1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
verifiable-token-based-authentication-pattern
igbuend/grimbard
Security pattern for self-contained token authentication (e.g., JWT). Use when implementing stateless authentication, designing tokens with embedded claims, or building systems where tokens contain principal information and can be verified without server-side storage. Specialization of Authentication pattern.
security-audit
yangkuoshih/security-audit
>
stash-encryption
cipherstash/protectjs
Implement field-level encryption with @cipherstash/stack using the EQL v3 typed schema. Covers the types.* column catalog, the generic EncryptionClient, encrypt/decrypt and model operations, searchable encryption, encrypted JSON, bulk operations, identity-aware encryption, multi-tenant keysets, and the rollout/cutover lifecycle.
selective-encrypted-transmission-pattern
igbuend/grimbard
Security pattern for encrypting specific data before transmission. Use when only certain data elements need encryption, implementing field-level encryption for transit, or when entities must actively manage encryption decisions. Addresses "Leak action request or data in transit" problem.
encrypted-maps
dfinity/icskills
Add access-controlled, end-to-end encrypted key-value storage to a canister with the vetKeys EncryptedMaps library (ic-vetkeys for Rust and Motoko backends, @icp-sdk/vetkeys for the frontend). Values are encrypted client-side under vetKeys and shared between principals with per-user access rights (Read, ReadWrite, ReadWriteManage). Use when building a password manager, encrypted notes, a secure vault, or any app that stores and shares encrypted data on-chain. Start here for encrypted storage; escalate to the vetkeys skill only for BLS signatures, custom IBE, or timelock encryption.
vetkeys
dfinity/icskills
Build vetKeys cryptography on the Internet Computer via the vetKD system API and the ic-vetkeys (Rust, Motoko) and @icp-sdk/vetkeys (frontend) libraries: identity-based encryption (IBE), threshold BLS signatures, timelock encryption, symmetric key derivation, and offline public-key derivation. Use when implementing IBE, encrypting to a principal, BLS signing, sealed-bid or timelock schemes, deriving encryption keys on-chain, transport keys, or calling vetkd_public_key / vetkd_derive_key. For access-controlled encrypted key-value storage (password managers, encrypted notes), use the encrypted-maps skill instead. Not for authentication — use internet-identity.
owasp-top-10-analysis
aniondev/aniondevpublicskills
Analyze a repository for security weaknesses based on the OWASP Top 10 and provide actionable remediation advice.
security-authentication
kentoshimizu/sw-agent-skills
Security workflow for authentication architecture, credential lifecycle, and session/token assurance. Use when login, identity proofing, MFA, or session security decisions are required; do not use for authorization policy design or non-security quality tuning.
password-based-authentication-pattern
igbuend/grimbard
Security pattern for implementing password-based authentication. Use when designing login systems with username/password, implementing password storage, hashing, salting, peppering, password policies, or password reset flows. Specialization of the Authentication pattern.
web-pentest
nousresearch/hermes-agent
Authorized web pentest: recon, proof-based exploits, report.
cms-tokens-authentication
contentstack/contentstack-agent-skills
Advise developers on choosing the right Contentstack authentication method and token type for frontend, backend, automation, and third-party app use cases. Include security guidance, rate-limit awareness, and SSO considerations.
gdpr-dev
mikkelkrogsholm/dev-skills
GDPR compliance for European developers. Use when building features that handle personal data: user registration, profiles, authentication, email sending, analytics, error tracking, payments, search indexes, background jobs, or any feature that stores, processes, or transmits information about people. Provides stack-aware gotchas, anti-patterns to avoid, and schema design principles. Does not ask questions — applies principles proactively based on what is being built.
supabase-cli
georgekhananaev/claude-skills-vault
CLI automation for Supabase development workflows. Provides scripts for migrations, Edge Functions, secrets management, type generation, and SQL execution with safety checks.
