1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
create-auth-skill
epicenterhq/epicenter
Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
oauth-2-0-setup
h4vzz/awesome-ai-agent-skills
Implement OAuth 2.0 authentication flows including authorization code with PKCE, client credentials, and device code for secure API integration.
check-dependency-vulnerabilities
dykyi-roman/awesome-claude-code
Analyzes PHP dependencies for security vulnerabilities. Detects outdated packages, known CVEs, unsupported versions, vulnerable transitive dependencies.
cyber-owasp-review
0x-professor/agent-skills-hub
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.
secrets-vault-manager
kilo-org/kilo-marketplace
>-
dependency-check
novacode37/claude-security-skills
>-
fix-vulnerabilities
soyio-id/skills
Fix multiple dependency vulnerabilities across multiple repos. Parses Vanta-style vulnerability entries, groups by repo, creates a single fix branch per repo, applies all fixes, verifies compatibility, and creates PRs after user approval. Use when the user says '/fix-vulnerabilities' or asks to fix vulnerabilities across repos.
owasp-top10-security-test
akarnikr/asuo-skills-inventory
Assess application code and configuration for OWASP Top 10 security risks with actionable findings and remediations. Use when reviewing new features, bug fixes, pull requests, or release candidates where security regression risk must be evaluated systematically.
owasp-cloud-native-top-10
yariv1025/skills
OWASP Cloud-Native Application Security Top 10 - prevention, detection, and remediation for containers, orchestration, and cloud-native apps. Use when securing insecure config, injection, auth, CI/CD and supply chain, secrets, network policies. Note - official list has 6 risks; project archived.
firebase-auth-basics
falahat/agent-skills
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
firebase
xfstudio/skills
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
oRPC Encryption Helpers
ali-master/skills
Functions to encrypt and decrypt sensitive data using AES-GCM.
bx-mail
ortus-boxlang/skills
Use this skill when sending email in BoxLang with the bx-mail module: bx:mail component, attachments with bx:mailparam, multipart emails with bx:mailpart, SMTP configuration in boxlang.json, S/MIME signing and encryption, and server-level mail settings.
envx
rahulretnan/envx-cli
>-
trivy
mauromedda/agent-toolkit
>-
penetration-testing
ffsshhttiikk/opencode-agents-skills
Penetration testing and ethical hacking
ai-pentesting
terminalskills/skills
>-
owasp-security-audit
mfksec/owasp-security-skills
Perform OWASP-aligned security audits of source code, API handlers, mobile apps, Kubernetes manifests, LLM/agent code, and deployment configuration. Covers the OWASP Top 10 (2021), ASVS 5.0, MASVS, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the OWASP LLM Top 10 (2025) plus Agentic Applications Top 10 (2026). Use this skill whenever the user asks for a security review, vulnerability audit, threat assessment, compliance check, or hardening guidance — including indirect phrasings like "is this login flow secure?", "review this endpoint", "audit my pod spec", "what could go wrong with this prompt?", or when the user pastes auth, crypto, SQL, RBAC, or LLM-tool-calling code without explicitly asking for security review.
owasp-zap
terminalskills/skills
>-
owasp-kubernetes-top-10
yariv1025/skills
OWASP Kubernetes Top 10 - prevention, detection, and remediation for Kubernetes security. Use when designing or reviewing K8s workloads and clusters - workload config, supply chain, RBAC, policy enforcement, logging, authentication, network segmentation, secrets, cluster components, vulnerable components.
api-security
jim60105/copilot-prompt
>-
moai-platform-auth0
modu-ai/moai-rank
Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements.
moai-platform-firebase-auth
modu-ai/moai-rank
Firebase Authentication specialist covering Google ecosystem, social auth, phone auth, and mobile-first patterns. Use when building Firebase-backed or Google ecosystem apps, implementing social login, or adding phone verification.
moai-platform-clerk
modu-ai/moai-rank
Clerk modern authentication specialist covering WebAuthn, passkeys, passwordless, and beautiful UI components. Use when implementing modern auth with great UX.
