1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
fs-mobile-security
fernandoserra/skills
Audita el código fuente de una app Expo/React Native contra el OWASP MASVS (Mobile Application Security Verification Standard), nivel L1 por defecto. Revisa storage, criptografía, autenticación, red, plataforma, calidad de código y privacidad, y reporta por control con estado, evidencia y remediación. Usar cuando el usuario pida una auditoría de seguridad, un análisis OWASP/MASVS, o revisar vulnerabilidades de una app móvil.
security-secrets-management
kentoshimizu/sw-agent-skills
Security workflow for secret inventory, storage, distribution, rotation, and auditability controls. Use when API keys, credentials, certificates, or signing secrets lifecycle decisions are required; do not use for generic config management that excludes sensitive material.
security-sensitive-path-instrumenter
arabelatso/skills-4-se
Instruments authentication, authorization, and input-handling code paths to monitor security-relevant events and states at runtime. Use this skill when developers need to add security monitoring and logging to their code, including tracking authentication attempts (login/logout), authorization decisions (access control checks), input validation failures, session management events, and other security-critical operations. Supports Python, JavaScript/TypeScript, and Java with structured logging patterns. Triggers when users ask to add security instrumentation, monitor security events, log authentication/authorization, track security-sensitive operations, or add security observability to their codebase.
secrets-management
kunanonj/ai-skills-hub
Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
secrets-management
ffsshhttiikk/opencode-agents-skills
Secrets and credentials management best practices
secrets-management-azure-key-vault
anurag-azure/skills
Implement Azure Key Vault secrets management for all LeadPerfection Spring Boot 4.x microservices — Spring Cloud Azure Key Vault integration, zero-secret-in-code pattern, secret rotation, and CI/CD pipeline vault access.
encryption
ffsshhttiikk/opencode-agents-skills
Data encryption best practices and implementation
data-encryption
afu-it/secure-ship
Encrypt personal data at rest and in transit to comply with PDPA 2024. Covers field-level encryption for PII, AES-256-GCM patterns, key management, and database column encryption for Node.js, Python, Laravel, and Cloudflare Workers. Use when storing sensitive user data, implementing encryption, or responding to PDPA compliance requirements.
owasp
ffsshhttiikk/opencode-agents-skills
Practical application and coding skills for Owasp
owasp
saeedhosan/agent-skills
Perform an OWASP security assessment across the application, APIs, database layer, internal services, and deployment surface. Use for security audits. Append "deep" for an extra-thorough assessment with attacker mindset.
authentication
param087/saas-starter-skills
Use when adding sign-in/sign-up or session handling to a SaaS app — set up Auth.js (NextAuth) or a hosted provider with secure sessions, OAuth + email, and server-side session checks that protect routes and actions.
authentication
stagecontinuity/continuityskills
Obtain and refresh JWT access tokens, and manage API keys for the Continuity V1 API
api-security-testing
charlieviettq/awesome-agent-skill
Security testing checklist for HTTP APIs—authn/z, input validation, rate limits, sensitive data exposure, and common OWASP API issues. Use when reviewing or testing REST/GraphQL endpoints before release.
api-security-tester
alizafarbati/opencode-agents-mcp
Expert API security tester specializing in REST, GraphQL, and SOAP API vulnerability assessment and security testing.
devops
maxmiksa/auto-company
Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm). Use for serverless, containers, CI/CD, GitOps, security audit.
vulnerability-validation
factory-ai/skills
Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.
threat-model-generation
factory-ai/skills
Generate a STRIDE-based security threat model for a repository. Use when setting up security monitoring, after architecture changes, or for security audits.
devops
hotriluan/alkana-dashboard
Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm). Use for serverless, containers, CI/CD, GitOps, security audit.
embedded
prismatic-io/prismatic-skills
Reference documentation for embedding Prismatic's integration marketplace and workflow builder in a web application. Covers JWT authentication, the embedded SDK, marketplace and workflow embedding, theming, i18n, additional screens, and custom marketplace UI. Use when the user asks about embedding Prismatic, JWT tokens for embedded apps, marketplace iframes, workflow builder integration, custom marketplace UI, or frontend SDK setup.