gcloud-auth-verification
gemini-cli-extensions/data-agent-kit-starter-pack
Guidelines for identifying and resolving missing Google Cloud authentication
secret-management-patterns
vibeeval/vibecosystem
HashiCorp Vault, cloud secret managers, rotation strategies, and zero-trust secret access
vuln-scanner
inbharatai/claude-skills
Identify security vulnerabilities in code and configurations — CVE lookup, SAST findings, and remediation guides.
osv-scanner
igbuend/grimbard
Run Google OSV-Scanner for Software Composition Analysis (SCA) and vulnerability detection in dependencies. Use when scanning package manifests, lock files, SBOMs, or container images for known vulnerabilities.
sops-age-secrets
dimdasci/vps-setup
|
SSH Penetration Testing
zebbern/secops-cli-guides
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
google-cloud-secret-manager-js
avbel/ai-skills
Google Cloud Secret Manager conventions for JavaScript and TypeScript - @google-cloud/secret-manager setup, ADC/IAM, access/create/rotate/list/delete secrets, version pinning, and getSecret(key) modules that return undefined when unconfigured.
active-record-encryption
thinkoodle/rails-skills
Expert guidance for encrypting sensitive data at rest using Active Record Encryption in Rails. Use when adding encryption to model attributes, rotating keys, migrating unencrypted data, querying encrypted fields, or protecting PII. Triggers on "encryption", "encrypt", "encrypts", "encrypted attribute", "at-rest encryption", "field encryption", "key rotation", "deterministic encryption", "PII", "sensitive data", "encrypt column", "encrypts macro".
encryption-pattern
igbuend/grimbard
Security pattern for implementing encryption and decryption operations. Use when encrypting data for confidentiality, selecting encryption algorithms (AES, RSA), configuring cipher modes (GCM, CBC), choosing key lengths, or implementing symmetric/asymmetric encryption. Specialization of Cryptographic action pattern addressing confidentiality requirements.
encrypted-tunnel-pattern
igbuend/grimbard
Security pattern for channel-level encryption (TLS/SSH). Use when implementing HTTPS, securing all communication between endpoints, setting up TLS connections, or when infrastructure should handle encryption transparently. Addresses "Leak action request or data in transit" problem.
selective-encrypted-storage-pattern
igbuend/grimbard
Security pattern for field-level encryption at rest. Use when encrypting specific sensitive data fields before storage, implementing application-level encryption for databases, or when only certain data elements need encryption at rest. Addresses "Leak data at rest" problem.
transparent-encrypted-storage-pattern
igbuend/grimbard
Security pattern for full-disk or database-level encryption at rest. Use when implementing Transparent Data Encryption (TDE), full-disk encryption, or when storage infrastructure should handle encryption without application changes. Addresses "Leak data at rest" problem.
stash-drizzle
cipherstash/stack
Integrate CipherStash encryption with Drizzle ORM using @cipherstash/stack-drizzle (EQL v3). Covers the types.* encrypted column factories (concrete Postgres domains), auto-encrypting query operators (eq, ne, gt/gte/lt/lte, between, inArray, matches, contains, JSON selector, asc/desc), schema extraction, the Encryption typed client, database setup with stash eql install, and migrating existing plaintext columns to encrypted. Use when adding encryption to a Drizzle ORM project, defining encrypted Drizzle schemas, or querying encrypted columns with Drizzle.
owasp-checker
inbharatai/claude-skills
Check for OWASP Top 10 vulnerabilities — injection, broken auth, XSS, insecure deserialization, and misconfiguration.
message-authentication-code-pattern
igbuend/grimbard
Security pattern for implementing Message Authentication Codes (MACs) to ensure data integrity and origin authentication. Use when implementing HMAC, CMAC, or other MAC algorithms, verifying message integrity, authenticating message origin with shared secrets, or when non-repudiation is NOT required. Specialization of Cryptographic action pattern.
