#SkillRepo stars

1. 1Django Securityaffaan-m/ECCDjango security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.294k
2. 2Laravel Securityaffaan-m/ECCBuenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.294k
3. 3Laravel Securityaffaan-m/ECCLaravel セキュリティベストプラクティス：認証・認可、バリデーション、CSRF、一括割当、ファイルアップロード、シークレット管理、レート制限、安全なデプロイメント294k
4. 4Perl Securityaffaan-m/ECCテイントモード、入力バリデーション、安全なプロセス実行、DBIパラメータ化クエリ、Webセキュリティ（XSS/SQLi/CSRF）、perlcriticセキュリティポリシーを網羅する包括的なPerlセキュリティ。294k
5. 5Quarkus Securityaffaan-m/ECCBuenas prácticas de seguridad en Quarkus para autenticación, autorización, JWT/OIDC, RBAC, validación de entrada, CSRF, gestión de secretos y seguridad de dependencias.294k
6. 6Quarkus Securityaffaan-m/ECCQuarkus認証、認可、JWT/OIDC、RBAC、入力検証、CSRF、シークレット管理、依存関係セキュリティのセキュリティベストプラクティス。294k
7. 7Security Bounty Hunteraffaan-m/ECCリポジトリ内の悪用可能なバウンティ対象のセキュリティ問題を発見します。ノイズの多いローカルのみの発見ではなく、実際のレポートに適格なリモートから到達可能な脆弱性に焦点を当てます。294k
8. 8Security Reviewaffaan-m/ECCUse this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.294k
9. 9Security Reviewaffaan-m/ECCUsar este skill al agregar autenticación, manejar entradas de usuario, trabajar con secretos, crear endpoints de API o implementar funcionalidades de pago/sensibles. Proporciona lista de verificación y patrones de seguridad completos.294k
10. 10Security Reviewaffaan-m/ECC認証の追加、ユーザー入力の処理、シークレットの操作、APIエンドポイントの作成、支払い/機密機能の実装時にこのスキルを使用します。包括的なセキュリティチェックリストとパターンを提供します。294k
11. 11Security Scanaffaan-m/ECCAgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。294k
12. 12Springboot Securityaffaan-m/ECCSpring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.294k
13. 13Springboot Securityaffaan-m/ECCBuenas prácticas de Spring Security para autenticación/autorización, validación, CSRF, secretos, cabeceras, limitación de velocidad y seguridad de dependencias en servicios Java Spring Boot.294k
14. 14Springboot Verificationaffaan-m/ECCVerification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.294k
15. 15Ponytail AuditDietrichGebert/ponytailQuality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.181k
16. 16Ponytail ReviewDietrichGebert/ponytailQuality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.181k
17. 17Gke Basicsgoogle/skillsManages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).22k
18. 18Google Cloud Waf Securitygoogle/skillsGenerates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.22k
19. 19Secure Code GuardianJeffallan/claude-skillsUse when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.12k
20. 20Security ReviewerJeffallan/claude-skillsIdentifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.12k
21. 21Deepsecvercel-labs/deepsecRun deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.8.3k
22. 22Bug Bountyawarexone/Agentic-Bug-HunterComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via co5.5k
23. 23Positioning Workshopdeanpeters/Product-Manager-SkillsRun a positioning workshop that surfaces target customer, unmet need, category, benefits, and differentiation. Use when your product messaging feels fuzzy, generic, or misaligned.7.8k
24. 24Tirithsheeki03/tirithTerminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with t2.8k
25. 25VibeSec SkillBehiSecc/VibeSec-SkillThis skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.1.4k
26. 26Find Bugsgetsentry/skillsFind bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.1.1k
27. 27Security GuidejnMetaCode/shellwardOpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation139
28. 28Claude Pentest Skillsfrendysanusi/claude-pentest-skillsStructured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation66
29. 29Auditor Skillsolanabr/auditor-skill**AUDIT SKILL** — Comprehensive on-chain Solana program auditor and full-stack security review for ANY programming language. USE FOR: auditing Solana/Anchor programs, reviewing smart contract security, checking for vulnerabilities (missing signers, unchecked accounts, arithmetic overflow, CPI attacks, PDA confusion, type cosplay, reinitialization, flash loan exploits, MEV, governance backdoors, timelock bypass), auditing TypeScript/Python/Go/Java/Ruby/PHP/any language, backend/frontend code review, supply chain safety, CI/CD and GitHub Actions workflow security (comment-triggered commands, pul63
30. 30Malware Analysisgl0bal01/malware-analysis-claude-skillsOrchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.54