firebase
cleodin/antigravity-awesome-skills
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
fastify-auth-and-oauth
andrewsrigom/agent-skills
Use when implementing authentication or OAuth flows in Fastify, especially authorization code with PKCE, login callbacks, token validation, refresh handling, session or cookie boundaries, and protected route hooks.
mcp-server-oauth
contextware/skills
Handles OAuth authentication flows for protected MCP servers that require user authorization.
oauth
fullstack-phoenix/saas_kit
Use when the app needs social sign-in (GitHub OAuth) on top of existing authentication. Covers installing Ueberauth, the user-identity linking flow, configuration, and how to add more providers.
paid-add
lovstudio/skills
Compute the sum of two numbers. The simplest possible skill, used as an end-to-end test for the paid-skill encryption + activation protocol. Trigger when the user says "paid add", "/paid-add", "用 paid-add 算", or asks to use the paid-add skill.
privacy-engineering
marvinrichter/clarc
Privacy engineering patterns — PII classification and inventory, GDPR consent flows, data minimization, right-to-erasure implementation, pseudonymization/encryption, privacy-by-design architecture, and DPIA checklist.
sub-account
s60007766/binance-openclaw
Binance Sub-account request using the Binance API. Authentication requires API key and secret key.
dotenvx-secrets
leonardoacosta/skills
Use dotenvx to inject, encrypt, and redact .env secrets — especially when running a coding agent (Claude Code, Codex) against real credentials. Triggers on dotenvx, `dotenvx run`, `--redact`, `--overload`, .env encryption, .env.keys, DOTENV_PRIVATE_KEY, `op://`/`bw://` secret references, 1Password service accounts, vault access, MCP secret injection, "secrets in Claude Code", "don't leak my API key", precommit .env guards, or migrating a repo off dotenv-cli. Covers what redaction does and — critically — what it does not protect against.
ssh-penetration-testing
guppythecat/antigravity-awesome-skills
This skill should be used when the user asks to \"pentest SSH services\", \"enumerate SSH configurations\", \"brute force SSH credentials\", \"exploit SSH vulnerabilities\", \"perform SSH tu...
node-dependency-vulns
skuridin/agent-stuff
Use this skill when the user wants to audit or fix JavaScript or TypeScript dependency vulnerabilities in a project, including npm, pnpm, and Yarn repos or workspaces. It detects the active package manager, runs the correct audit command, prefers real dependency upgrades over forced pins, warns when a major version bump is the clean fix, and uses overrides or resolutions only as a last resort.
retire
podut/gitleakguard
Scans JavaScript dependencies for known vulnerabilities using the RetireJS database. Checks npm packages in node_modules and package.json against a database of CVEs. Use when adding new packages, reviewing dependencies, or before deploying.
dependency-auditor
aaaaqwq/agi-super-team
Audit project dependencies for vulnerabilities, license risks, upgrade
AWS Penetration Testing
claudiodearaujo/izacenter
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
Cloud Penetration Testing
claudiodearaujo/izacenter
This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
SMTP Penetration Testing
claudiodearaujo/izacenter
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
SSH Penetration Testing
claudiodearaujo/izacenter
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
WordPress Penetration Testing
claudiodearaujo/izacenter
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
authorized-pentest
cb23333/cb-skills
>
secrets-management
anurag-azure/skills
Secrets management: externalized secrets, vaults (Azure Key Vault/AWS Secrets Manager/Vault), rotation, and least-privilege access.
sota-secrets-management
martinholovsky/sota-skills
>-
moai-security-encryption
jg-chalk-io/nora-livekit
Encryption patterns - AES-GCM, RSA, password hashing, envelope encryption
fle-nodejs
couchbaselabs/agent-skills
Field-Level Encryption with the Couchbase Node.js SDK — CryptoManager setup, encrypting and decrypting document fields
azure-compliance
microsoft/skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
entra-app-registration
microsoft/skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
Email & Password Best Practices
better-auth/skills
This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.
llm-security
semgrep/agent-skills
Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like "prompt injection" or "check LLM security".
auth
openai/plugins
Authentication integration guidance — Clerk (native Vercel Marketplace), Descope, and Auth0 setup for Next.js applications. Covers middleware auth patterns, sign-in/sign-up flows, and Marketplace provisioning. Use when implementing user authentication.
