1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
api-firebase-auth
jcorpac/ai-skills-library
Patterns for implementing secure user authentication with Firebase Auth.
firebase-authentication-patterns
agentient/vibekit
>
firebase-auth
mgd34msu/goodvibes-gemini
Implements Firebase Authentication with email, OAuth, phone auth, and custom tokens. Use when building apps with Firebase, needing flexible auth methods, or integrating with Firebase ecosystem.
using-firebase
xbg-solutions/boilerplate_sveltekit
Comprehensive Firebase development guidance for GCP-hosted applications. Covers Firestore database operations (CRUD, queries, transactions, data modeling), Cloud Functions (1st and 2nd generation, TypeScript and Python, all trigger types), Firebase CLI operations, emulator setup and data persistence, security rules (Firestore and Storage), authentication integration, hosting configuration, and GCP service integration. Use when working with Firebase projects, deploying Cloud Functions, querying Firestore, setting up triggers (Firestore, Auth, Storage, HTTP, Callable, Scheduled, Pub/Sub), managing security rules, configuring hosting rewrites/headers, managing secrets, or integrating with GCP services like BigQuery and Cloud Tasks. Triggers include firebase, firestore, cloud functions, firebase functions, firebase hosting, firebase auth, firebase storage, firebase emulator, firebase deploy, firebase init, firebase rules, callable function, scheduled function, onDocumentCreated, onRequest, onCall, onSchedule.
sqlite-to-fast-sql
aver005/agent-skills
Guides the agent through migrating SQLite and SQL-style Capacitor plugins to @capgo/capacitor-fast-sql. Use when replacing bridge-based SQL plugins, adding encryption, preserving transactions, or moving key-value storage onto Fast SQL. Do not use for non-SQL storage, generic app upgrades, or plugins that already wrap Fast SQL.
csharp-sqlite
woutervanranst/arius7
Use when writing or reviewing C# code that uses SQLite with Microsoft.Data.Sqlite, including connection strings, transactions, WAL, type mapping, parameters, BLOB streaming, encryption, Dapper, user-defined functions, extensions, and provider limitations.
oauth
taidaid/node-skills
Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.
oauth
mnalley95/agent-stuff
Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.
analyzing-ransomware-encryption-mechanisms
oyi77/1ai-skills
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to
env-encryption
heldernoid/agentic-build-templates
AES-256-GCM encryption and PBKDF2 key derivation patterns for secure secret storage in Node.js
expanso-encryption-patterns
expanso-io/skills.expanso.io
Multi-field encryption strategies (payment, PII, temporal)
aws-kms
paulpas/agent-skill-router
"Manages encryption keys with AWS KMS for data protection at rest and
token-endpoint-reviewer
maronnjapan/maronn-openid-provider
Review test cases for Token Endpoint. Covers grant_type=authorization_code, client authentication (client_secret_basic, client_secret_post), token request/response validation, and all requirements per OIDC Core 1.0 Section 3.1.3 and OAuth 2.1.
enabling-cmek-encryption
cockroachdb/copilot-plugin
Enables Customer-Managed Encryption Keys (CMEK) on CockroachDB Cloud clusters with the Advanced plan and Advanced Security Add-on to give organizations control over data-at-rest encryption keys via their cloud provider's KMS. Use when enabling CMEK for compliance, rotating encryption keys, or verifying CMEK configuration.
bitlocker-design
sidneysimas/microsoft-security-skills
Guidance for designing BitLocker drive encryption for Windows endpoints managed via Microsoft Intune — encryption policy, silent enablement, recovery key escrow to Entra ID, TPM, pre-boot authentication trade-offs, and BitLocker To Go for removable media. Covers compliance integration with Conditional Access and recovery workflows. WHEN: BitLocker, disk encryption, Windows encryption policy, BitLocker recovery key, silent BitLocker enablement, Intune disk encryption, TPM 2.0, escrow recovery key, encrypt endpoints, XTS-AES, BitLocker To Go, pre-boot authentication, removable drive encryption. DO NOT USE for general Intune device management (use intune-device-mgmt), Linux/macOS encryption (use intune-device-mgmt FileVault), or Azure disk encryption (use azure-key-vault).
mongez-encryption-recipes
hassanzohdy/mongez-encryption
|
safe-encryption-skill
demerzels-lab/elsamultiskillagent
Encrypt, decrypt, and manage keys with the SAFE CLI — a modern GPG alternative with post-quantum support.