firebase-auth-basics
hoangsoft90/ai_skills
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
bx-pdf
ortus-boxlang/skills
Use this skill when generating PDF documents in BoxLang with the bx-pdf module: bx:document component, headers/footers with bx:documentitem, multi-section PDFs with bx:documentsection, saving to file, capturing PDF as binary variable, encryption, and page settings.
bx-esapi
ortus-boxlang/skills
Use this skill for OWASP ESAPI encoding, decoding, and HTML sanitization in BoxLang: encodeFor(), encodeForHTML(), encodeForJavaScript(), encodeForSQL(), encodeForURL(), decodeFrom(), htmlSanitize() with AntiSamy, and context-aware output encoding to prevent XSS/injection.
bx-ftp
ortus-boxlang/skills
Use this skill when working with FTP, FTPS, or SFTP operations in BoxLang: connecting to servers, uploading/downloading files, managing remote directories, listing contents, SSH key authentication, named connection pooling, and using the bx:ftp component.
check-authentication
dykyi-roman/awesome-claude-code
Analyzes PHP code for authentication issues. Detects weak password handling, insecure sessions, missing auth checks, token vulnerabilities.
check-crypto-usage
dykyi-roman/awesome-claude-code
Analyzes PHP code for cryptography issues. Detects weak algorithms, hardcoded keys, insecure random, poor key management, deprecated functions.
owasp-security-check
emerson1337/skills-for-agents
Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production deployment.
moai-platform-auth
modu-ai/cc-plugins
>
api-testing
oimiragieo/agent-studio
API security testing and validation for REST/GraphQL/gRPC endpoints, contract testing, load testing, fuzzing, and Postman/Bruno/Hurl workflows
create-hec-event-integration
bitwarden/clients
Use when adding a new HEC (HTTP Event Collector) event integration to the Bitwarden web client. Implements the Splunk token authentication model (Bearer token + URI). Covers feature flag setup and card registration behind the flag. Does not apply to API key integrations or integrations requiring a custom connect dialog.
memstack-business-gdpr
cwinvestments/memstack
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR applies and how critical it is, then reports required roles, obligations, and remediation. Do NOT use for general security audits (use owasp-top10) or contract drafting (use contract-template).
modal-web-serving
botirkhaltaev/botir-skills
Expose Modal Functions as HTTP endpoints using FastAPI, ASGI, WSGI, or raw HTTP. Use when building APIs, web apps, streaming endpoints, or serving ML models over HTTP with custom domains and authentication. For low-latency long-lived servers see modal-servers; for managed LLM APIs see modal-endpoints.
security-firebase-apk-scanner
elizaos/eliza
Scan Android APKs for Firebase misconfigurations and exposed credentials. Use when analyzing Android applications for insecure Firebase configurations, leaked API keys, open Realtime Database or Firestore instances, exposed Cloud Storage buckets, or misconfigured authentication settings.
mcp-oauth-setup
obie/skills
Implement MCP server authentication with OAuth Dynamic Client Registration (RFC 7591), Authorization Server Metadata Discovery (RFC 8414), and generalized per-agent credential support. This skill should be used when building admin UIs that let users connect to third-party MCP servers, whether they use OAuth (Linear, Sentry, Granola), bearer tokens (Render, custom APIs), or API keys. Covers the full flow: metadata discovery, client registration, PKCE authorization, token exchange, token refresh, tool sync, and credential storage patterns (shared vs per-agent for any auth type). Includes hard-won lessons from production implementation.
encryption-patterns
skeletorflet/opencode-kit
Encryption and data security patterns. At-rest encryption, in-transit, field-level encryption, key management, hashing.
dn-reset
automattic/dn-cli
Remove stored dn CLI configuration and credentials. Use when the user wants to clear their saved credentials, start fresh, or switch between authentication modes. Does not require existing configuration.
testing-api-tester
sahiixx/agency-agents
Expert API testing specialist focused on comprehensive API validation, performance testing, and quality assurance across all systems and third-party integrations
secrets-management
afu-it/secure-ship
Prevent hardcoded secrets in source code. Covers .env setup, .gitignore patterns, secret scanning, runtime secret injection, and rotation strategies for Node.js, Python, Laravel, and Cloudflare Workers. Use when setting up environment variables, fixing exposed secrets, or implementing secret rotation.
