1,051 free skills
Security skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
1,051 free skills
Skills for security — code auditing, penetration testing, secrets management, encryption, and dependency vulnerability scanning.
Sourced from real, public repositories — synced daily, never invented.
15 tools across six categories
13 of them never send your data anywhere
Free · No signup · No trial clock
SEE THE DIRECTORY
supabase-report
yoanbernabeu/supabase-pentest-skills
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
analyzing-kubernetes-audit-logs
mukul975/anthropic-cybersecurity-skills
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod,
testing-api-authentication-weaknesses
mukul975/anthropic-cybersecurity-skills
Tests API authentication mechanisms for weaknesses including broken
safe-action-better-auth
next-safe-action/skills
Use when adding authentication or authorization to safe actions with Better Auth -- covers betterAuth() middleware setup, typed session context (BetterAuthContext), custom authorize callbacks (AuthorizeFn), unauthorized() handling, nextCookies() configuration, and Next.js authInterrupts setup
vulnerability-triage-brocards
trailofbits/skills
>-
supabase-audit-auth-users
yoanbernabeu/supabase-pentest-skills
Test for user enumeration vulnerabilities through various authentication endpoints.
owasp-mobile-security-checker
harishwarrior/flutter-claude-skills
Use when performing security audits, vulnerability assessments, or compliance checks on Flutter or mobile applications. Covers OWASP Mobile Top 10 (2024) — hardcoded secrets (M1), insecure storage (M9), weak cryptography (M10), network issues (M5), and 6 more categories with automated scanners and remediation guidance.
analyzing-sbom-for-supply-chain-vulnerabilities
mukul975/anthropic-cybersecurity-skills
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON
security-headers-configuration
secondsky/claude-skills
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.
frontend-security
schalkneethling/webdev-agent-skills
Audit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependencies. Target frameworks include web platform (vanilla HTML/CSS/JS), React, Astro, Twig templates, Node.js, and Bun. Based on OWASP security guidelines.
owasp-llm-top10
mastepanoski/claude-skills
Security audit for LLM and GenAI applications using OWASP Top 10 for LLM Apps 2025. Assess prompt injection, data leakage, supply chain, and 7 more critical vulnerabilities.
expo-react-native-coder
pproenca/dot-skills
Comprehensive Expo React Native feature development guide. This skill should be used when building mobile app screens, navigation, data fetching, authentication, deep linking, or native UX patterns with Expo. Triggers on tasks involving Expo Router, React Native components, mobile forms, or app configuration.
supabase-report-compare
yoanbernabeu/supabase-pentest-skills
Compare two security audit reports to track remediation progress and identify new vulnerabilities.
Bankr Agent - Error Handling
bankrbot/claude-plugins
This skill should be used when encountering authentication errors, API key errors, 401 errors, "invalid API key", "BANKR_API_KEY not set", job failures, or any Bankr API errors. Provides setup instructions and troubleshooting guidance for resolving Bankr configuration issues.
gmail-automation
sickn33/agentic-awesome-skills
Lightweight Gmail integration with standalone OAuth authentication. No MCP server required.
oauth-implementation
secondsky/claude-skills
OAuth 2.0 and OpenID Connect authentication with secure flows. Use for third-party integrations, SSO systems, token-based API access, or encountering authorization code flow, PKCE, token refresh, scope management errors.
security
cognitedata/dune-skills
MUST be used whenever fixing security issues in a Dune app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report them. Do NOT skip this when the user asks for a security fix, security hardening, or vulnerability remediation — run every step in order. Triggers: security, security fix, security hardening, vulnerability, XSS, injection, credentials, secrets, auth, authentication, authorization, token, sensitive data, input validation, CORS, CSP, dependency audit.
devsecops-expert
martinholovsky/claude-skills-generator
Expert DevSecOps engineer specializing in secure CI/CD pipelines, shift-left security, security automation, and compliance as code. Use when implementing security gates, container security, infrastructure scanning, secrets management, or building secure supply chains.
setup-dune-auth
cognitedata/dune-skills
MUST be used when migrating an existing React app to Dune, or when no Dune auth is wired up. Detects classic vs Apps API flow from `app.json` `infra` field, installs the right packages, and wires up the entry file. No-op when a valid auth setup is already in place. Triggers: migrate to Dune, add Dune auth, DuneAuthProvider, AppSdkAuthProvider, connectToHostApp, useDune, Dune setup, setup auth, missing auth provider, CDF authentication, Fusion iframe auth.
trailmark-variant-neighborhood
trailofbits/skills
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
performing-web-application-vulnerability-triage
mukul975/anthropic-cybersecurity-skills
Triages web application vulnerability findings from DAST/SAST scanners
ln-625-dependencies-auditor
levnikolaevich/claude-code-skills
Checks outdated packages, unused deps, reinvented wheels, CVE/CVSS vulnerability scan. Use when auditing dependencies.
