Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Security Review

  by @Factory-AI

  Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review, scheduled scans, and full…

• Agents Md Generator

  by @MADTeacher

  Create, generate, update, repair, trim, or split minimal AGENTS.md files for repository roots and confirmed nested modules using progressive disclosure. Use for missing, bloated, contradictory, or outdated agent instructions,…

• Cometchat Angular V5 Production

  by @cometchat

  Ship a CometChat Angular integration safely — server-minted auth tokens instead of the Auth Key, environment file replacement, key hygiene, build config and a pre-launch checklist. Triggers: 'is this production ready', 'auth…

• Nextjs Client Cookie Pattern

  by @wsimmonds

  Pattern for client components calling server actions to set cookies in Next.js. Covers the two-file pattern of a client component with user interaction (onClick, form submission) that calls a server action to modify cookies. Use…

• Knock

  by @Hmbown

  Knock is specifically about restoring legitimate access through authorized channels. It is NOT about: - Performance optimization (slow queries, throughput issues) → different spell - Removing safety controls (approval gates,…

• Hold Person

  by @Hmbown

  Hold Person = hard freeze. Nothing moves. In-flight operations stop. Requires authority. Used for security incidents, fraud, compliance holds, misbehaving systems. Sleep = graceful suspension. State is preserved and queued.…

• Identify

  by @Hmbown

  Identify is static analysis for operational understanding. It answers "What is this?" by inspecting structure, naming, dependencies, and runtime touchpoints. It does NOT search for artifacts, debug failures, monitor systems,…

• Dynamic Workflows

  by @TheBeardedBearSAS

  Orchestrate dozens-to-hundreds of subagents from a script Claude writes (Claude Code Dynamic Workflows, trigger `ultracode`). Use when a task exceeds a single agent's context or needs more than ~4 concurrent workers — large…

• Ecosystem Tools

  by @TheBeardedBearSAS

  Third-party Claude Code token/context/code-review tools. Use when choosing or recommending an external tool to reduce token usage, manage context, or review large codebases.

• Security Paperclip

  by @TheBeardedBearSAS

  Paperclip-Sicherheit — Tenancy-Isolation, Secrets, Approval-Gates, harte Budgets, signierter Adapter-Channel. Verwenden Sie dies beim Auditing oder Härten von Paperclip.

• Security Reactnative

  by @TheBeardedBearSAS

  Security - React Native Best Practices. Use when reviewing security, implementing auth, or hardening code.

• Security Symfony

  by @TheBeardedBearSAS

  Sicherheit & DSGVO - Atoll Tourisme. Use when reviewing security, implementing auth, or hardening code.

• Security Flutter

  by @TheBeardedBearSAS

  Flutter Security. Use when reviewing security, implementing auth, or hardening code.

• Security React

  by @TheBeardedBearSAS

  React Security. Use when reviewing security, implementing auth, or hardening code.

• Security

  by @TheBeardedBearSAS

  Security best practices, OWASP Top 10, and secure coding guidelines

• K8s Manifest Generator

  by @HermeticOrmus

  Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests, creating K8s resources, or…

• Solana Ai Kit

  by @solanabr

  Skill hub for the solana-ai-kit Claude Code plugin. Routes the bundled go-to-market skills and the opt-in add-on catalog, and points to upstream marketplaces (and the install.sh full install) for protocol, security, and…

• K8s Security Policies

  by @HermeticOrmus

  Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

• Nodejs Backend Patterns

  by @HermeticOrmus

  Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST…

• Dependency Upgrade

  by @HermeticOrmus

  Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use when upgrading framework versions, updating major dependencies, or managing breaking changes in libraries.

• Olore Better Auth 1.6.18

  by @olorehq

  Local better-auth documentation reference (1.6.18). Better Auth documentation. Use for TypeScript authentication, OAuth, email/password, 2FA, organizations, sessions, and framework-agnostic auth.