cicd-automation-secrets-management
mohsenpak370/agent-skills
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
dependency-scanning
github/copilot-advanced-security-plugin
Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.
audit
git-pkgs/skills
Scan dependencies for known vulnerabilities using OSV, check provenance attestations, and find deprecated or yanked versions. Use when checking for CVEs, reviewing security posture, or investigating who introduced or fixed a vulnerable dependency.
owasp-check
woohyun212/security-skill
OWASP Top 10 (2021) checklist-based inspection and compliance matrix generation
symfony-security
recranet/symfony-skills
Symfony security - firewalls, authenticators, voters, access control, password hashing, #[IsGranted]. Use for any authentication or authorization task in a Symfony project - login, API tokens, roles, permissions, securing endpoints or routes.
setup-dune-auth
cognitedata/builder-skills
MUST be used when migrating an existing React app to Dune, or when no Dune auth is wired up. Detects classic vs Apps API flow from `app.json` `infra` field, installs the right packages, and wires up the entry file. No-op when a valid auth setup is already in place. Triggers: migrate to Dune, add Dune auth, DuneAuthProvider, AppSdkAuthProvider, connectToHostApp, useDune, Dune setup, setup auth, missing auth provider, CDF authentication, Fusion iframe auth.
healthcheck
firecrawl/openclaw
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).
cloud-pentest
woohyun212/security-skill
Multi-cloud CSPM assessment using ScoutSuite/Prowler with IAM privilege escalation, storage exposure, and network posture for AWS/Azure/GCP
tasks
arlenagreer/claude_configuration_docs
Manage Google Tasks with full CRUD operations via Ruby scripts. This skill should be used when working with Google Tasks - creating, reading, updating, deleting, and organizing tasks and task lists. Supports task completion, subtask creation, task ordering, and integration with other Google skills through shared OAuth authentication.
embedded-patterns
prismatic-io/prismatic-skills
Reference documentation for embedding Prismatic's integration marketplace and workflow builder in a web application. Covers JWT authentication, the embedded SDK, marketplace and workflow embedding, theming, i18n, additional screens, and custom marketplace UI. Use when the user asks about embedding Prismatic, JWT tokens for embedded apps, marketplace iframes, workflow builder integration, custom marketplace UI, or frontend SDK setup.
firebase-auth-basics
kinnekate-hub/agent-skills
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
firebase
terminalskills/skills
Expert guidance for Firebase, Google's platform for building and scaling web and mobile applications. Helps developers set up authentication, Firestore/Realtime Database, Cloud Functions, hosting, storage, and analytics using Firebase's SDK and CLI.
firebase
automindtechnologie-jpg/ultimate-skill.md
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
epmd-pentest
abelrguezr/hacktricks-skills
Pentest Erlang Port Mapper Daemon (epmd) on port 4369. Use this skill whenever you need to enumerate, assess, or exploit epmd services during security assessments. Trigger this when you see port 4369 open, when working with RabbitMQ or CouchDB installations, when you need to extract Erlang node information, or when attempting cookie-based RCE attacks. Don't forget to use this for any epmd-related reconnaissance or exploitation tasks.
lovstudio:paid-add
lovstudio/skills
Compute the sum of two numbers. The simplest possible skill, used as an end-to-end test for the paid-skill encryption + activation protocol. Trigger when the user says "paid add", "/paid-add", "用 paid-add 算", or asks to use the paid-add skill.
encrypting-and-decrypting-data
jeremylongshore/claude-code-plugins-plus-skills
Validate encryption implementations and cryptographic practices. Use
yt-dlp
1999azzar/yt-dlp-skill
A robust CLI wrapper for yt-dlp to download videos, playlists, and audio from YouTube and thousands of other sites. Supports format selection, quality control, metadata embedding, and cookie authentication.
fs-mobile-security
fernandoserra/skills
Audita el código fuente de una app Expo/React Native contra el OWASP MASVS (Mobile Application Security Verification Standard), nivel L1 por defecto. Revisa storage, criptografía, autenticación, red, plataforma, calidad de código y privacidad, y reporta por control con estado, evidencia y remediación. Usar cuando el usuario pida una auditoría de seguridad, un análisis OWASP/MASVS, o revisar vulnerabilidades de una app móvil.