better-auth-authentication
bobmatnyc/claude-mpm-skills
Better Auth authentication flows for TypeScript apps. Use when enabling email/password auth, configuring social providers, or implementing sign-up, sign-in, and verification flows.
webflow-code-component:deploy-guide
webflow/webflow-skills
Step-by-step guide for deploying Webflow Code Components to a workspace. Covers authentication, pre-flight checks, deployment execution, and verification.
authentication-setup
akillness/jeo-skills
>-
nuxt-studio
secondsky/claude-skills
This skill should be used when the user asks to "set up Nuxt Studio", "configure Studio OAuth", "deploy Studio to Cloudflare", "add visual editor to Nuxt", "configure studio.domain.com subdomain", "Studio authentication", "Nuxt CMS", or mentions visual content editing, Nuxt Studio module, TipTap editor, Monaco editor, or content management for Nuxt websites.
oauth2-oidc-implementer
patricio0312rev/skills
Implements OAuth 2.0 and OpenID Connect authentication flows with secure token handling and provider integration. Use when users request "OAuth setup", "OIDC implementation", "social login", "SSO integration", or "authentication flow".
supabase-auth
nice-wolf-studio/claude-code-supabase-skills
Manage authentication and user operations in Supabase. Use for sign up, sign in, sign out, password resets, and user management.
supabase-best-practices
pedrobarretocw/supabase-best-practices
Supabase security and performance guidelines with Clerk authentication integration. Contains 40+ rules across 10 categories covering RLS policies, Clerk setup, database security, and more.
auth-security-reviewer
patricio0312rev/skills
Reviews authentication and authorization implementation for session management, CSRF, cookie security, and auth flow vulnerabilities with findings, severity assessment, and fix recommendations. Use for "auth review", "session security", "CSRF protection", or "authentication audit".
kernel-auth
kernel/skills
Use Kernel managed auth after choosing a browser path that genuinely requires an authenticated website UI or authenticated browser behavior. Prefer a dedicated API, CLI, MCP server, or authoritative local records for operations they support; a URL alone does not require browser auth. Reuse or create auth connections, complete hosted login without abandoning the task, launch profile-backed browsers with telemetry, and handle reauthentication safely.
analyzing-ransomware-network-indicators
mukul975/anthropic-cybersecurity-skills
Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
code-reviewer
nodnarbnitram/claude-code-extensions
Review code for best practices, security issues, and potential bugs. Use when reviewing code changes, checking PRs, analyzing code quality, or performing security audits.
analyzing-ransomware-encryption-mechanisms
mukul975/anthropic-cybersecurity-skills
Analyzes encryption algorithms, key management, and file encryption
pulumi-typescript
dirien/claude-skills
Scaffolds Pulumi TypeScript infrastructure-as-code projects, writes IaC code with proper resource configuration, manages Pulumi ESC environments for centralized secrets and configuration, configures OIDC authentication for cloud providers, and builds multi-language component resources. Use when the user asks to create Pulumi TypeScript projects, write Pulumi infrastructure code, set up ESC environments, configure OIDC for Pulumi, implement infrastructure automation with Node.js/TypeScript, create reusable Pulumi components, or work with stack references. Also use when the user mentions Pulumi with TypeScript, AWS/Azure/GCP infrastructure in TypeScript, or PulumiPlugin.yaml for multi-language components.
bypassing-authentication-with-forced-browsing
mukul975/anthropic-cybersecurity-skills
Discovering and accessing unprotected pages, APIs, and administrative
configuring-dbt-mcp-server
dbt-labs/dbt-agent-skills
Generates MCP server configuration JSON, resolves authentication setup, and validates server connectivity for dbt. Use when setting up, configuring, or troubleshooting the dbt MCP server for AI tools like Claude Desktop, Claude Code, Cursor, or VS Code.
conducting-external-reconnaissance-with-osint
mukul975/anthropic-cybersecurity-skills
Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
flutter-dio
dhruvanbhalara/skills
Implement HTTP networking with Dio including interceptors, retry logic, and response caching. Use when building API clients, configuring authentication headers, or handling network errors gracefully.
