250 free skills · page 4 of 5
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Real files from public repositories — hand-curated, never invented. Sorted by installs.
4 / 5page
list-segment-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build email segments from my list", "make engaged / lapsed / RFM segments", "set up cart-abandoner or lifecycle-stage audiences", or "build a suppression list of unsubscribes and bounces"; turns the user''s OWN list/CRM/GA4/ecommerce export into behavioral, attribute, and lifecycle-stage segments plus a suppression list, with per-segment sizes labeled Measured/Estimated, informing the SEND E (Engagement/targeting) dimension. Not for scoring EQS or running vetoes — use email-quality-auditor; not for authentication or spam-content checks — use deliverability-qa. 邮件列表分群/生命周期分群/抑制名单/流失召回Security586email-quality-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit an email program" or "is this campaign safe to send"; runs a typed 20-item SEND profile with authentication, consent, opt-out, and claim veto checks on own evidence. Not for building deliverability setup — use deliverability-qa; not for designing lifecycle flows — use email-sequence-designer. 邮件质量审计/EQS评分/发送前放行Security586
data-encryptionaj-geddes/useful-ai-promptsImplement robust encryption strategies for protecting sensitive data at rest and in transit using industry-standard cryptographic algorithms and key management practices.Security582list-hygiene-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "watch my list health over time", "flag decaying / unengaged subscribers on a schedule", "why is my open rate drifting down / bounces creeping up", or "build me a re-permission and prune worklist"; runs the scheduled SEND list-decay + suppression-drift watch — an engagement-recency cohort read (30/90/180/365-day), hard-bounce and spam-complaint trend vs benchmark, suppression-list growth/leakage check, and a segmented re-permission / sunset / prune worklist tied to SEND S (list hygiene) and E (engagement-decay) sub-items. Not for the one-time pre-send authentication pre-flight — use deliverability-qa; not for the consent/suppression record itself — use consent-registry; not for computing the EQS or enforcing vetoes — use email-quality-auditor. 邮件列表健康度监控/退订漂移/沉睡用户清理Security580security-testingaj-geddes/useful-ai-promptsSecurity testing identifies vulnerabilities, weaknesses, and threats in applications to ensure data protection, prevent unauthorized access, and maintain system integrity. It combines automated scanning (SAST, DAST) with manual penetration testing and code review.Security576vulnerability-scanningaj-geddes/useful-ai-promptsSystematically identify security vulnerabilities in applications, dependencies, and infrastructure using automated scanning tools and manual security assessments.Security575
google-calendar-automationsickn33/agentic-awesome-skillsLightweight Google Calendar integration with standalone OAuth authentication. No MCP server required.Security575
reviewshiplightai/agent-skillsReview orchestrator and single entry point for all application reviews. Triage what needs reviewing, then run the right domains: security (OWASP, auth, headers, supply chain), privacy (PII, tracking, consent, GDPR/CCPA), compliance (HIPAA, SOC 2, PCI-DSS, GDPR), design (responsive, accessibility, typography, i18n), resilience (error handling, degradation, API contracts), performance (Core Web Vitals, bundles, runtime), SEO (meta, structured data, crawlability), and GEO (AI citation readiness, llms.txt, entity clarity). Use for pre-launch readiness, post-incident planning, or any 'review my app for X' request.Security572api-authenticationaj-geddes/useful-ai-promptsImplement comprehensive authentication strategies for APIs including JWT tokens, OAuth 2.0, API keys, and session management with proper security practices.Security567
nodeops-authnodeops-app/skillsAdd NodeOps PKCE OAuth authentication to a Next.js app. Trigger when the user wants to set up NodeOps login, integrate NodeOps OAuth, add @nodeops-createos/integration-oauth, or connect a Next.js project to NodeOps identity/SSO. Also trigger on "add NodeOps auth", "setup NodeOps authentication", or "add NodeOps login".Security562
laravel-owasp-securityasyrafhussin/agent-skillsOWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities ("run OWASP audit", "security review", "check my app security") or writing secure Laravel code involving auth, payments, file uploads, or API design. Triggers on security-related tasks, payment handling, authentication, or any request to audit a Laravel codebase.Security558
solidity-auditorpashov/skillsSecurity audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo) or a specific filename.Security558
dt-obs-log-semantic-mappingdynatrace/dynatrace-for-aiSuggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation).Security548
