Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Writing Sigma Rules

  by @trilwu

  Author and maintain Sigma detection rules — structure, logsource taxonomy, detection logic with modifiers, false-positive filtering, backend conversion with pySigma, and offline validation with Hayabusa or Chainsaw. Use when…

• Reversing Network Protocols

  by @trilwu

  Reverse engineer undocumented binary network protocols from packet captures and the client that speaks them — recovering framing and field structure, identifying length prefixes, opcodes, checksums and encryption, and building a…

• Analyzing Memory Images

  by @trilwu

  Analyze volatile memory images (RAM dumps) using Volatility 3 — process enumeration, injected code detection, credential extraction, network artifacts, rootkit analysis, and timeline construction from memory-resident data. Use…

• Mapping Attack Techniques

  by @trilwu

  Navigate security work by MITRE ATT&CK tactic and technique — resolve a technique ID or name to the right skill, map a threat intel report or adversary emulation plan to procedures, and run the purple-team loop from technique to…

• Analyzing Dotnet Assemblies

  by @trilwu

  Reverse engineer .NET assemblies and executables with dnSpyEx, ILSpy, and de4dot — identifying and unwrapping obfuscators and packers, deobfuscating control flow and string encryption, handling single-file and NativeAOT…

• Analyzing Ios Binaries

  by @trilwu

  Analyze iOS applications at the binary level — decrypting FairPlay-protected IPAs with frida-ios-dump or bagbak, inspecting Mach-O load commands, recovering Objective-C headers with class-dump, and reading Swift metadata. Use…

• Attacking Grpc Protobuf

  by @trilwu

  Test gRPC and Protocol Buffers services — recovering .proto definitions from server reflection or compiled descriptors, calling methods with grpcurl and grpcui, intercepting HTTP/2 and gRPC-Web traffic, and fuzzing unknown…

• Unpacking Protected Binaries

  by @trilwu

  Unpack and dump protected executables — UPX and commodity packers, custom crypters, commercial protectors like Themida and VMProtect, and .NET packers — by finding the original entry point, dumping from memory, and rebuilding…

• Reversing Flutter Apps

  by @trilwu

  Reverse engineer and intercept traffic from Flutter/Dart mobile apps using blutter, reFlutter, and Frida. Use when an APK or IPA contains libflutter.so, libapp.so, App.framework, or flutter_assets, when jadx shows only a thin…

• Auditing Supply Chain

  by @trilwu

  Audit software supply chain risk — dependency and transitive package review, typosquatting and dependency confusion, lockfile and SBOM analysis, CI/CD pipeline and GitHub Actions security, build provenance, and secrets exposure.…

• Hunting Threats

  by @trilwu

  Run hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry using stack counting, outlier analysis, and ATT&CK-based hypotheses, with SIEM query patterns for Splunk, KQL, and Elastic. Use when…

• Reversing Xamarin Maui

  by @trilwu

  Reverse engineer Xamarin and .NET MAUI mobile apps by extracting assemblies.blob and XALZ-compressed DLLs with pyxamstore, then decompiling with dnSpy or ILSpy. Use when an APK contains libmonodroid.so, libmonosgen,…

• Responding To Incidents

  by @trilwu

  Run digital forensics and incident response — triage, evidence acquisition with chain of custody, host and cloud artifact analysis, timeline reconstruction, scoping, containment, eradication, and postmortem. Use during a…

• Reviewing Cryptography

  by @trilwu

  Review cryptographic implementations and protocol usage for misuse — weak primitives, nonce and IV handling, key management, authentication of ciphertext, randomness, timing side channels, TLS and JWT configuration, and password…

• Reversing React Native Apps

  by @trilwu

  Reverse engineer React Native mobile apps, including Hermes bytecode bundles, using hbctool, hermes-dec, and Frida. Use when an APK contains index.android.bundle or libhermes.so, when an IPA contains main.jsbundle, when jadx…

• Reporting Security Findings

  by @trilwu

  Write security findings and assessment reports — severity scoring with CVSS and business impact, reproducible proof of concept, remediation guidance, executive summaries, and coordinated disclosure. Use when writing up a…

• Engineering Detections

  by @trilwu

  Build, test, and tune detection content — Sigma, YARA, Suricata, and EDR/SIEM queries — mapped to MITRE ATT&CK with explicit false-positive analysis and detection-as-code practices. Use when writing or reviewing a detection…

