Security Research

Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon

22 stars 2 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add rhysha/claude-security-research-skill --skill security-research

Manual install

git clone --depth 1 https://github.com/rhysha/claude-security-research-skill.git /tmp/claude-security-research-skill
mkdir -p ~/.claude/skills
cp -r /tmp/claude-security-research-skill/. ~/.claude/skills/security-research

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Security Research Skill

Advanced security research skill for web servers, REST APIs, web applications, and
network infrastructure. Designed for experienced users who want structured, tool-driven
engagements.

---

## Claude's Role

Claude's role is to interpret tool output, suggest next steps, and document findings.
Tools perform active testing. Claude does not generate payloads or exploit code.

In practice this means:
- Claude reads and analyzes output from established security tools (nmap, nuclei, sqlmap, etc.)
- Claude proposes which tool to run next and explains why
- Claude organizes findings into the reporting format
- Claude does **not** write injection strings, payloads, shellcode, or test scripts
  that perform active testing. When a step requires active testing, Claude identifies
  the right tool and asks the user to run it.

---

## Ethics Gate — The First Thing Claude Checks

**Before reading any other section, before suggesting any command, Claude runs this check.**

1. **Scope**: User has explicit written authorization or owns the target
2. **Target**: Not a third-party production system without consent
3. **Output**: Findings stay private; no exfiltration of real credentials
4. **Tooling boundary**: Claude will not generate exploit code, payloads, or attack
   strings. If a step requires this, Claude will identify the appropriate tool and
   instruct the user to run it directly.

If any of these are unclear, ask before proceeding. This is non-negotiable.

Read the full skill on GitHub

Details

Skill name: security-research
Repository: rhysha/claude-security-research-skill
License: MIT
Repo updated: 8 April 2026

FAQ

What does the Security Research skill do?

How do I install the Security Research skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add rhysha/claude-security-research-skill --skill security-research. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Security Research popular?

It lives in rhysha/claude-security-research-skill, which has 22 GitHub stars and 2 forks.

Related skills

Security Scan

Ray0907/security-scan

Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.

Security

Move Auditor

pantheraudits/move-auditor

Audits Move contracts (Sui & Aptos) for security bugs.

Security

Malware Analysis Static

guelfoweb/malware-analysis-static

Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.

Security

Slopsec

lachydotmcg/slopsec

Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.

Security

Security Bluebook Builder

SHADOWPR0/security-bluebook-builder

Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.

SecurityIn 1 list

Pentest Tool

Jumbo-WJB/pentest-skills

Autonomous penetration testing framework. Claude acts as offensive security expert with independent decision-making. Provides methodology and principles, not command scripts. ALL commands must execute in kali-pentest container via 'docker exec kali-pentest <tool>'.

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.