sqlite-to-fast-sqlcap-go/capgo-skillsGuides the agent through migrating SQLite and SQL-style Capacitor plugins to @capgo/capacitor-fast-sql. Use when replacing bridge-based SQL plugins, adding encryption, preserving transactions, or moving key-value storage onto Fast SQL. Do not use for non-SQL storage, generic app upgrades, or plugins that already wrap Fast SQL.Security540security-audit-loggingaj-geddes/useful-ai-promptsImplement comprehensive audit logging for security events, user actions, and system changes with structured logging, retention policies, and SIEM integration.Security533
create-prfandhe-ai/agent-cli-skillsConventional Commits 形式で GitHub PR を作成する。OWASP Top 10 のセキュリティチェック必須で、問題があれば PR 作成を中止。Summary/Test plan/Design を含む body を生成。「PR 作って」「プルリク」「gh pr create」などで使用。別リポジトリ (upstream) への貢献は contribute-skill。Security533implement-issuefandhe-ai/agent-cli-skillsGitHub Issue を読み込み、_/local-plans/<issue-number>-<slug>.md に詳細計画を作成してユーザー承認後にコードを実装する。実装後はセキュリティレビュー (OWASP Top 10) → テスト実行 → Conventional Commits でコミット。Issue 番号や URL を渡された実装依頼、「Issue #N を実装して」「この Issue を着手」などで使用。Security532implement-reviewfandhe-ai/agent-cli-skillsコード変更 (git diff) の品質・アーキテクチャ準拠・セキュリティ (OWASP Top 10) を Agent ツール委譲で読み取り専用レビューする。コミット前/PR 作成前のセルフレビュー、「変更をレビューして」「コードレビューして」などで使用。GitHub PR のレビューには implement-review-pr を使用。Security531
supabase-pentestyoanbernabeu/supabase-pentest-skillsOrchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.Security527
securityparcadei/continuous-claude-v3Security audit workflow - vulnerability scan → verificationSecurity520
vercel-deployvercel-labs/agent-skillsDeploy applications and websites to Vercel. Use this skill when the user requests deployment actions such as "Deploy my app", "Deploy this to production", "Create a preview deployment", "Deploy and give me the link", or "Push this live". No authentication required - returns preview URL and claimable deployment link.Security519
Python Security Scansugarforever/01coder-agent-skillsComprehensive security vulnerability scanner for Python projects including Flask, Django, and FastAPI applications. Detects OWASP Top 10 vulnerabilities, injection flaws, insecure deserialization, authentication issues, hardcoded secrets, and framework-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.Security519
auth-setupget-convex/agent-skillsSet up Convex authentication with proper user management, identity mapping, and access control patterns. Use when implementing auth flows.Security516laravel-security-auditsickn33/agentic-awesome-skillsSecurity auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.Security515
copilot-sdkintellectronica/agent-skillsThis skill helps with GitHub Copilot SDK work across Node.js/TypeScript, Python, Go, .NET, and Java. It covers setup, authentication, permissions, streaming events, custom tools, custom agents, MCP servers, hooks, skills, and session persistence.Security513
oauth2-authenticationmanutej/luxor-claude-marketplaceComprehensive OAuth2 authentication skill covering authorization flows, token management, PKCE, OpenID Connect, and security best practices for modern authentication systemsSecurity511
conducting-api-security-testingmukul975/anthropic-cybersecurity-skillsConducts security testing of REST, GraphQL, and gRPC APIs to identifySecurity507testing-api-security-with-owasp-top-10mukul975/anthropic-cybersecurity-skillsSystematically assesses REST, GraphQL, and gRPC API endpoints against the OWASPSecurity505Next.js Security Scansugarforever/01coder-agent-skillsComprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and Next.js-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.Security503
ClawdStrikecantinaxyz/clawdstrike-skillSecurity audit and threat model for OpenClaw gateway hosts. Use to verify OpenClaw configuration, exposure, skills/plugins, filesystem hygiene, and to produce an OK/VULNERABLE report with evidence and fixes.Security495
dependency-auditoruseai-pro/openclaw-skills-securityAudit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting,Security485
api-testingpetrkindlmann/qa-skillsA response that adds a nullable field or quietly drops one slips past toHaveProperty spot-checks and silently breaks the frontend in production.Security478
security-auditnetresearch/security-audit-skillUse when conducting security assessments — OWASP Top 10 / API / LLM, CWE Top 25, CVSS scoring — auditing PHP/TYPO3, APIs, frontend, Terraform/K8s/Docker IaC, AWS cloud, AI agent configs, or scanning dependencies.Security476
pinme-authglitternetwork/pinmeUse when a PinMe project (Worker TypeScript) needs to integrate user authentication — creating email/password users, verifying id_tokens, querying user info, or listing users via Identity Platform auth proxy APIs.Security468auth-implementation-patternssickn33/agentic-awesome-skillsBuild secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.Security467
