Skill Evaluator

antoniocostalopes/ia-security-skill

Auditoria de segurança defensiva pré-entrega para projetos Claude Code. Cobre web, mobile (MASVS), cloud/IaC, web3 e ML/AI em 18 linguagens e 34 frameworks. Devolve relatório Markdown com score 0-100, mapa de postura (seguro/menos seguro/inseguro por área), attack chains e achados detalhados; opcionalmente aplica as correções no código com confirmação por achado. Ativa quando o developer pede para auditar, fazer security review, verificar vulnerabilidades, corrigir/blindar código antes do deploy.

kigiela/16-eyes

Security audits with four subcommands — `/16-eyes init` (configure: detect quality gates, exclude patterns, output location, and design the repo's tailored investigation lenses — auto-runs non-interactively if skipped), `/16-eyes audit` (run every persisted lens across the WHOLE repo, verify every finding skeptically, adversarially re-check high-impact ones, produce a classified safe/risky report), `/16-eyes audit-diff` (the identical engine, scoped to a diff/PR instead of the whole repo — for reviewing a change before merge), `/16-eyes fix` (apply the findings — safe ones directly, risky ones

hamzhk15/tenable-sc-reporting-assistant

Generate importable Tenable Security Center (Tenable SC / SecurityCenter) XML for dashboards, PDF reports, and CSV exports, then optionally upload them to a SC console via API keys. Works two ways — a freeform mode that maps any dashboard/report a user describes to a catalog of known-good components, proposes the layout for approval, and builds it with tested builders; and a curated "Vulnerability Management and Remediation Planning" dashboard/report as a ready-made starting point. Use whenever someone wants to build, customize, or deploy a Tenable SC dashboard or report of any kind — vulnerab

mariano-aguero/solidity-security-audit-skill

Comprehensive Solidity smart contract security auditing and vulnerability analysis skill. Based on methodologies from Trail of Bits, OpenZeppelin, Consensys Diligence, Sherlock, CertiK, Cyfrin, Spearbit, Halborn, and other leading Web3 security firms. This skill should be used whenever the user asks to "audit a smart contract", "review Solidity code for security", "find vulnerabilities", "check for reentrancy", "analyze gas optimization", "review access control", "check proxy patterns", "analyze DeFi protocol security", "review ERC20/ERC721 implementation", "check oracle manipulation risks", "

goingli0324/web-security-reviewer

對使用者自己的程式碼做防禦性安全審查，檢測資安漏洞、資料外洩風險、壓力／效能風險與程式品質，並產出「依嚴重度排序的風險報告 ＋ 修正後程式碼」。涵蓋 Google Apps Script（Workspace 自動化）、前端 HTML/CSS/JS、後端 API（Node/Python/PHP 等）。特別適用於「使用者用 AI 生成 / vibe coding 寫出來、希望更安全、避免被攻擊或破壞」的網頁程式碼。MANDATORY TRIGGERS：使用者要求「檢測程式碼安全」「幫我看這段 code 有沒有漏洞」「防止資料外洩」「review 我的網頁／後端程式」「這段會不會被攻擊／被駭」「加固 / harden」「壓力測試」「優化程式碼安全性」「個資會不會外洩」「這是 AI 寫的幫我看安不安全」，或貼上一段前端／後端／Apps Script 程式碼並要求審查、找漏洞、修正建議、加固時，都要套用此 skill。即使使用者沒明說「資安」，只要意圖是審查或加固自己的程式碼，就觸發。SCOPE：本 skill 僅用於防禦性檢測——找出並修補使用者自己程式碼裡的漏洞；不協助撰寫可直接攻擊用的 exploit、不協助繞過資安機制。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的安全閘：當該編排器要在部署前驗證安全／個資時會呼叫本 skill；使用者單獨要求安全審

Dilaz/security-review-skill

Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.