Tenable Sc Reporting Assistant

goingli0324/web-security-reviewer

對使用者自己的程式碼做防禦性安全審查，檢測資安漏洞、資料外洩風險、壓力／效能風險與程式品質，並產出「依嚴重度排序的風險報告 ＋ 修正後程式碼」。涵蓋 Google Apps Script（Workspace 自動化）、前端 HTML/CSS/JS、後端 API（Node/Python/PHP 等）。特別適用於「使用者用 AI 生成 / vibe coding 寫出來、希望更安全、避免被攻擊或破壞」的網頁程式碼。MANDATORY TRIGGERS：使用者要求「檢測程式碼安全」「幫我看這段 code 有沒有漏洞」「防止資料外洩」「review 我的網頁／後端程式」「這段會不會被攻擊／被駭」「加固 / harden」「壓力測試」「優化程式碼安全性」「個資會不會外洩」「這是 AI 寫的幫我看安不安全」，或貼上一段前端／後端／Apps Script 程式碼並要求審查、找漏洞、修正建議、加固時，都要套用此 skill。即使使用者沒明說「資安」，只要意圖是審查或加固自己的程式碼，就觸發。SCOPE：本 skill 僅用於防禦性檢測——找出並修補使用者自己程式碼裡的漏洞；不協助撰寫可直接攻擊用的 exploit、不協助繞過資安機制。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的安全閘：當該編排器要在部署前驗證安全／個資時會呼叫本 skill；使用者單獨要求安全審

antoniocostalopes/ia-security-skill

Auditoria de segurança defensiva pré-entrega para projetos Claude Code. Cobre web, mobile (MASVS), cloud/IaC, web3 e ML/AI em 18 linguagens e 34 frameworks. Devolve relatório Markdown com score 0-100, mapa de postura (seguro/menos seguro/inseguro por área), attack chains e achados detalhados; opcionalmente aplica as correções no código com confirmação por achado. Ativa quando o developer pede para auditar, fazer security review, verificar vulnerabilidades, corrigir/blindar código antes do deploy.

ravindrakele/claude-skills

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app

huajielong/skill-evaluator

Evaluate any skill before installing. Run security gate, score trigger precision, execution quality, and cost efficiency. Get a yes/no recommendation. Use when users find a new skill and ask "这个技能值不值得装？" v3.1: 脚本计数精度+信息密度阈值+脚本完整性检查

give-jd/deep-security-check

Use when the user asks for a defensive security assessment, security audit, vulnerability scan, or "how safe / how reliable is this code/project/repo". Runs Semgrep (SAST), osv-scanner (dependency CVEs) and gitleaks (secrets) against a local project, then produces a report with a reproducible reliability grade (0-100, A-F). Defensive only — finds weaknesses in code you own; it does not exploit, attack, or test remote targets.

kigiela/16-eyes

Security audits with four subcommands — `/16-eyes init` (configure: detect quality gates, exclude patterns, output location, and design the repo's tailored investigation lenses — auto-runs non-interactively if skipped), `/16-eyes audit` (run every persisted lens across the WHOLE repo, verify every finding skeptically, adversarially re-check high-impact ones, produce a classified safe/risky report), `/16-eyes audit-diff` (the identical engine, scoped to a diff/PR instead of the whole repo — for reviewing a change before merge), `/16-eyes fix` (apply the findings — safe ones directly, risky ones