All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,679
- 1,237
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,721–3,744 of 29,679 skills
- Coercing Authentication With Coercer PetitpotamTrigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.Votes: 0GitHub stars: 9
- Building Ransomware Playbook With Cisa Framework'Builds a structured ransomware incident response playbook aligned withVotes: 0GitHub stars: 9
- Building Identity Governance Lifecycle Process'Builds comprehensive identity governance and lifecycle management processesVotes: 0GitHub stars: 9
- Auditing Kubernetes Rbac Privilege EscalationFind over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.Votes: 0GitHub stars: 9
- Auditing Entra Id With AadinternalsRun Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.Votes: 0GitHub stars: 9
- Attacking Oauth With Device Code PhishingRun OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.Votes: 0GitHub stars: 9
- Attacking Entra Id With RoadtoolsEnumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.Votes: 0GitHub stars: 9
- Analyzing Ransomware Leak Site IntelligenceMonitor and analyze ransomware group data leak sites (DLS) to track victimVotes: 0GitHub stars: 9
- Abusing Shadow Credentials For PrivescTake over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.Votes: 0GitHub stars: 9
- Abusing Dpapi For Credential AccessExtract DPAPI-protected secrets such as credentials and browser data offline and online.Votes: 0GitHub stars: 9
- Well Architected6-pillar architecture review framework. Adapted from AWS Well-Architected for use by great_cto's architect agent on every non-nano ARCH document. Forces explicit answers across operational excellence, security, reliability, performance, cost, and sustainability — not just feature design.Votes: 0GitHub stars: 36
- Vibesec SkillThis skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.Votes: 0GitHub stars: 36
- Varlock Claude SkillSecure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials", "sensitive", "Varlock".Votes: 0GitHub stars: 36
- Api Security PatternsDesigns and documents authentication, authorization, and security patterns for any API. Use whenever the user asks about OAuth 2.0, JWT, API keys, RBAC, ABAC, rate limiting for security, CORS, HTTPS enforcement, input validation, OWASP API security, token refresh flows, multi-tenancy isolation, or any question starting with "how do I secure my API", "what auth should I use", "implement OAuth for", "design permissions for", or "API security checklist". Triggers on any mention of: JWT, OAuth, A...Votes: 0GitHub stars: 36
- Spring Boot EngineerGenerates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data JPA repositories, and configures reactive WebFlux endpoints. Use when building Spring Boot 3.x applications, microservices, or reactive Java applications; invoke for Spring Data JPA, Spring Security 6, WebFlux, Spring Cloud integration, Java REST API design, or Microservices Java architecture.Votes: 0GitHub stars: 36
- Skeptical TriageReusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of ~4 extra LLM turns.Votes: 0GitHub stars: 36
- Shellward Security GuideOpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installationVotes: 0GitHub stars: 36
- Security ReviewerIdentifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.Votes: 0GitHub stars: 36
- Redis SecurityRedis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.Votes: 0GitHub stars: 36
- Governance Readiness AssessorAssess AAP platform governance readiness -- full 7-domain audit or scoped to specific domains. Use when: - Full assessment: "Is my AAP ready for production?", "Audit my platform governance" - Scoped assessment: "Assess my credentials setup", "Check my RBAC", "How are my notifications configured?" - "What should I fix before executing jobs?" - "Assess my AAP configuration" - Any question about a specific governance domain (credentials, RBAC, workflows, notifications, EEs, instance groups, aud...Votes: 0GitHub stars: 36
- Governance ExecutorOrchestrates governed job execution with risk analysis, check mode, approval, and rollback. Use when: - "Execute job template X", "Deploy to production", "Push to prod", "Launch job template" - Any execution request targeting sensitive environments - Job template launches requiring governance controls NOT for platform assessment (use governance-assessor) or troubleshooting (use forensic-troubleshooter).Votes: 0GitHub stars: 36
- Governance AssessorOrchestrates AAP governance readiness assessments -- full platform audit or scoped to specific domains. Assesses 7 governance domains + 1 bonus: 1. Workflow Governance (approval gates, workflow coverage) 2. Notification Coverage (failure alerting, notification bindings) 3. Access Control / RBAC (teams, roles, least privilege) 4. Credential Security (separation of duties, credential hygiene) 5. Execution Environments (custom EEs, image provenance) 6. Workload Isolation (instance groups, capac...Votes: 0GitHub stars: 36
- Container Cve ValidatorValidate a CVE against a Red Hat container image using official SBOM attestations, Red Hat VEX data, and CVE metadata from MITRE/OSV.dev.Votes: 0GitHub stars: 36
- Public Google DriveCreate public Google Docs or Google Sheet files without requiring OAuth. Use this skill to create and edit Google Docs and Sheets, no Google sign-in required. Documents are viewable at shareable links. Registration is automatic on first use.Votes: 0GitHub stars: 36