112-java-maven-plugins
jabrena/plinth
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml; Configure Maven quality plugins in pom.xml; Add Maven build lifecycle plugins for Java verification; Review Maven plugin versions and executions. Part of Plinth Toolkit
analyzing-office365-audit-logs-for-compromise
mukul975/anthropic-cybersecurity-skills
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect
dependency-management-deps-audit
sickn33/agentic-awesome-skills
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
testing-websocket-api-security
mukul975/anthropic-cybersecurity-skills
Tests WebSocket API implementations for missing upgrade-handshake authentication,
auditing-aws-s3-bucket-permissions
mukul975/anthropic-cybersecurity-skills
Systematically audit AWS S3 bucket permissions to identify publicly
audio-voice-recovery
pproenca/dot-skills
Audio forensics and voice recovery guidelines for CSI-level audio analysis. This skill should be used when recovering voice from low-quality or low-volume audio, enhancing degraded recordings, performing forensic audio analysis, or transcribing difficult audio. Triggers on tasks involving audio enhancement, noise reduction, voice isolation, forensic authentication, or audio transcription.
keycloak-administration
dauquangthanh/hanoi-rainbow
Provides comprehensive KeyCloak administration guidance including realm management, user/group administration, client configuration, authentication flows, identity brokering, authorization policies, security hardening, and troubleshooting. Covers SSO configuration, SAML/OIDC setup, role-based access control (RBAC), user federation (LDAP/AD), social login integration, multi-factor authentication (MFA), and high availability deployments. Use when configuring KeyCloak, setting up SSO, managing realms and clients, troubleshooting authentication issues, implementing RBAC, or when users mention "KeyCloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "authentication flow", "user federation", "realm configuration", or "access management".
talos-os-expert
martinholovsky/claude-skills-generator
Elite Talos Linux expert specializing in immutable Kubernetes OS, secure cluster deployment, machine configurations, talosctl CLI operations, upgrades, and production-grade security hardening. Expert in Talos 1.6+, secure boot, disk encryption, and zero-trust infrastructure. Use when deploying Talos clusters, configuring machine configs, troubleshooting node issues, or implementing security best practices.
adding-auth
spencerpauly/awesome-cursor-skills
Add authentication to a web application using NextAuth.js (Auth.js), including OAuth providers, session management, and protected routes.
owasp-audit
briiirussell/cybersecurity-skills
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, SSRF. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' or wants to check their codebase for common security weaknesses.
metabase-embedding-sso-implementation
metabase/agent-skills
Implements JWT SSO authentication for Metabase embedding in a project. Supports all embedding types that use SSO — Modular embedding (embed.js web components), Modular embedding SDK (@metabase/embedding-sdk-react), and Full app embedding (iframe-based). Creates the JWT signing endpoint, configures the frontend auth layer, and sets up group mappings. Use when the user wants to add SSO/JWT auth to their Metabase embedding, implement user identity for embedded analytics, set up JWT authentication for Metabase, or connect their app's authentication to Metabase embedding.
flutter-security
dhruvanbhalara/skills
Enforce architect-level security standards including AES-256-GCM encryption, secure storage, biometric gates, and memory safety. Use when handling sensitive data, credentials, clipboard content, or API communication security.
flutter-firebase
dhruvanbhalara/skills
Integrate Firebase services including Authentication, Firestore, Cloud Messaging, Crashlytics, and Analytics. Use when adding backend capabilities, push notifications, crash reporting, or remote configuration to a Flutter app.
smart-contract-security
pluginagentmarketplace/custom-plugin-blockchain
Master smart contract security with auditing, vulnerability detection, and incident response
api-security-review
bobmatnyc/claude-mpm-skills
API security checklist for reviewing endpoints before deployment. Use when creating or modifying API routes to ensure proper authentication, authorization, and input validation.
page-layout-builder
patricio0312rev/skills
Generates complete page layouts and shells for common patterns (dashboard, authentication, settings, CRUD pages) with consistent navigation, layout components, routing structure, and state management placeholders. Use when building "new page", "dashboard layout", "auth pages", or "admin panel structure".
Newt Blueprint Generator
rknall/claude-skills
Generate and validate Pangolin Newt blueprint configurations in YAML or Docker Labels format. Use when creating Pangolin resource configurations, proxy resources, client resources, authentication settings, or Docker Compose blueprints.
websocket
martinholovsky/claude-skills-generator
Real-time bidirectional communication with security focus on CSWSH prevention, authentication, and message validation
better-auth-best-practices
pedronauck/skills
Skill for integrating Better Auth - the comprehensive TypeScript authentication framework.
security-audit
donchitos/claude-code-game-studios
Audit the game for security vulnerabilities: save tampering, cheat vectors, network exploits, data exposure, and input validation gaps. Produces a prioritised security report with remediation guidance. Run before any public release or multiplayer launch.
GitLab Stack Validator
rknall/claude-skills
Validates GitLab stack projects before deployment, ensuring proper architecture patterns, directory structure, secrets management, .env configuration, and Docker best practices. Use when users ask to validate a stack, check stack configuration, verify stack architecture, audit stack setup, or ensure stack deployment readiness.