptive change.

• Assumption Stress Test

  by @yogsoth-ai

  Surface load-bearing assumptions, classify vulnerability, challenge or perturb them, and re-check causal logic.

• Plugin Creator

  by @deonmenezes

  Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a…

• Babysit Pr

  by @deonmenezes

  Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky…

• Codex Issue Digest

  by @deonmenezes

  Run a GitHub issue digest for openai/codex by feature-area labels, all areas, and configurable time windows. Use when asked to summarize recent Codex bug reports or enhancement requests, especially for owner-specific labels such…

• Update V8 Version

  by @deonmenezes

  Update Codex's pinned `v8` / `rusty_v8` versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update `rusty_v8` artifacts, prepare or validate a V8 release…

• Codex Bug

  by @deonmenezes

  Diagnose GitHub bug reports in openai/codex. Use when given a GitHub issue URL from openai/codex and asked to decide next steps such as verifying against the repo, requesting more info, or explaining why it is not a bug; follow…

• Mantis Pipeline

  by @deonmenezes

  The master Mantis playbook -- how to run an authorized vulnerability-discovery engagement end to end, which subagent owns each stage, which MCP tool feeds it, and how findings move through the tool-owned lifecycle

• Http Evidence

  by @deonmenezes

  Turn a captured HTTP request/response into a bounded, redacted evidence pack with a stable request-ref using the mantis_http_audit MCP server, instead of pasting raw traffic into a finding

• Detection Breadth

  by @deonmenezes

  When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain

• Program Analysis

  by @deonmenezes

  Use ast_grep_scan, source_sink_scan, and smt_check_reachability (mantis_program_analysis MCP server) to move a candidate toward a proven-reachable finding

• Path Types

  by @deonmenezes

  Choose Rust types for operating system paths across the Codex repository. Use when defining new path-bearing types or explicitly migrating existing ones.

• Canary Tripwire Response

  by @deonmenezes

  What to do if a mantis_canary decoy tool ever shows up as tempting or gets called -- treat it as a security incident, not a normal tool result

• Findings Spine

  by @deonmenezes

  Record and advance every vulnerability finding through the tool-owned mantis_findings service instead of tracking findings in prose

• Secrets Scan

  by @deonmenezes

  Run trufflehog via the mantis_trufflehog MCP server and handle secret findings without ever exposing the raw secret

• Semgrep Triage

  by @deonmenezes

  Run semgrep via the mantis_semgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle

• Codeql Audit

  by @deonmenezes

  Build a CodeQL database and run dataflow-backed query-suite analysis via the mantis_codeql MCP server

• Osv Dependency Scan

  by @deonmenezes

  Run osv-scanner via the mantis_osv_scanner MCP server for SCA (vulnerable dependency) findings

• Pushing Ci Changes

  by @deonmenezes

  Pushing GitHub Actions changes, resolving push rejection, requesting upload exceptions.