• Olore A2a Latest

  by @olorehq

  Local A2A (Agent-to-Agent) protocol documentation (latest). Use for agent communication, task management, streaming, push notifications, and enterprise-ready agent interoperability.

• Olore Lucia Latest

  by @olorehq

  Local lucia documentation reference (latest). Lucia auth documentation. Use for session-based authentication, OAuth 2.0, password hashing, and framework-specific auth implementations.

• Api Patterns

  by @agent-skills-hub

  API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

• Active Directory Attacks

  by @agent-skills-hub

  This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or…

• API Fuzzing For Bug Bounty

  by @agent-skills-hub

  This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API…

• Api Security Best Practices

  by @agent-skills-hub

  Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

• Accessibility Audit

  by @AccessLint

  Whole site or product — a full web accessibility (a11y) audit against WCAG 2.2, following the WCAG-EM methodology. Defines scope, samples representative pages and flows, runs the automated tier (`accessibility-scan`) and the…

• Openclaw Shield

  by @aAAaqwq

  Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw…

• Squirrelscan

  by @squirrelscan

  squirrelscan audits websites for SEO, performance, security, accessibility, content, and structured data issues (300+ rules) and scores site health, via the squirrel CLI. Use when the user wants to check, audit, or improve a…

• Audit Code

  by @aAAaqwq

  Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized report with concrete fixes. Use when the user asks to audit code,…

• Native Agent Swarms

  by @aAAaqwq

  Coordinate small teams of specialized Codex agents with bounded parallelism, explicit ownership, native messaging, and evidence-based synthesis. Use when two or more independent investigations, reviews, or implementation streams…

• Caching Strategies Knowledge

  by @dykyi-roman

  Caching Strategies knowledge base. Provides caching patterns (Cache-Aside, Read-Through, Write-Through, Write-Behind), invalidation approaches, multi-level caching, and Redis data structures for caching audits and generation.

• Api Design Knowledge

  by @dykyi-roman

  API Design knowledge base. Provides REST constraints, Richardson Maturity Model, HTTP semantics, content negotiation, and GraphQL/gRPC comparison for API audits and generation.

• Access Control Knowledge

  by @dykyi-roman

  Access Control knowledge base. Provides ACL, RBAC, ABAC, ReBAC models, multi-tenancy patterns, and PHP implementations (Symfony Voters, Laravel Gates) for security audits and generation.

• Security Audit

  by @aAAaqwq

  Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning,…

• Business Strategy

  by @travisjneuman

  Business strategy expertise for strategic planning, competitive analysis, market entry, M&A strategy, portfolio management, and strategic decision-making. Use when analyzing competitive positioning, planning growth strategies,…

• Check Connection Pool

  by @dykyi-roman

  Analyzes PHP code for connection pool issues. Detects connection leaks, improper pool sizing, missing connection release, timeout issues.

• Afrexai Compliance Audit

  by @aAAaqwq

  Run internal compliance audits against major governance and security frameworks, highlighting gaps, risks, and remediation priorities.

• Generic Fullstack Code Reviewer

  by @travisjneuman

  Review full-stack code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md compliance. Enforces TypeScript strict mode, input validation, GPU-accelerated animations, and design system…

• Compliance Engineering

  by @travisjneuman

  SOC2, HIPAA, GDPR, PCI-DSS, FedRAMP compliance implementation in code. Audit logging, data encryption, access controls, privacy by design, and regulatory requirement mapping. Use when implementing compliance controls, preparing…

• Blockchain Web3

  by @travisjneuman

  Solidity smart contracts, Web3 development, DeFi protocols, NFTs, EVM chains, Hardhat/Foundry tooling, and blockchain security. Use when writing smart contracts, building dApps, auditing contract security, or integrating Web3…

• Application Security

  by @travisjneuman

  OWASP Top 10 with code examples, SAST/DAST tools, dependency scanning, CSP headers, and input validation patterns. Use when hardening applications, reviewing security posture, or implementing defensive coding practices.

