1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
age-encryption
claude-dev-suite/claude-dev-suite
|
git-secure
leegonzales/aiskills
Encrypt folders and files in a git repo so they're plaintext locally but encrypted on GitHub. Uses git-crypt for transparent encryption and age for versioned snapshots.
fle-rust
couchbaselabs/agent-skills
Field-Level Encryption is not supported by the Couchbase Rust SDK 1.0 — alternatives and workarounds
fle-go
couchbaselabs/agent-skills
Field-Level Encryption with the Couchbase Go SDK — CryptoManager setup, encrypting and decrypting document fields
manamesh-crypto
cyotee/manamesh
This skill should be used when the user asks about "cryptographic primitives", "SRA encryption", "Shamir secret sharing", "Merkle tree", "mental poker", "threshold cryptography", "EC ElGamal", "Paillier", "DLEQ proofs", " Feldman DKG", "ECDSA", "Go Fish crypto", "key escrow", "shuffle proof", or needs to understand how ManaMesh implements provably fair play.
dbt_trino
ivanshamaev/de-agent-skills
Use when writing, configuring, or optimizing dbt projects targeting Trino or Starburst — covering profiles.yml setup, all authentication methods, materializations (table/view/incremental/materialized_view/ephemeral), incremental strategies (append/merge/delete+insert), table properties (format/partitioning/sorted_by), on_schema_change, seeds, snapshots, grants, session properties, data modeling patterns (Kimball/staging/intermediate/mart), dbt project structure, tests, and CI/CD.
github-repo-setup
bcgov/agent-skills
Assess GitHub repository maturity against BC Gov DevOps and security standards. Generates a MATURITY_REPORT.md scorecard covering branch protection rulesets, TypeScript strictness, Renovate preset tracing, vulnerability SLAs, CI/CD quality gates, and OpenShift container security. Use when onboarding repos, running compliance reviews, or evaluating vendor conformance.
coldbox-security-implementation
coldbox/skills
Use this skill when setting up the full CBSecurity framework in ColdBox, configuring the security firewall, creating authentication services, implementing security event handlers, configuring security rules and validators, or building a complete security layer for a ColdBox application.
cloud-penetration-testing
tmolavi/mcp-agent-skills-hub
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
SMTP Penetration Testing
igunublue/awesome-ai-skills
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
secrets-management
kunanonj/claude-skills-hub
Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
secrets-management
jiho00seo-dev/antigravity-awsome-skill
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
secrets-management
tspry/superpowers-devops
Use when working with Vault, SOPS, secret scanning, or managing credentials safely
mysql-encryption
percona-lab/skills
Data-at-rest encryption and keyring management in Percona Server for MySQL. Use when encrypting InnoDB tablespaces, binary/relay logs, redo/undo logs, or temporary files; choosing or configuring a keyring (file, HashiCorp Vault, KMIP, AWS KMS); rotating the master key; or verifying what is encrypted. IMPORTANT - Percona Server provides binary-log encryption, temp-file encryption, and the Vault/KMIP/AWS-KMS keyrings in the OPEN-SOURCE build (these are MySQL Enterprise-only upstream). Encryption uses a two-tier master-key→tablespace-key hierarchy; the keyring must be loaded at startup BEFORE encrypted redo logs or binlogs can open, or the server won't start. Use keyring COMPONENTS, not the removed legacy plugins.
security-scanning-security-dependencies
tmolavi/mcp-agent-skills-hub
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.
platform-encryption-configure
dhoffritz/sf-skills
Configure Salesforce Shield Platform Encryption — generate deployable encryption settings and encrypted-field metadata, and answer key-model and lifecycle questions. TRIGGER when: user wants to turn on deterministic encryption, encrypt a field, set up Cache-Only Keys, External Key Management, or replay detection, or mentions Shield Platform Encryption, encryption at rest, deterministic vs probabilistic encryption, encryptionScheme, PlatformEncryptionSettings, EncryptionKeySettings, BYOK, BYOKMS, tenant secrets, key rotation, or .settings-meta.xml / .field-meta.xml for encryption — even when they don't say 'Shield'. SKIP when: user needs a generic custom field with no encryption (use platform-custom-field-generate), needs the raw Metadata API type reference (use platform-metadata-api-context-get), or asks about Classic Encryption (encrypted text fields), which is a different feature. Use this skill for any Platform Encryption configuration, field-encryption, or key-model question.
