All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,704
- 1,238
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,865–3,888 of 29,704 skills
- Axguard PreshipPre-ship security review checklist for the current repository. Use for focused release reviews covering auth, SQL/injection/SSTI, path, SSRF, XSS, uploads, GraphQL, crypto, secrets, cloud, supply chain, debug, and agent risks when a full /axguard-audit is not requested.Votes: 0GitHub stars: 15
- Axguard KnowledgePre-ship vulnerability class encyclopedia for AXguard — root causes, static detection hints, CWE/OWASP maps, and fix guidance for IDOR, auth, XSS, SSRF, SQLi, SSTI, deserialization, path traversal, secrets, cloud, CORS, JWT, upload, GraphQL, supply chain, LLM/agent, debug exposure, and crypto misuse. Load when auditing, triaging, or remediating and a class needs depth. Defensive static review only.Votes: 0GitHub stars: 15
- Axguard CsoChief Security Officer workflow for AXguard — STRIDE-lite threat model, OWASP-oriented prioritization, confidence-gated findings, then audit/triage/fix/report handoff. Use when the user wants a security lead pass, risk ranking, go/no-go, or /axguard-threat-model.Votes: 0GitHub stars: 15
- Axguard AuditFull A-Z pre-ship security audit. Run when the user asks to audit, scan for vulnerabilities, security review before publish, or generate an AXguard report. Covers secrets, auth/IDOR, SQL/SSTI/injection, path traversal, SSRF, XSS, uploads, GraphQL, crypto, CORS/cloud, supply chain, debug exposure, and AI-agent risks; writes Markdown and HTML reports.Votes: 0GitHub stars: 15
- Authorization AnalysisAnalyze authorization and access control — use for IDOR/BOLA, missing ownership checks, privilege escalation, and function-level authZ gaps (CWE-639 / CWE-862 / CWE-863 / A01:2021 / API1:2023 / API5:2023).Votes: 0GitHub stars: 15
- Authentication AnalysisAnalyze authentication mechanisms — use when reviewing login, MFA, password storage, account recovery, API keys, or credential handling failures (CWE-287 / A07:2021 / API2:2023).Votes: 0GitHub stars: 15
- Attack Surface MappingMap application attack surface before deep scanning — use to inventory entry points, trust boundaries, data stores, and high-risk features that prioritize AXGuard skills and /axguard-audit.Votes: 0GitHub stars: 15
- Api SecurityAnalyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).Votes: 0GitHub stars: 15
- Ai Application SecurityPre-ship security review for LLM-powered apps — RAG, chat APIs, output handling, and data exposure — without agent/tool focus.Votes: 0GitHub stars: 15
- Ai Agent SecurityReview AI agents with tools — shell, HTTP, files, browsers — for excessive agency, unsafe exec of model output, and missing human gates (CWE-78 / CWE-94).Votes: 0GitHub stars: 15
- 21 Threat IntelligenceCyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reportingVotes: 0GitHub stars: 430
- Xss Html InjectionThis skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection...Votes: 0GitHub stars: 277
- Athena ReviewPACE 实现后一次独立多维 review。进入 review stage 时触发；优先本端原生入口，fallback 为一个只读 reviewer。Votes: 0GitHub stars: 188
- Setup SnowflakeFirst-time Snowflake setup wizard for the NATIVE ConnectionManager path (the connection the analyst actually queries through, with auto-logged provenance). Prompts for every connection field, stores the approved credential in .env, registers the dataset, and VERIFIES the session is live on the warehouse before declaring success. Use when the user says "set up snowflake", "connect to snowflake", "configure the warehouse", or is routed here from /connect-data. For day-to-day remote querying aft...Votes: 0GitHub stars: 304
- Setup NotionConnect Claude Code to Notion's official hosted MCP, complete OAuth, verify the intended workspace with a read, and stop before any write. Use when the user asks to connect Notion, set up Notion, export to Notion, or diagnose an unavailable Notion connection.Votes: 0GitHub stars: 304
- TprmExpert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mention...Votes: 0GitHub stars: 935
- Sox ItgcExpert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weaknes...Votes: 0GitHub stars: 935
- Cyber EssentialsExpert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update ru...Votes: 0GitHub stars: 935
- Firebase Security Rules AuditorAudits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.Votes: 0GitHub stars: 16
- LienfiResearch and buy tokenized US tax lien certificates on LienFi (Base, USDC) — screen the live book by NET yield with no credential, then, once your operator has authorized your wallet in a browser, register and run the prepare → sign → confirm → submit → report purchase loop from the wallet you control. LienFi signs only the price; every transaction leaves your wallet.Votes: 0GitHub stars: 1,203
- Secrets VaultUse whenever an API key, token, password, connection string, or any other secret needs to be stored, rotated, retrieved, or used — so the value never enters the chat transcript. Triggers on "vault this", "save this key/token/password", "rotate the <x> key", "where's the <x> secret", "put this in the vault", or any time a credential is about to be handled.Votes: 0GitHub stars: 2
- Cw HandoffUse when writing a Codewhale takeover prompt, continuation note, or end-of-session summary for another agent or a later session: a paste-ready handoff grounded in live state, with done/suspected/blocked kept separate.Votes: 0GitHub stars: 17
- MoneyBank accounts, balances, and transactions via Plaid. Use when: bank, balance, transactions, spending, accounts, or plaid.Votes: 0GitHub stars: 17
- GmailSearch, read, draft, and send Gmail when the user asks to work with their inbox or email.Votes: 0GitHub stars: 17