All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,246
- 1,219
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,361–3,384 of 29,246 skills
- Path TraversalAnalyze path traversal and unsafe file access — use when user input influences file paths, downloads, includes, zip extraction, or static file send APIs (CWE-22 / A01:2021).Votes: 0GitHub stars: 15
- Oauth SecurityAnalyze OAuth/OIDC integration security — use when reviewing redirect URIs, state/nonce, token handling, PKCE, or confused-deputy risks in authorization code flows (CWE-601 / A07:2021 / API2:2023).Votes: 0GitHub stars: 15
- Mcp SecurityReview Model Context Protocol servers/clients and tool bridges for trust, supply-chain, and over-privileged tool exposure before ship.Votes: 0GitHub stars: 15
- Jwt SecurityAnalyze JWT implementation flaws — use when reviewing alg confusion, none algorithm, missing verify, weak secrets, or claim validation gaps (A07:2021 / API2:2023 / auth.jwt rules).Votes: 0GitHub stars: 15
- Graphql SecurityAnalyze GraphQL API security — use when reviewing schemas, resolvers, introspection, batching, authorization per field, or CSRF on cookie-authenticated GraphQL endpoints (API1/API5/API8:2023).Votes: 0GitHub stars: 15
- File Upload SecurityAnalyze unsafe file upload handling — use when reviewing multipart uploads, extension/MIME checks, stored filenames, image processors, or user-supplied archives (CWE-434 / A04:2021).Votes: 0GitHub stars: 15
- Deserialization SecurityAnalyze unsafe deserialization and object-decode sinks — use when reviewing pickle, YAML load, Java ObjectInputStream, PHP unserialize, or untrusted serialized blobs (CWE-502 / A08:2021).Votes: 0GitHub stars: 15
- Configuration SecurityFind security misconfiguration before ship — debug flags, verbose errors, exposed actuators/admin, weak defaults (CWE-489 / CWE-209 / A05:2021).Votes: 0GitHub stars: 15
- Command InjectionAnalyze OS command and shell injection in application code — use when reviewing subprocess, exec, system, shell=True, or user-influenced shell strings (CWE-78 / CWE-77 / A03:2021).Votes: 0GitHub stars: 15
- Cloud SecurityReview cloud and CORS misconfiguration in app code and IaC-adjacent configs — metadata URLs, public buckets, wildcard origins (CWE-918 / CWE-942 / A05:2021 / A10:2021).Votes: 0GitHub stars: 15
- Axguard TriageTriage AXguard scanner output — false-positive filter, severity promotion, and keep/drop gates per vuln class. Use after an audit when the user wants signal, not volume, or runs /axguard-triage.Votes: 0GitHub stars: 15
- Axguard SecurityAnalyze code for security vulnerabilities, investigate findings, verify fixes, and assess security risk before deployment. Use when reviewing security-sensitive changes, before ship/deploy, or when an agent should call AXGuard MCP instead of inventing its own scanner.Votes: 0GitHub stars: 15
- Axguard ReportProduce or polish AXguard Markdown and HTML audit reports from verified evidence. Use with /axguard-report. Prefer regenerating via axguard audit; tighten narrative only with confirmed findings.Votes: 0GitHub stars: 15
- Axguard RemediateApply concrete defensive fixes for confirmed AXguard findings and re-audit. Use with /axguard-fix after triage. Prefer minimal patches, critical first, then verify with axguard audit/scan.Votes: 0GitHub stars: 15
- Axguard PreshipPre-ship security review checklist for the current repository. Use for focused release reviews covering auth, SQL/injection/SSTI, path, SSRF, XSS, uploads, GraphQL, crypto, secrets, cloud, supply chain, debug, and agent risks when a full /axguard-audit is not requested.Votes: 0GitHub stars: 15
- Axguard KnowledgePre-ship vulnerability class encyclopedia for AXguard — root causes, static detection hints, CWE/OWASP maps, and fix guidance for IDOR, auth, XSS, SSRF, SQLi, SSTI, deserialization, path traversal, secrets, cloud, CORS, JWT, upload, GraphQL, supply chain, LLM/agent, debug exposure, and crypto misuse. Load when auditing, triaging, or remediating and a class needs depth. Defensive static review only.Votes: 0GitHub stars: 15
- Axguard CsoChief Security Officer workflow for AXguard — STRIDE-lite threat model, OWASP-oriented prioritization, confidence-gated findings, then audit/triage/fix/report handoff. Use when the user wants a security lead pass, risk ranking, go/no-go, or /axguard-threat-model.Votes: 0GitHub stars: 15
- Axguard AuditFull A-Z pre-ship security audit. Run when the user asks to audit, scan for vulnerabilities, security review before publish, or generate an AXguard report. Covers secrets, auth/IDOR, SQL/SSTI/injection, path traversal, SSRF, XSS, uploads, GraphQL, crypto, CORS/cloud, supply chain, debug exposure, and AI-agent risks; writes Markdown and HTML reports.Votes: 0GitHub stars: 15
- Authorization AnalysisAnalyze authorization and access control — use for IDOR/BOLA, missing ownership checks, privilege escalation, and function-level authZ gaps (CWE-639 / CWE-862 / CWE-863 / A01:2021 / API1:2023 / API5:2023).Votes: 0GitHub stars: 15
- Authentication AnalysisAnalyze authentication mechanisms — use when reviewing login, MFA, password storage, account recovery, API keys, or credential handling failures (CWE-287 / A07:2021 / API2:2023).Votes: 0GitHub stars: 15
- Attack Surface MappingMap application attack surface before deep scanning — use to inventory entry points, trust boundaries, data stores, and high-risk features that prioritize AXGuard skills and /axguard-audit.Votes: 0GitHub stars: 15
- Api SecurityAnalyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).Votes: 0GitHub stars: 15
- Ai Application SecurityPre-ship security review for LLM-powered apps — RAG, chat APIs, output handling, and data exposure — without agent/tool focus.Votes: 0GitHub stars: 15
- Ai Agent SecurityReview AI agents with tools — shell, HTTP, files, browsers — for excessive agency, unsafe exec of model output, and missing human gates (CWE-78 / CWE-94).Votes: 0GitHub stars: 15