vulnerability-analysis
baroude/claude-skills-exploit
Analyze CVE/GHSA vulnerabilities from multiple sources. Collect vulnerability data (GHSA/NVD/OSV), analyze patches, identify security patterns, construct attack sequences, perform risk assessment. Use when you need to understand a specific vulnerability in depth.
dependency-vulnerability-fix
saintgo7/claude-skills
pip-audit 발견 취약점 안전 fix 패턴 — vLLM/PyTorch 같은 큰 의존성 깨지지 않게 patch 버전만 안전 업그레이드. 사용 시점 — "pip-audit", "CVE", "취약점 패치", "aiohttp 업그레이드", "cryptography CVE", "의존성 취약점", "supply chain". 4단계 (스캔 → 분류 → 안전 업그레이드 → 회귀 검증).
webhook-authentication-security
marquesfelip/agents-and-skills
Secure webhook verification and validation for SaaS applications. Use when: webhook authentication security, webhook signature verification, webhook HMAC, webhook secret rotation, webhook replay prevention, secure webhook endpoint, webhook payload validation, webhook origin validation, webhook timing attack, webhook secret management, outbound webhook security, inbound webhook security, webhook signing, webhook shared secret, webhook delivery security, webhook receiver security, webhook forgery prevention.
backend-security-coder
agent-skills-hub/agent-skills-hub
Expert in secure backend coding practices specializing in input
security-core
aaronbassett/paneful
Comprehensive application security expertise covering authentication, authorization, OWASP Top 10, and security best practices. Use when (1) Implementing authentication (JWT, OAuth2, sessions, OAuth for CLI/TUI/desktop apps), (2) Adding authorization (RBAC, ABAC, RLS with Supabase/PostgreSQL), (3) Security auditing code or infrastructure, (4) Setting up security infrastructure (headers, CORS, CSP, rate limiting), (5) Managing secrets and credentials, (6) Preventing OWASP Top 10 vulnerabilities (injection, XSS, CSRF, etc.), (7) Reviewing code for security issues, (8) Configuring secure web applications in TypeScript, Python, or Rust. Automatically triggered when working with authentication/authorization systems, security reviews, or addressing security vulnerabilities.
backend-security-coder
alexander-kastil/skills-collection
Expert in secure backend coding practices specializing in input
aws-penetration-testing
tmolavi/mcp-agent-skills-hub
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
penetration-testing
njones17/ai-agent-master-cyber-skills-list
Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.
penetration-testing
hacho55/absolutelyskilled
>
penetration-testing-basics
shubhashjha/codex-skills
Basic skill for basic penetration testing workflow, defensive security checks, and identifying common application weaknesses. Use when Codex needs a basic starting point for this development area.
penetration-testing-methodology
coppermare/skillverse
Apply systematic penetration testing methodologies including reconnaissance, scanning, exploitation, and reporting. Use for security assessments, red team exercises, or vulnerability discovery.
aws-penetration-testing
guppythecat/antigravity-awesome-skills
This skill should be used when the user asks to \"pentest AWS\", \"test AWS security\", \"enumerate IAM\", \"exploit cloud infrastructure\", \"AWS privilege escalation\", \"S3 bucket testing...
AWS Penetration Testing
jiho00seo-dev/antigravity-awsome-skill
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
Cloud Penetration Testing
jiho00seo-dev/antigravity-awsome-skill
This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
SMTP Penetration Testing
jiho00seo-dev/antigravity-awsome-skill
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
SMTP Penetration Testing
neuralchainx/claude-code-guide
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
smtp-penetration-testing
tmolavi/mcp-agent-skills-hub
Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration.
SSH Penetration Testing
igunublue/awesome-ai-skills
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
SSH Penetration Testing
jiho00seo-dev/antigravity-awsome-skill
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
SSH Penetration Testing
neuralchainx/claude-code-guide
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
ssh-penetration-testing
tmolavi/mcp-agent-skills-hub
Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
WordPress Penetration Testing
igunublue/awesome-ai-skills
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
penetration-test
scramblerlab/generative-radio
Black-box web application penetration test — enumerate, exploit, fix, re-test, and report. Covers OWASP Top 10 2025, API Security Top 10 2023, JWT, WebSocket, cloud metadata, LLM threats, and more. Attack patterns auto-refresh every 30 days.
penetration-test-scope
winbda/claude-skills-collection
|
penetration-tester
mtsatryan/openclaw-ai-agents
Expert penetration tester specializing in ethical hacking, vulnerability assessment, and security testing. Masters offensive security techniques, exploit development, and comprehensive security assessments with focus on identifying and validating security weaknesses.