• Analyzing Binaries

  by @trilwu

  Reverse engineer compiled binaries, firmware, and mobile app packages using triage, static disassembly, decompilation, and dynamic instrumentation. Use when analyzing an executable, ELF/PE/Mach-O file, firmware image, or…

• Reviewing Code Changes

  by @trilwu

  Perform a security review of a diff, branch, or pull request — assessing what the change introduces, weakens, or exposes, with a triage-first workflow and false-positive discipline. Use when asked to security review a PR or…

• Reversing Unity Il2cpp

  by @trilwu

  Reverse engineer Unity games and apps built with IL2CPP or Mono, using Il2CppDumper, Il2CppInspector, and dnSpy. Use when an APK or IPA contains global-metadata.dat, libil2cpp.so, UnityFramework, or Assembly-CSharp.dll, when…

• Analyzing Malware

  by @trilwu

  Analyze suspected malware safely — containment, static triage, sandboxed detonation, unpacking, capability and C2 extraction, IOC production, and YARA rule authoring. Use when handed a suspicious file, hash, or sample, when…

• Attacking Active Directory

  by @trilwu

  Attack and enumerate Active Directory environments using Kerberos attacks (Kerberoasting, ASREPRoasting), credential dumping (DCSync, Mimikatz), lateral movement (PtH, PtT), and BloodHound analysis. Use when pentesting Windows…

• Find Duplicate Ownership

  by @instructa

  Find duplicate ownership, hidden second sources of truth, and contract drift in layered codebases. Use when reviewing normalization, validation, defaulting, canonicalization, persistence mapping, runtime-vs-durable state,…

• Secleak Check

  by @instructa

  Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks,…

• Claude Code Templates

  by @happycapy-ai

  CLI tool for configuring and monitoring Claude Code with a comprehensive collection of 600+ AI agents, 200+ custom commands, 55+ external service integrations (MCPs), 60+ settings, 39+ hooks, and 14+ project templates. Use when…

• Better Auth Best Practices

  by @happycapy-ai

  Skill for integrating Better Auth - the comprehensive TypeScript authentication framework.

• Avatar Naval Ravikant Thinking

  by @Wind-Alice

  使用纳瓦尔·拉维坎特式的重新定义、欲望审计、特定知识和杠杆框架澄清职业、创业、财富、幸福、自由与人生选择。用于识别错误问题、冲突欲望、独特竞争力、AI替代风险、许可依赖、边际成本和长期复利方向。

• Birdeye

  by @sendaifun

  Complete Birdeye API integration for real-time DeFi data across Solana and 15 other chains. Use for token prices, OHLCV charts, market discovery, on-chain trader intelligence, holder analysis, wallet portfolio & P&L, and…

• Quicknode

  by @sendaifun

  Quicknode blockchain infrastructure for Solana — RPC endpoints, DAS API (Digital Asset Standard) for NFTs and compressed assets, Yellowstone gRPC streaming, Priority Fee API, Streams (real-time data pipelines), Webhooks, Metis…

• Vulnhunter

  by @sendaifun

  Security vulnerability detection and variant analysis skill. Use when hunting for dangerous APIs, footgun patterns, error-prone configurations, and vulnerability variants across codebases. Combines sharp edges detection with…

• Zz Code Recon

  by @sendaifun

  Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits…

• Lifi

  by @sendaifun

  Integrate LI.FI for cross-chain swaps, bridging, payments, route discovery, and transfer status tracking across Solana, EVM, Bitcoin, and Sui. Use when building Solana applications or AI agents that need quotes, routes,…

• Full Investigation

  by @dandye

  Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated…

• Triage Suspicious Login

  by @dandye

  Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if…

• Respond Ransomware

  by @dandye

  Respond to a ransomware incident following PICERL methodology. Use when ransomware is detected or suspected. Orchestrates identification, containment, eradication, and recovery phases. Requires CASE_ID and initial indicators.

• Hunt Credential Access

  by @dandye

  Hunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.

• Respond Malware

  by @dandye

  Respond to a malware incident following PICERL methodology. Use when malware is detected on endpoints. Orchestrates triage, containment, eradication, and recovery. Works with triage-malware skill for analysis.

• Generate Thesaurus

  by @dandye

  Generate controlled vocabulary thesaurus for content domains. Creates comprehensive thesauri with preferred terms, broader/narrower/related terms.