container-security-skill
julianobarbosa/claude-code-skills
Container image security scanning, Dockerfile hardening, and ACR image management. Use when scanning container images for vulnerabilities with Trivy, hardening Dockerfiles (pinning versions, non-root runtime, SSH config), importing images to Azure Container Registry to avoid Docker Hub rate limits, or analyzing CVE findings. Also trigger when the user mentions image security, vulnerability scanning, CVE remediation, container hardening, Trivy scan, Docker security, or ACR image import — even if they don't explicitly say "container security".
agentic-wallet
coinbase/agentic-wallet-skills
Crypto wallet operations via the awal CLI — sign in, check balances, send USDC/ETH/POL/SOL, trade tokens, fund the wallet, and use the x402 payment protocol to discover paid services, pay for API calls, monetize an API, or query onchain data. Use whenever the user mentions signing in, login, authentication, wallet status, balance, address, sending money, paying someone, transferring tokens, ENS names, swapping/trading/converting tokens, funding/topping up/onramp, USDC, ETH, POL, SOL, the x402 bazaar, paid APIs, monetizing an endpoint, or querying onchain data on Base.
nextjs-supabase-auth
odjaramillo/custom-rules
Expert integration of Supabase Auth with Next.js App Router Use when: supabase auth next, authentication next.js, login supabase, auth middleware, protected route.
email-and-password-best-practices
epicenterhq/epicenter
Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.
gcp
cloudvoyant/codevoyant
GCP context skill — gcloud authentication, Artifact Registry image push/pull, Cloud Run deploy, Terraform infra patterns, and common mise.toml GCP env vars. Triggers on: ".tf files", "Terraform", "Dockerfile with gcr.io or pkg.dev", "mise.toml with GCP_ env vars", "gcloud commands", "Cloud Run", "Artifact Registry", "GCP project", "service account impersonation".
supabase-setup
kazdenc/builder-skills
Initialize Supabase for a project including database schema, Row Level Security policies, authentication, storage buckets, and edge functions. Use when user says "set up Supabase", "add Supabase", "configure database", "add auth", "Supabase init", "RLS policies", or needs a backend with Supabase.
supabase-ts
bjornmelin/dev-skills
Production-ready Supabase integration patterns for Next.js/React/TypeScript applications. Use when working with Supabase for (1) SSR authentication with @supabase/ssr, (2) Database operations and migrations, (3) Row Level Security (RLS) policies, (4) Storage buckets and file uploads, (5) Realtime channels and presence, (6) Edge Functions with Deno, (7) pgvector embeddings and semantic search, (8) Vercel deployment and connection pooling, (9) CLI operations (type generation, migrations). Triggers on Supabase client setup, auth patterns, RLS policies, storage uploads, realtime subscriptions, Edge Functions, vector search, or Vercel+Supabase deployment.
oauth-security-anti-pattern
igbuend/grimbard
Security anti-pattern for OAuth implementation vulnerabilities (CWE-352, CWE-287). Use when generating or reviewing OAuth/OIDC authentication flows, state parameter handling, or token exchange. Detects missing CSRF protection and insecure redirect handling.
safe-encryption
grittygrease/safe-encryption-skill
Encrypt, decrypt, and manage keys with the SAFE CLI — a modern GPG alternative with post-quantum support.
dj-auth
ashbrener/opinionated-django
Install and wire authentication for a Django + Ninja project — custom User model (AbstractUser + email login + prefixed ULID PK), custom UserManager, AUTH_USER_MODEL, jwtninja for SPA/mobile API auth with Django sessions retained for admin, and AuthedRequest type narrowing. Use when scaffolding a new project that needs auth, or converting an existing Django project to the email-login + JWT pattern. Designed to pair with dj-scaffold and supersede its placeholder User import.
opaque-token-based-authentication-pattern
igbuend/grimbard
Security pattern for server-side token authentication (e.g., session IDs). Use when implementing session management, designing stateful authentication where server maintains token-to-principal mapping, or building systems requiring immediate token revocation. Specialization of Authentication pattern.