• Check Access Control Model

  by @dykyi-roman

  Analyzes PHP code for access control issues. Detects inline role checks, hardcoded permissions, mixed ACL/RBAC models, missing Voter/Policy pattern, and authorization logic in controllers.

• Check Cors Security

  by @dykyi-roman

  Audits CORS configuration security. Detects wildcard origins, credentials with wildcards, dynamic origin reflection, missing preflight handling, and overly permissive policies.

• Check Cqrs Alignment

  by @dykyi-roman

  Audits CQRS and Event Sourcing alignment. Checks command/query separation, projection idempotency, event store consistency, and read/write model synchronization.

• Check Command Injection

  by @dykyi-roman

  Analyzes PHP code for command injection vulnerabilities. Detects shell_exec, exec, system, passthru with user input, missing escapeshellarg/escapeshellcmd.

• Check Dependency Vulnerabilities

  by @dykyi-roman

  Analyzes PHP dependencies for security vulnerabilities. Detects outdated packages, known CVEs, unsupported versions, vulnerable transitive dependencies.

• Check Deserialization

  by @dykyi-roman

  Analyzes PHP code for insecure deserialization. Detects unserialize with user input, missing allowed_classes, PHP object injection risks, gadget chains.

• Check Authorization

  by @dykyi-roman

  Analyzes PHP code for authorization issues. Detects missing access control, IDOR vulnerabilities, privilege escalation, role-based access gaps.

• Check Crypto Usage

  by @dykyi-roman

  Analyzes PHP code for cryptography issues. Detects weak algorithms, hardcoded keys, insecure random, poor key management, deprecated functions.

• Check Authentication

  by @dykyi-roman

  Analyzes PHP code for authentication issues. Detects weak password handling, insecure sessions, missing auth checks, token vulnerabilities.

• Check Doc Links

  by @dykyi-roman

  Validates documentation links. Detects broken relative links, missing anchor targets, malformed URLs, and orphaned documentation files.

• Check Docker Security

  by @dykyi-roman

  Checks Docker security for PHP projects. Detects root user, exposed secrets, privileged mode, and missing security configurations.

• Ast Governor

  by @aAAaqwq

  Governor｜重大结论与完成声明的独立证据复核者。需要独立复核重大结论、发布、安全、资金、法律或完成声明，并给出放行门决定或风险升级时调用。 不适用：需要设计与实现交付物、替领域负责人作专业判断、替 CEO 作资源取舍，或声明方无法提供可复核证据。

• Check Csrf Protection

  by @dykyi-roman

  Analyzes PHP code for CSRF vulnerabilities. Detects missing CSRF tokens, state-changing GET requests, token validation gaps.

• Ast Clo

  by @aAAaqwq

  CLO (Alan Dershowitz)｜需要合同与协议风险评审、隐私与跨境合规检查、许可与知识产权问题识别、监管政策适用判断时调用。 不适用：需要特定司法辖区的正式法律意见或诉讼代理、商业与财务取舍、技术安全实现，或交易结构与事实尚未明确。

• Api Doc Template

  by @dykyi-roman

  Generates API documentation for PHP projects. Creates endpoint documentation with parameters, responses, and examples.

• Ast Pe

  by @aAAaqwq

  PE (Linus Torvalds)｜已批准的设计需要跨模块实现、集成、测试、代码评审、缺陷修复或可回退交付时调用。 不适用：设计尚未批准、需要产品或优先级取舍、架构边界存在争议，或只需窄领域专家给出专项建议而不承担跨模块实现。

• Changelog Template

  by @dykyi-roman

  Generates CHANGELOG.md files following Keep a Changelog format. Creates version history documentation.