• Fastapi Templates

  by @jh941213

  프로덕션 수준의 FastAPI 프로젝트 생성 및 설정 가이드. async 패턴, DI, 에러 핸들링 포함. 트리거: "FastAPI", "Python API 프로젝트", "FastAPI 프로젝트 생성", "FastAPI 템플릿", "FastAPI 설정" 안티-트리거: "Django", "Flask", "Node.js API", "Express", "기존 FastAPI 수정만"

• Harness Audit

  by @jh941213

  하네스(hooks, skills, agents, rules) 전체 건강도를 진단하고 점수 산출. 대상: ~/.claude 전역 하네스 (프로젝트 진단은 harness-diagnostics). Triggers on: harness audit, 하네스 진단, 설정 점검, 하네스 점검. NOT for: 코드 작성, 구현.

• Codebase Modernizer

  by @luongnv89

  Audit a stale, inherited, or messy codebase — deps, bugs, security, tests, CI, docs, UI/UX — then emit a phased, testable modernization plan. Read-only: plans upgrades, never applies them. Not for single-PR review, PRD-to-tasks,…

• Appstore Review Checker

  by @luongnv89

  Audit iOS/macOS apps against App Store Review Guidelines before submission, with evidence-backed verdicts and fixes. Don't use for Google Play, general code review, or rejection appeals.

• Agent Config

  by @luongnv89

  Create or update CLAUDE.md and AGENTS.md files following official best practices. Use when asked to create, audit, or improve agent config files (CLAUDE.md, AGENTS.md). Don't use for README/contributor docs or non-Claude IDE…

• Subagent Creator

  by @luongnv89

  Create, evaluate, or improve Claude Code subagent files (.claude/agents/*.md) — the frontmatter + system prompt defining a delegatable specialist. Don't use for skills (skill-creator), CLAUDE.md/AGENTS.md (agent-config), or…

• Security Setup

  by @luongnv89

  Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI. Use when hardening repos or adding security hooks. Don't use for incident response or…

• Devops Pipeline

  by @luongnv89

  Configure pre-commit hooks and lean GitHub Actions for shift-left quality assurance. Use when adding or auditing CI/CD to maximize local test coverage and minimize CI cost. Skip for Terraform/K8s, deployment pipelines, or…

• Website Clone Report

  by @luongnv89

  Generate a plain-language report from website-analyzer JSON and save it only after explicit approval. Use for non-technical summaries. Don't use for developer audits, raw SEO analysis, penetration testing, or unapproved…

• Website Cloner

  by @luongnv89

  Build an improved website clone from a URL via 6-phase gated workflow (Vite/React/shadcn/Tailwind + GitHub Pages). Use for end-to-end site rebuilds. Don't use for single-phase work.

• Website Analyzer

  by @luongnv89

  Analyze a website's UI/UX, category, style, performance, surface security, and SEO; emit structured JSON. Use for URL audits or website-cloner input. Don't use for penetration tests, full SEO audits, or App Store ASO.

• Revise Claude Md

  by @Houseofmvps

  Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then…

• Using Ultraship

  by @Houseofmvps

  Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions

• Ship Gate

  by @Houseofmvps

  Turn the /ship scorecard into a blocking, config-as-code quality gate. Sets per-category score thresholds, hard-fails on leaked secrets or critical findings, and wires the gate into a pre-push hook and CI so nothing below the…

• A11y

  by @Houseofmvps

  Accessibility audit + auto-fix (WCAG 2.2 A/AA). Scans built/static HTML for screen-reader, keyboard, and structure failures, fixes the deterministic ones, and escalates to a rendered scan for contrast and focus. Use when the…

• Frontend Design

  by @Houseofmvps

  Create distinctive, production-grade frontend interfaces with top-tier product design and UI/UX quality. Use this skill when the user asks to build web components, pages, or applications. Combines product thinking, UX…

• Guard

  by @Houseofmvps

  Safety guardrails — blocks destructive commands (rm -rf, DROP TABLE, force-push, git reset --hard) and optionally restricts file edits to a specific directory. Use when working on critical systems or when you want extra…

• Staying Current

  by @Houseofmvps

  Use whenever answering anything version-sensitive — library/framework/SDK APIs, package versions, model IDs, pricing, CLI flags, config, or "latest/newest" anything. Verify against current sources instead of training data.

• Seo Audit

  by @Houseofmvps

  Run SEO audit (39 rules) with AI visibility checks — GEO (20 rules for AI bot access, snippet restrictions) and AEO (4 schema checks). Auto-fix included. Use when user wants to check or improve search visibility.