sign-in-with-vercel
openai/plugins
Sign in with Vercel guidance — OAuth 2.0/OIDC identity provider for user authentication via Vercel accounts. Use when implementing user login with Vercel as the identity provider.
fle-scala
couchbaselabs/agent-skills
Field-Level Encryption is not supported by the Couchbase Scala SDK — alternatives and workarounds
django-security
omkarop0808/neofuture
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
implementing-scalekit-flask-auth
scalekit-inc/skills
Guides implementation of Scalekit OIDC/OAuth2 authentication and authorization in an existing Flask project. Use when the user wants to add Scalekit login, SSO, token management, session handling, or permission-based route protection to a Flask app.
flask-development
natelandau/dotfiles
Build Python web applications with Flask 3+, using the application factory pattern and Blueprints. Use when developing Flask projects — blueprint structure, routes, authentication, error handling, working with sessions, implementing forms, configuring flask extensions, Jinja2 templates, CLI commands, logging, security, and deployment. Also use when the user mentions Flask routes, blueprints, app factory, Flask-Login, Flask-WTF, or any Flask extension, even if they don't explicitly say "Flask development.
cloud-security-audit
alizafarbati/opencode-agents-mcp
Expert cloud security auditor specializing in AWS, Azure, and GCP security assessment and cloud infrastructure auditing.
firebase-gcp
trusted-american/marketplace
Deep Firebase and Google Cloud Platform reference — Firestore Admin SDK (every method, query operator, aggregation, timestamp, FieldValue), Authentication Admin (full user management, token operations, custom claims), Cloud Storage Admin (bucket operations, signed URLs, metadata), Realtime Database, Security Rules, indexes, backup/export, and GCP service configuration
netlify-identity
practicalswan/agent-skills
Add authentication and user management to a Netlify site with @netlify/identity — signup/login/logout, OAuth social login (Google/GitHub/GitLab/Bitbucket), server-side user verification in Functions, role-based access control (RBAC), admin user management, and Identity event hooks. Use when adding a login/signup flow, \"add social login\", gating content by user role, protecting a function or page behind auth, assigning roles at signup, customizing auth emails, or handling OAuth/confirmation/recovery callbacks. Not for locking an entire site to a company/team — that is netlify-access-control.
netlify-mcp-servers
practicalswan/agent-skills
Build, deploy, and secure Model Context Protocol (MCP) servers on Netlify. Use whenever the task involves creating an MCP server, exposing an app or API to AI agents as MCP tools, letting Claude / Cursor / Claude Code call a custom remote server, or adding MCP tools to an existing Netlify site. Covers the MCP SDK + Streamable HTTP transport on a Netlify Function, authentication (single shared secret vs per-user API keys with Netlify Identity), read/write safety, file uploads, and connecting clients. Use even when the user just says \"MCP\", \"tool server for an agent\", or \"let an AI use my API\".
firebase
claudiodearaujo/izacenter
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
oauth
jpoutrin/product-forge
OAuth 2.0 and OpenID Connect implementation patterns. Use when implementing authentication, authorization flows, or integrating with OAuth providers like Google, GitHub, or custom identity providers.
authenticating-with-oauth
emgreppi/business-central-ai-skill
Generates access tokens, handles token refresh, and manages bearer authentication for external APIs in BC. Use when implementing OAuth Client Credentials flow, Authorization Code flow, or API authentication with token caching.
encryption
tinh2/skills-hub-registry
Audit and harden encryption across the full stack. Checks data-at-rest encryption (database TDE, field-level AES-256-GCM, file storage SSE, backup encryption), data-in-transit security (TLS 1.2+, HSTS, certificate pinning, mTLS, WebSocket WSS), key management (KMS, envelope encryption, key rotation, key separation), password hashing (argon2id, bcrypt, scrypt, PBKDF2 work factors, salt uniqueness, migration plans), token security (JWT signing algorithms, CSPRNG, refresh token rotation), and API key management (hashed storage, scoping, revocation). Use when you need to audit crypto, fix weak hashing, implement envelope encryption, rotate keys, upgrade TLS, or harden token generation.
fle-php
couchbaselabs/agent-skills
Field-Level Encryption with the Couchbase PHP SDK — CryptoManager setup, encrypting and decrypting document fields