• Authentication Patterns

  by @travisjneuman

  OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns

• Learnworlds Cli

  by @antoniolg

  Use the private LearnWorlds CLI to inspect DevExpert Academy users, find students by email, list their enrolled courses/products, look up products, and perform safe enrollment workflows. Trigger when Antonio asks what courses a…

• Security Engineer

  by @wasintoh

  Security-first auditing of AI-generated code — Level 1 quick checks during /toh-dev and /toh-test (hardcoded secrets, dangerous code execution, obvious injection vectors) and Level 2 full audits for /toh-protect (SQL/XSS/command…

• Error Handling

  by @wasintoh

  Intelligent error handling — silently auto-fix routine errors (missing imports, undefined variables, type mismatches, missing dependencies, syntax and lint issues) and translate everything else into friendly, non-technical…

• Backend Engineer

  by @wasintoh

  Supabase integration specialist. Handles database schema, authentication, Row Level Security (RLS), real-time subscriptions, and storage. Connects existing UI to real backend. Only called AFTER UI exists with mock data.…

• Click Path Audit

  by @mturac

  ユーザー向けボタン/タッチポイントを完全な状態変更シーケンスを通して追跡し、機能が個別に機能するが互いにキャンセルされたり、間違った最終状態を生成したり、UIを矛盾した状態にしたままにするバグを見つけます。次の場合に使用します：体系的なデバッグがバグを見つけたが、ユーザーは壊れたボタンを報告する場合、または共有状態ストアに触れる主要なリファクター後。

• Defi Amm Security

  by @mturac

  DeFi自動マーケットメーカー（AMM）スマートコントラクトセキュリティ監査パターン。フラッシュローン、スリッページ、サンドイッチング攻撃、価格操作、再入攻撃、不正確な整数演算をカバー。

• Continuous Agent Loop

  by @mturac

  品質ゲート、評価、リカバリーコントロールを備えた継続的な自律エージェントループのパターン。

• Owasp Security Check

  by @sergiodxa

  Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production deployment.

• Audit Website

  by @squirrelscan

  Audit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-optimized report, then drives…

• Security Patterns

  by @korallis

  Implement comprehensive security patterns to protect applications against OWASP Top 10 vulnerabilities including XSS, CSRF, SQL injection, authentication bypass, and data exposure. Use when handling user data, implementing…

• Code Review

  by @korallis

  Systematically review pull requests, feature implementations, and code changes to ensure quality, maintainability, security, and adherence to best practices. Use when reviewing code before merging, conducting peer reviews,…

• Api Design

  by @korallis

  Design clean, scalable, and maintainable REST and GraphQL APIs following industry best practices. Use when designing public or internal APIs, planning endpoint structures, defining request/response contracts, establishing…

• Threat Hunting

  by @korallis

  Proactively search for security threats, vulnerabilities, and suspicious patterns in applications and infrastructure before they cause damage. Use when conducting security audits, identifying vulnerabilities, analyzing security…

• Fifteen Factor App

  by @henkisdabro

  Cloud-native SaaS architecture methodology extending Twelve-Factor with three additional factors (API First, Telemetry, Security). Use when planning SaaS tools, product software architecture, microservices design, PRPs/PRDs, or…

• Prp Generator

  by @henkisdabro

  Generate comprehensive Product Requirement Plans (PRPs) for feature implementation with thorough codebase analysis and external research. Use when the user requests a PRP, PRD, or detailed implementation plan for a new feature.…

• Data Sql Optimization

  by @vasilyu1983

  Diagnoses and tunes SQL for OLTP workloads on PostgreSQL, MySQL, and SQL Server. Use when tuning queries, reading plans, indexing, or fixing lock contention.

• Dev Api Design

  by @vasilyu1983

  Designs durable API contracts across REST, GraphQL, gRPC, tRPC, and AsyncAPI. Use when specifying interfaces, auth, versioning, errors, rate limits, or agent APIs.