• Grow

  by @Houseofmvps

  Post-Ship Growth Intelligence — track how your shipped product is performing. Use when user wants to check growth metrics, SEO trajectory, uptime, deploy frequency, or overall project health over time.

• Architecture

  by @Houseofmvps

  Living Architecture Map — auto-generate Mermaid diagrams of your codebase. Use when user wants to visualize architecture, understand code structure, generate diagrams, or document system design.

• Cost

  by @Houseofmvps

  AI Build Cost Tracker — track how much AI is costing you per feature. Use when user wants to track AI spending, understand cost per feature, optimize AI usage, or budget their Claude/GPT costs.

• Code Review

  by @Houseofmvps

  Code review with principal-engineer-level depth. Reviews for correctness, performance, security, maintainability, and architecture. Use when completing tasks, reviewing PRs, or before merging.

• Onboard

  by @Houseofmvps

  Instant Project Onboarding — generate a complete onboarding guide for any project. Use when user wants to onboard a new developer, understand a new codebase, or generate project documentation.

• Learn

  by @Houseofmvps

  Manage project learnings across sessions. Save, search, recall, digest, prune, and export learnings that compound over time. Use when user wants to record, recall, or share project knowledge.

• Pentest

  by @Houseofmvps

  Automated penetration testing — web, API, browser, GitHub, and local code. Zero false positives. Use when user wants to hack-test their app, find vulnerabilities, or run security pentesting.

• Demo

  by @Houseofmvps

  Demo-Ready Mode — prepare your app for demos, screenshots, and presentations. Use when user wants to demo their app, take screenshots, prepare for a presentation, or clean up dev artifacts.

• Retro

  by @Houseofmvps

  Sprint retrospective — analyzes git velocity, commit patterns, test health, and shipping cadence. Use after a sprint, at the end of the week, or when the user wants to reflect on progress.

• Sprint

  by @Houseofmvps

  Sprint workflow pipeline — chains plan → build → test → review → ship skills into a structured sprint. Use when starting a new feature or project iteration to follow the full lifecycle.

• Launch

  by @Houseofmvps

  Launch Day Autopilot — prepare everything for a product launch. Use when user wants to launch, go live, announce, or prepare for Product Hunt / Hacker News / social media launch.

• Investigate

  by @Houseofmvps

  Root cause investigation — structured debugging with module freeze. No fixes without investigation. Use when encountering any bug, error, or unexpected behavior.

• Release

  by @Houseofmvps

  Generate changelog from commits, bump version, create GitHub release, publish to npm. Use when user wants to release, publish, or ship a new version.

• Security Audit

  by @Houseofmvps

  Run security audit — dependency vulnerabilities, secret scanning, OWASP pattern detection, HTTP headers. Use when user wants to harden their project.

• Deploy

  by @Houseofmvps

  Pre-flight checks then deploy. Validates env vars, migrations, bundle size, runs /ship audit, then deploys via git push or platform CLI.

• Index Fix

  by @Houseofmvps

  Diagnose and fix non-indexed pages using GSC and Bing Webmaster data. Finds exactly why each page isn't indexed and applies the fix.

• Perf Audit

  by @Houseofmvps

  Run Lighthouse performance audit with auto-fix for common issues. Use when user wants to check or improve site performance.

• Gcloud

  by @einverne

  Guide for implementing Google Cloud SDK (gcloud CLI) - a command-line tool for managing Google Cloud resources. Use when installing/configuring gcloud, authenticating with Google Cloud, managing projects/configurations,…

• Mongodb

  by @einverne

  Guide for implementing MongoDB - a document database platform with CRUD operations, aggregation pipelines, indexing, replication, sharding, search capabilities, and comprehensive security. Use when working with MongoDB…

• Shell Scripting

  by @einverne

  Specialized knowledge of Bash and Zsh scripting, shell automation, command-line tools, and scripting best practices. Use when the user needs to write, debug, or optimize shell scripts or work with command-line tools.

• Security Playbook Builder

  by @frumu-ai

  Transform security context into prioritized controls, response runbooks, and compliance-ready documentation.

• Pr Reviewer

  by @mblode

  Reviews a diff or security scope read-only using evidence-tiered findings, structural and context-error rubrics, and repository review policy. Use when asked to "review my changes", "structural review", "review for AI patterns",…

• Memory

  by @686f6c61

  This skill should be used when the user asks to record a design decision, search past project decisions, inspect the Alfred memory timeline, or work with the alfred-memory MCP server. Use it to call the namespaced MCP tools…

• Incident Response

  by @686f6c61

  Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem. Usar ante caidas, errores criticos, incidentes de seguridad o degradacion de servicio.