31. 31Secscanatgreen/secscan-skillIn-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive → adversarial-verify → report — using Read/Grep/Glob (and optional subagents), no external tooling. Use when asked to "security scan", "find vulnerabilities", "SAST", "audit this code for security", or "secscan".51
32. 32Security Scanchaenmasahiro0425/claude-security-scan開発者のPC・手元のgitリポジトリ・GitHub・Vercelと公開サイト・クラウド（AWS / Google Cloud / Azure / Cloudflare / Supabase）・Gmailを読み取り専用で横断スキャンし、重要度別のHTMLレポートと前回からの差分を出すスキル。「セキュリティチェックして」「セキュリティスキャン」「脆弱性ないか見て」「APIキー漏れてない？」「乗っ取られてないか確認」「新しく出たリスクだけ教えて」「毎週スキャンを設定して」等で使う。設定の変更・送信・削除はしない。直すときは1件ずつ利用者の承認を取る。42
33. 33R00 ComposioHQ Awesome Claude Skills SecurityCraftsmanTuck/r08-composiohq-awesome-claude-skills-security🔒 Security & Compliance skill suite derived from ComposioHQ/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.49
34. 34R00 Travisvn Awesome Claude Skills Securityregimentpebblehearth/r09-travisvn-awesome-claude-skills-security🔒 Security & Compliance skill suite derived from travisvn/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.51
35. 35Bugbountyrulessanjarbiy/bugbountyrulesUse for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings, writing reports, or when you are stuck on a target and about to give up. Activates automatically for all bug-bounty and pentest sessions. Runs an autonomous, never-surrender predator methodology: refuses to conclude "secure", exhausts each vuln class to depth, proves a real attac35
36. 36R00 Alirezarezvani Claude Skills SecurityAxisfrommall/r02-alirezarezvani-claude-skills-security🔒 Security & Compliance skill suite derived from alirezarezvani/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.46
37. 37Repo Security ReviewConsensys/repo-security-reviewFull automated security review pipeline for a code repository. Use this skill whenever the user asks to: review a repo for security issues, run a security audit, find vulnerabilities in a codebase, perform a security assessment, check for OWASP Top 10 and OWASP API Top 10 issues, scan for secrets or exposed credentials, audit dependencies for CVEs, or analyze architecture for security flaws. Trigger even for casual phrasings like "can you check this repo for security issues" or "run security on this". This skill orchestrates a multi-phase pipeline of isolated subagents: secret scanning, tech-s32
38. 38SpecforgeGodModeAI2025/specforge-ai-skillSpec-Driven Requirements Engineering mit Governance-Enforcement. Kombiniert Harness-Patterns, EARS-Syntax, Gherkin und NIS2/KRITIS-NFRs. Erzeugt spec.md, plan.md, tasks.md und mehr. Verwende diesen Skill IMMER bei: Requirements schreiben, User Stories, Spezifikation erstellen, Spec-Driven Development, EARS, Gherkin, Requirements Review, Stakeholder-Analyse, KRITIS, NIS2, STRIDE, ADR, Clarify, Analyze, Checklist, Research, Quickstart, Discover, Reverse Engineering. Auch bei: "erstelle eine Spezifikation", "was fehlt in diesem Requirement", "simuliere einen Security Officer", "STRIDE-Analyse", "33
39. 39R00 Borghei Claude Skills SecurityInnerPrawn98/r14-borghei-claude-skills-security🔒 Security & Compliance skill suite derived from borghei/Claude-Skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.42
40. 40R00 Glebis Claude Skills Securitylavendertalesun/r20-glebis-claude-skills-security🔒 Security & Compliance skill suite derived from glebis/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.40
41. 41R00 BehiSecc Awesome Claude Skills Securityfreewaychameleonnode/r17-behisecc-awesome-claude-skills-security🔒 Security & Compliance skill suite derived from BehiSecc/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.38
42. 42Prism Scanneraidongise-cell/prism-scannerSecurity scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.28
43. 43Pentest ToolJumbo-WJB/pentest-skillsAutonomous penetration testing framework. Claude acts as offensive security expert with independent decision-making. Provides methodology and principles, not command scripts. ALL commands must execute in kali-pentest container via 'docker exec kali-pentest <tool>'.27
44. 44Slopseclachydotmcg/slopsecSecurity audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.25
45. 45Move Auditorpantheraudits/move-auditorAudits Move contracts (Sui & Aptos) for security bugs.20
46. 46Security Researchrhysha/claude-security-research-skillFull-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon22
47. 47Security ScanRay0907/security-scanUse when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.20
48. 48Malware Analysis Staticguelfoweb/malware-analysis-staticUse this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.12