pentest-planner
barwickdesign/codevitals
>
secrets-management
henryhawke/skills
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
secrets-management
do360now/security-agents
>
secrets-management
vanara-agents/skills
Handle secrets safely across the lifecycle — keep them out of source, load from env or a secret manager, scope to least privilege, encrypt in transit and at rest, rotate on a schedule, and respond fast when one leaks. Deep reference with runbooks, examples, and a runnable leak scanner.
secrets-management
lauren-framework/lauren-framework
Provides a pluggable secrets provider interface with implementations for environment variables, in-memory (tests), HashiCorp Vault, and AWS Secrets Manager. Use when you need to inject secrets into Lauren services without hardcoding credentials.
env-secrets-management
0motionguy/gicm
Vercel env vars, .env.local, secret rotation. Secure config management.
sota-secrets-management
tomkabel/sodo-sota
>-
dependency-auditor
droodotfoo/agent-skills
|
secure-auth
vanara-agents/skills
Implement authentication securely — authentication vs authorization, password hashing (argon2id/bcrypt), sessions vs JWT (storage, expiry, refresh, revocation), MFA, OAuth2/OIDC flows, and defenses against credential stuffing, session fixation, and CSRF. Worked examples + a runnable password-policy check.
secrets-mgr
wellux/claude-code-deprecated
>
secrets
fred-drake/nix
|
secrets-manager
david-2814/claw-aws
Manage AWS Secrets Manager secrets, rotation, versioning, and cross-account sharing via AWS CLI.
secrets-manager
jayrha/agentskills
Detects, prevents, and remediates leaked credentials and teaches safe secret handling using environment variables, vaults (HashiCorp Vault, AWS/GCP/Azure secret stores), KMS envelope encryption, and rotation. Use this skill when a user mentions hardcoded API keys, passwords, tokens, or .env files in code; asks how to store, inject, or rotate secrets; wants to set up a vault or KMS; needs to scrub a leaked credential from git history; or asks to add pre-commit secret scanning.
fhenix-trivial-encryption
nickthelegend/fhenix-skills
Convert plaintext to encrypted types on-chain with FHE.asEuintXX/asEbool/asEaddress (+ optional securityZone), and understand the critical caveat — trivially-encrypted values are NOT confidential. Covers the full cross-cast matrix and the wrap*/asE* renaming.
fhenix-client-sdk-encryption
nickthelegend/fhenix-skills
Encrypt plaintext into InE* inputs with @cofhe/sdk encryptInputs + the Encryptable factory, then pass them into a contract call. Covers the 5-step ZK pipeline, the 2048-bit limit, builder options (setAccount/setChainId/onStep), and the EncryptedItemInput shape.
sqlencryption-review
vanterx/mssql-performance-skills
Analyze SQL Server encryption posture across all layers — TDE, Always Encrypted, cell-level encryption, backup encryption, transport/TLS, certificate lifecycle, asymmetric and symmetric key management, DMK/SMK key hierarchy including sp_control_dbmasterkey_password and SSISDB, EKM/AKV, sensitivity-classification gaps, TLS hardening, AE enclave/driver, operational key lifecycle, SQL Ledger, Azure encryption, dynamic data masking patterns, and PCI-DSS/HIPAA/GDPR/FedRAMP/CMMC/NY-DFS compliance. Applies 112 checks (A1–A112) across 20 categories. Use this skill when reviewing database security posture, preparing for a compliance audit, investigating a key exposure, troubleshooting SSISDB or DMK auto-open failures, or whenever output from sys.dm_database_encryption_keys, sys.certificates, sys.symmetric_keys, sys.master_key_passwords, msdb.dbo.backupset, sys.dm_exec_connections, sys.ledger_*, sys.masked_columns, or sys.sensitivity_classifications is pasted. Trigger for questions about TDE setup, Always Encrypted configuration, backup encryption, TLS enforcement, certificate rotation, key rotation, sp_control_dbmasterkey_password, SSISDB encryption, SQL Ledger, dynamic data masking, HASHBYTES algorithm selection, or crypto-shredding for GDPR.
fle
couchbaselabs/agent-skills
Field-Level Encryption (FLE) in Couchbase — client-side encryption of specific document fields before writing to the server, supported SDKs, key management
fle-python
couchbaselabs/agent-skills
Field-Level Encryption with the Couchbase Python SDK — CryptoManager setup, encrypting and decrypting document fields, key rotation
fle-java
couchbaselabs/agent-skills
Field-Level Encryption with the Couchbase Java SDK — CryptoManager setup, @Encrypted annotation, encrypting and decrypting document fields