• Style Direction

  by @686f6c61

  Abrir y operar el companion visual de Selina para elegir una direccion de estilo en proyectos con interfaz. Skill manual: levanta un servidor local y escribe artefactos visuales.

• Sbom Generate

  by @686f6c61

  Usar para generar Software Bill of Materials para cumplimiento del CRA. También: Software Bill of Materials, inventario de componentes, CycloneDX, SPDX, cadena de suministro.

• Sync Project Docs

  by @686f6c61

  Usar para sincronizar la documentación viva del proyecto después de una fase. También: actualizar docs/project, índice, architecture.md, compliance.md, threat-model.

• Sonarqube

  by @686f6c61

  Levantar SonarQube con Docker, analizar el código y proponer mejoras. También: análisis estático, deuda técnica, code smells, cobertura, calidad automatizada.

• Write Adr

  by @686f6c61

  Usar para escribir o cerrar un Architecture Decision Record. También: ADR, docs/adr, decisión de stack, persistencia, autenticación o límites de arquitectura.

• Threat Model

  by @686f6c61

  Usar para modelar amenazas con metodología STRIDE. También: análisis de amenazas, STRIDE, superficie de ataque, vectores de ataque, modelado de amenazas.

• Evaluate Dependency

  by @686f6c61

  Usar antes de aceptar una dependencia nueva. También: auditar paquete, licencia, CVEs, transitivas, bundle, npm install, pip, cargo add.

• Pr Workflow

  by @686f6c61

  Crear pull requests completas con descripcion, labels y reviewers

• Apollo Router

  by @apollographql

  Version-aware guide for configuring and running Apollo Router for federated GraphQL supergraphs. Generates correct YAML for both Router v1.x and v2.x. Use this skill when: (1) setting up Apollo Router to run a supergraph, (2)…

• Neo4j Aura Agent Skill

  by @neo4j-contrib

  Manages Neo4j Aura Agents via the v2beta1 REST API — create, list, get, update, delete, and invoke Aura agents backed by an AuraDB instance. Use when configuring Aura Agent tools (CypherTemplate, SimilaritySearch, Text2Cypher),…

• Apollo Mcp Server

  by @apollographql

  Guide for using Apollo MCP Server to connect AI agents with GraphQL APIs. Use this skill when: (1) setting up or configuring Apollo MCP Server, (2) defining MCP tools from GraphQL operations, (3) using introspection tools…

• Neo4j Spark Skill

  by @neo4j-contrib

  Use when reading from or writing to Neo4j with Apache Spark or Databricks using the Neo4j Connector for Apache Spark 6.0 (org.neo4j.connectors:spark) or 5.x (org.neo4j:neo4j-connector-apache-spark). Covers SparkSession setup,…

• Neo4j Kafka Skill

  by @neo4j-contrib

  Configure and operate the Neo4j Connector for Kafka (sink + source) and the native Neo4j CDC API. Covers Cypher/Pattern/CUD sink strategies, CDC-based and query-based source, exactly-once semantics, DLQ error handling, Confluent…

• Neo4j Security Skill

  by @neo4j-contrib

  Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER), role lifecycle (CREATE/GRANT ROLE/DROP ROLE), privilege grants and denies (GRANT/DENY/REVOKE on graph, database, DBMS),…

• Neo4j Graphql Skill

  by @neo4j-contrib

  Build and configure a GraphQL API backed by Neo4j using @neo4j/graphql v7 (current) or v5 (LTS). Covers Neo4jGraphQL constructor, getSchema(), assertIndexesAndConstraints(), type definitions with @node, @relationship…

• Neo4j Spring Data Skill

  by @neo4j-contrib

  Use when building Spring Boot applications with Neo4j using Spring Data Neo4j (SDN 7.x/8.x) — @Node entity mapping, @Relationship, @RelationshipProperties, Neo4jRepository, ReactiveNeo4jRepository, @Query annotations,…

• Vulnerability Validation

  by @Factory-AI

  Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.

• Commit Security Scan

  by @Factory-AI

  Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns. Use for PR reviews, pre-commit checks, or branch comparisons.

• Threat Model Generation

  by @Factory-AI

  Generate a STRIDE-based security threat model for a repository. Use when setting up security monitoring, after architecture changes, or for security audits.