AWS Penetration Testing
zebbern/secops-cli-guides
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
SMTP Penetration Testing
zebbern/secops-cli-guides
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
create-secret
thisrohangupta/harness-skills
>-
stash-dynamodb
cipherstash/stack
Integrate CipherStash encryption with Amazon DynamoDB using @cipherstash/stack/dynamodb and EQL v3 schemas. Covers item and bulk encryption, legacy v2 reads, HMAC query attributes, nested objects, audit logging, and the __source/__hmac storage convention.
vuln-report
waybarrios/opencode-power-pack
Turn one confirmed security finding into a disclosure-ready GitHub advisory with root cause, proof of concept, impact, and source evidence. Use for reporting an established vulnerability, not discovering or validating one.
owasp-top-10
ggailabs/synkos-releases
OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.
owasp-serverless-top-10
yariv1025/skills
OWASP Serverless Top 10 - prevention, detection, and remediation for serverless (Lambda, Functions) security. Use when building or reviewing serverless apps - event injection, over-permissioned functions, insecure deps, secrets, config, and other serverless-specific interpretations of the Web Top 10.
authenticate-wallet
ahmetenesdur/starkfi
Authenticate, manage sessions, and deploy Starknet wallets with StarkFi. Handles email OTP login (two-step), session checks, address display, account deployment, and logout. Use this skill whenever the user wants to sign in, log in, check their session, see their wallet address, deploy their account, or log out — even if they don't say "authenticate" explicitly.
two-factor-authentication-best-practices
epicenterhq/epicenter
Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.
Linear OAuth + Actor Authorization
thelobbi/claude
This skill should be used when implementing Linear OAuth 2.0, OAuth actor authorization, or file-storage authentication. Activates on "linear oauth", "linear auth", "actor token", "linear-actor-token", "file storage".
terraform-secrets-management
dawiddutoit/custom-claude
|
gcp-secret-manager
kilo-org/kilo-marketplace
>-
env-secrets-manager
scayver/marketing-skills
>
programmable-privacy
skalenetwork/skills
Encrypted transactions, conditional transactions (CTX), re-encryption, and confidential tokens on SKALE. Use for privacy dApps, confidential voting, sealed-bid auctions, encrypted state, and data sharing.
dependency-audit
thedaviddias/front-end-checklist
Use when reviewing a project's security posture, setting up CI pipelines, or responding to a reported vulnerability in a dependency.
owasp-privacy-top-10
yariv1025/skills
OWASP Top 10 Privacy Risks - prevention, detection, and remediation for privacy in web applications. Use when addressing app vulnerabilities, data leakage, breach response, consent, transparency, data deletion, data quality, session expiration, user access rights, excessive data collection.
owasp-iot-top-10
yariv1025/skills
OWASP IoT Top 10 - prevention, detection, and remediation for IoT device and ecosystem security. Use when designing or reviewing IoT devices - passwords, network services, ecosystem interfaces, secure updates, components, data transfer/storage, device management, default settings, physical hardening, privacy.
authentication
opanasiuk00/swift-ios-skills
Implement iOS authentication flows with AuthenticationServices and LocalAuthentication. Use when building Sign in with Apple, passkey/WebAuthn registration or sign-in with ASAuthorizationPlatformPublicKeyCredentialProvider, ASAuthorizationController credential state and revocation handling, ASWebAuthenticationSession OAuth or third-party login, Password AutoFill, identity-token server validation, or local biometric re-authentication with LAContext.
api-security-schemathesis
vchirrav-eng/product-security-ai-skills
Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
auth0-aspnetcore-authentication
auth0/agent-skills
>
encryption
epicenterhq/epicenter
Encryption: HKDF, XChaCha20-Poly1305, blob formats, key hierarchy/rotation. Use for "encrypt this", "key management", crypto primitives, EncryptedBlob.