pentest-environmental-mismatch-detection
munalabs/ares
Identify and remediate when claimed vulnerabilities don't exist on the test target due to environment differences (e.g., OAuth in production vs form-based in QA). Includes pivot strategy when endpoints return 404.
encryption-patterns
cavaldos/opencode-kit
Encryption and data security patterns. At-rest encryption, in-transit, field-level encryption, key management, hashing.
memory-encryption
javiergbravo/koog-skills-mcp
Secure agent memory storage with Koog's EncryptedStorage and Aes256GCMEncryptor for AES-256-GCM encryption
encrypted-databases
almasumdev/awesome-mobile-security-agent-skills
Encrypting local databases on mobile with SQLCipher, Room + EncryptedFile, or Realm encryption. Use when persisting structured sensitive data on device.
expanso-encrypt-data
expanso-io/skills.expanso.io
Field-level encryption for sensitive data fields
bitlocker-design
cloudtwyst/security-skills
Guidance for designing BitLocker drive encryption for Windows endpoints managed via Microsoft Intune — encryption policy, key escrow, silent enablement, and recovery. Covers disk encryption policy, TPM, and recovery key management. WHEN: BitLocker, disk encryption, Windows encryption policy, BitLocker recovery key, silent BitLocker enablement, Intune disk encryption, TPM, escrow recovery key, encrypt endpoints.
golang-encryption-conventions
joshsoftware/ai-assistant-skilles
Go encryption and decryption conventions for backend services and BFSI applications \u2014 symmetric and asymmetric encryption, hashing, password storage, MACs, key derivation, secure randomness, and envelope encryption. Use whenever Go code performs cryptographic operations, or when such code is being reviewed or designed. Activate on mentions of encrypt, decrypt, AES, GCM, RSA, ECDSA, hashing, SHA-256, bcrypt, Argon2, HMAC, crypto/rand, key derivation, envelope encryption, field-level encryption, or "how do I encrypt this in Go". These are engineering conventions built on established cryptographic standards (NIST, OWASP) applied to Go's standard library. This skill is self-contained; for BFSI regulatory key-management obligations also consult bfsi-india-core and golang-bfsi-bindings.
managing-certificates-and-encryption
cockroachdb/copilot-plugin
Manages TLS certificate and encryption key lifecycle across all tiers. Self-Hosted covers certificate expiry monitoring, node/CA/client cert rotation, and Kubernetes cert management. Advanced/BYOC covers managed TLS (no action) and CMEK (Customer-Managed Encryption Key) rotation in your KMS. Standard and Basic have fully managed TLS and encryption with no customer action. CMEK is only available on Advanced. Use when monitoring cert health, performing rotation, managing CMEK, or responding to key compromise.
arcium-dev
outsmartchad/arcium-dev-skill
End-to-end Arcium MPC development playbook (Jan 2026). Build privacy-preserving Solana programs using Arcium's Cerberus MPC protocol. Covers encrypted instructions (Arcis), three-instruction callback pattern, encryption/sealing, MXE configuration, offchain circuit storage, ArgBuilder patterns, and integration with Anchor programs. Battle-tested on the Zodiac Liquidity project (16/16 tests passing on devnet + localnet).
privacy-by-design
ignvvcio254/jarvis-254-agent
Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption.
privacy-by-design
yashas-30/nyx
Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption.
vuln-patterns-languages
tomevault-io/skills-registry
Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities. Use when this capability is needed.
cg-cloud
benteigland11/cartograph-plugin
Invoke when the user wants to understand or manage the cloud layer — publishing, governance, adopt/sync/unpublish, account authentication, registry configuration, or whether to use cg vs a self-hosted registry. Covers both conceptual questions ("what does X mean") and operational ones ("how do I log in", "how do I add a registry"). Fires on "how does cloud work", "explain publishing", "what's governance", "open vs protected", "why can't I push this widget", "what does adopt do", "should I use cg or my own registry", "manage my cloud account", "how do I log in to cartograph", "how do I add a registry", "list my registries", "who am I logged in as", "whoami", "how do I connect to a new registry". Does NOT fire on one-off agent MCP calls made as part of a task (e.g. the agent calling checkin_widget with publish=true). Does NOT fire on config/defaults intent — that's cg-config. Does NOT fire on reviewing an incoming proposals queue — that's cg-proposals.
pentest-llm-proxy-exploitation
munalabs/ares
Post-compromise exploitation of multi-tenant LLM proxy platforms. Extract API tokens from web UI state, enumerate available models, make inference calls on target's budget, attempt to extract provider API keys via error reflection and SSRF.