• Dev Dependency Management

  by @vasilyu1983

  Guides dependency management across languages and ecosystems. Use when choosing package managers, lockfiles, update policy, security scanning, SBOMs, or monorepo patterns.

• Security Specialist

  by @fabricioctelles

  Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for…

• Human Ai

  by @fabricioctelles

  Rewrites English text so it reads as written by a person, without AI writing tics. Removes machine language patterns and AI slop, restores semantic entropy, and injects voice and personality. Use when ENGLISH text reads as…

• Ai Coding Agents Settings Policy

  by @vasilyu1983

  Designs settings and policy layers for coding-agent runtimes. Use when modeling source precedence, managed policy, env controls, or runtime settings validation.

• Ai Product Operating Model

  by @vasilyu1983

  Designs operating models for AI in product teams. Use when planning platform ownership, provider strategy, data boundaries, evals, or sensitive-data controls.

• Shopify Hydrogen

  by @Weaverse

  Core Shopify Hydrogen APIs — createHydrogenContext, cart handler, CartForm, caching strategies, pagination, SEO, variant selection, analytics, and CSP.

• Changelog Updates

  by @jonathimer

  Create release notes and product updates that developers actually read and care about. This skill covers changelog formatting, versioning communication, breaking change announcements, deprecation notices, and building…

• Developer Email Sequences

  by @jonathimer

  When the user wants to create email sequences for developers including onboarding, product updates, re-engagement, or changelog communications. Trigger phrases include "developer emails," "onboarding sequence," "email drip,"…

• Env Manager

  by @AIDotNet

  管理环境变量和.env文件，支持验证、加密和模板生成。

• Git Workflow

  by @AIDotNet

  自动化Git操作，智能生成遵循Conventional Commits的提交信息、分支管理和PR描述生成。

• Code Review

  by @AIDotNet

  全面的代码审查技能，分析代码质量、识别问题、安全漏洞，并提供带严重性评级的改进建议。

• Security Scanner

  by @AIDotNet

  全面的安全分析，识别OWASP Top 10漏洞、检测硬编码密钥和审查安全配置。

• Character Appeal

  by @dylantarre

  Use when creating or animating characters that need to connect with audiences—hero protagonists, memorable villains, lovable sidekicks, or any figure that must have personality and presence.

• Agent Coordination

  by @ilyasibrahim

  Coordination protocol for main Claude Code agent. Explicit user invocation required ("mobilize agents", "coordinate", "check registry"). Provides agent orchestration, registry management, and handoff protocols. Subagents never…

• Elixir Security Review

  by @existential-birds

  Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.

• Gen Release Notes

  by @existential-birds

  generate release notes for changes since a given tag

• Nexus

  by @simota

  Orchestrating multi-specialist task chains and scope-adaptive product delivery: classifies intent, selects and executes the minimum viable chain, aggregates results, and verifies acceptance criteria. For multi-domain tasks,…

• Hone

  by @simota

  Auditing AI CLI configs and designing, configuring, or debugging Claude Code hooks. Use for Codex/agy/Claude Code config reviews, hook lifecycle automation, quality gates, or MCP governance.

• Magi

  by @simota

  Deliberating decisions and founder priorities through multi-perspective, named-expert, and YC-style advisory lenses. Use for verdicts, office hours, or expert critique; not implementation.

• Echo

  by @simota

  Simulating users to evaluate existing flows and generate synthetic demand: cognitive walkthroughs, feature requests, unmet needs, JTBD, and opportunity trees. Not real-user research.

• Canon

  by @simota

  Assessing standards, regulatory controls, and legal-document coverage with cited evidence and proposed wording. Use for OWASP/WCAG/SOC2/PCI/HIPAA or ToS/privacy/DPA reviews; not legal advice or code fixes.

• Judge

  by @simota

  Reviewing code via multi-engine orchestration (Claude + Codex) on three axes — secure, correct, and lean — shipping only findings worth fixing. Use for PR review or pre-commit. Complements Zen.