websocket-realtime-builderpatricio0312rev/skillsImplements real-time features using WebSockets with Socket.io, rooms, authentication, and reconnection handling. Use when users request "real-time updates", "WebSocket", "Socket.io", "live chat", or "push notifications".Security463permission-auditoruseai-pro/openclaw-skills-securityAnalyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privilegedSecurity460analyzing-linux-audit-logs-for-intrusionmukul975/anthropic-cybersecurity-skillsUses the Linux Audit framework (auditd) with ausearch and aureport utilitiesSecurity458setup-auditoruseai-pro/openclaw-skills-securityAudit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style:Security455
api-authenticationsecondsky/claude-skillsSecure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.Security453vulnerability-scanningsecondsky/claude-skillsAutomated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.Security437
supply-chain-securityzhaoxuya520/reverse-skillUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.Security428secrets-rotationaj-geddes/useful-ai-promptsImplement automated secrets rotation strategy for credentials, API keys, certificates, and encryption keys with zero-downtime deployment and comprehensive audit logging.Security427email-securityzhaoxuya520/reverse-skillUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.Security423secrets-managementaj-geddes/useful-ai-promptsDeploy and configure secure secrets management systems to store, rotate, and audit access to sensitive credentials, API keys, and certificates across your infrastructure.Security419
hugging-face-model-trainerhuggingface/skillsThis skill should be used when users want to train or fine-tune language models using TRL (Transformer Reinforcement Learning) on Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, and model persistence. Should be invoked for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.Security419codebase-cleanup-deps-auditsickn33/agentic-awesome-skillsYou are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.Security411
auditing-securityspencerpauly/awesome-cursor-skillsPerform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.Security411supabase-audit-auth-configyoanbernabeu/supabase-pentest-skillsAnalyze Supabase authentication configuration for security weaknesses and misconfigurations.Security410
security-scanjwynia/agent-skillsScan code for security vulnerabilities including OWASP Top 10, secrets, and misconfigurations. Use when you need comprehensive security analysis of a codebase.Security409security-testingpetrkindlmann/qa-skillsA login test that only checks the happy path passes while an expired JWT still grants admin, an IDOR lets user A read user B's orders, and a webhook field reaches 169.254.169.254.Security408better-authsecondsky/claude-skillsSkill for integrating Better Auth - comprehensive TypeScript authentication framework for Cloudflare D1, Next.js, Nuxt, and 15+ frameworks. Use when adding auth, encountering D1 adapter errors, or implementing OAuth/2FA/RBAC features.Security406
securitytartinerlabs/skillsUse when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. Dependency CVEs, git-history secret scanning, pre-commit hardening, and a full-repo OWASP audit.Security401
firebasedavila7/claude-code-templatesFirebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. ISecurity396
cyrus-setup-gitlabcyrusagents/cyrusConfigure GitLab authentication for Cyrus — glab CLI login and git config for creating merge requests.Security396testing-api-for-broken-object-level-authorizationmukul975/anthropic-cybersecurity-skillsTests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR,Security396supabase-helpyoanbernabeu/supabase-pentest-skillsQuick reference for all Supabase security audit skills with usage examples and command overview.Security391
trading212-apitrading212-labs/agent-skillsThis skill should be used when the user asks to "connect to Trading 212", "authenticate Trading 212 API", "place a trade", "buy stock", "sell shares", "place market order",, "place pending order", "place limit order", "cancel order", "check my balance", "view account summary", "get positions", "view portfolio", "check P&L", "find ticker symbol", "search instruments", "check trading hours", "view dividends", "get order history", "export transactions", "generate CSV report", or needs guidance on Trading 212 API authentication, order placement, position monitoring, account information, instrument lookup, or historical data retrieval.Security384
audit-xcode-security-settingssuperagents-lab/xcode27-skillsAssess an Xcode project's security posture and progressively enable security build settings and entitlements — from broadly applicable warnings through Enhanced Security hardening.Security381csrf-protectionsecondsky/claude-skillsImplements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.Security377Other tasks
same rules, different job
