Security

Security audits, vulnerabilities, compliance, auth, secrets, and safe automation

skills in category: 29,704
pages available: 1,238

Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.

Open in full browser

Browse security skills

Showing 4,033–4,056 of 29,704 skills

Legal GdprAProduce a GDPR data-processing assessment, an Article 28 controller-to-processor DPA, or a sub-processor disclosure — covering lawful basis, transfer mechanism (SCCs and the transfer impact assessment), DPIA triggers, retention, and the data-subject-rights workflow. Use when the user handles EU or UK personal data, or a customer has sent a DPA to sign. Do NOT use for the product's licence terms (use legal-eula) or for general IP and compliance posture (use sentry-ip-and-compliance). Templates...securitygoexpressVotes: 0GitHub stars: 10
Version Bump Standard SkillAConsistent version bumping and release workflows — dev-to-uat-to-main flow, PR-label-driven semver. Use when setting up or auditing release workflows or onboarding a repo.securitygobashVotes: 0GitHub stars: 6
Security Audit SkillBAudit code and dependencies for vulnerabilities — OWASP Top 10, npm audit/pip-audit, secret detection, XSS/CSRF, security headers, vibeguard masking.securitypythonrustVotes: 0GitHub stars: 6
Authentication Authorization SkillAImplement authentication and authorization — OAuth2/OIDC, JWT, sessions, RBAC/ABAC, NextAuth/Auth.js, Passport.js, password hashing, CSRF.securitygonextjsVotes: 0GitHub stars: 6
Dump CommitAQuick commit all files with a short 1-line message. Saves tokens by skipping detailed diff analysis. Use when the user wants a fast save (e.g. "/dump-commit" or "/dump-commit fix upgrade flow").securitybashgitVotes: 0GitHub stars: 66
06 Security ReviewASkill do Security Reviewer para auditoria de segurança e boas práticas. Use quando precisar revisar código para vulnerabilidades, validar implementação de auth, checar OWASP Top 10, revisar CORS/CSRF/XSS, garantir DRY e clean code, ou qualquer review de segurança. Trigger em: "segurança", "security review", "vulnerabilidade", "OWASP", "XSS", "CSRF", "CORS", "injection", "HttpOnly", "cookie seguro", "DRY", "code review", "boas práticas", "audit", "pentest", "sanitização".securitytypescriptgoVotes: 0GitHub stars: 23
Skills DirectorySkills Directory Pro Download any skill as a ZIP for Claude.ai, Claude Desktop, or .claude/skills.See Pro
Risk Management SpecialistASenior Risk Management specialist for medical device companies implementing ISO 14971 risk management throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis. Use for risk management planning, risk assessments, risk control verification, and risk management file maintenance.securitygotestingVotes: 0GitHub stars: 2
Isms Audit ExpertASenior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.securitygotestingVotes: 0GitHub stars: 2
Information Security Manager Iso27001ASenior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.securitygotestingVotes: 0GitHub stars: 2
Golang SecurityASecurity best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as ...securityjavascriptrustVotes: 0GitHub stars: 8
Guru Select Workflow ModeASelect standard Guru Team intake or a bounded task-free current-checkout route through one AI-owned semantic decision.securityexpressapiVotes: 0GitHub stars: 8
SoeBOrchestrates the Linux Standard Operating Environment domain roles across ansible/configure_rhel.yml (general host baseline) and the purpose-built playbooks (connect_linux.yml, load_balancer_setup.yml, nfs_client_setup.yml, nfs_server_setup.yml, update_rhel.yml) to audit or remediate a RHEL-family host, and summarizes the results. Use when asked to check, audit, or bring a system into compliance with "the SOE" or "the standard operating environment" as a whole, rather than a single domain.securityrustgoVotes: 0GitHub stars: 5
Domain AdAMaintains the ansible/roles/domain_ad Ansible role that joins or leaves an Active Directory domain via realmd/adcli and configures sssd/authselect, as part of the Linux SOE. Use when checking or fixing AD domain membership.securitygitVotes: 0GitHub stars: 5
RafterCEntry point for rafter. Invoke when a sub-skill is unclear, or when the task needs `rafter run` (remote SAST+SCA), `rafter secrets` (local secrets-only), `rafter audit`, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of t...securitypythonrustVotes: 0GitHub stars: 27
Rafter Skill ReviewDREQUIRED before copying any third-party SKILL.md, MCP manifest, Cursor rule, or agent config into this machine or forwarding one to a user. Installing a skill grants Read/Bash/network under your identity — this is `curl | sh` in a different costume. Do not install, load, recommend, or forward any third-party agent asset until this skill has vetted it. Bypassing this turns the agent into a delivery vector.securityrustshellVotes: 0GitHub stars: 27
Rafter Secure DesignAREQUIRED before writing code for any feature touching auth, payments, credentials, tokens, sessions, file upload, user data, untrusted input, deserialization, network endpoints, or data deletion. Scope by that surface, not the task label — a research/experimental/local-only feature with none of it doesn't need this. Invoke it, record answers inline in the design doc or PR description, then write the code. Skipping this is how auth bypass, token leakage, and delete-the-wrong-record bugs ship. ...securityrustgoVotes: 0GitHub stars: 27
ResourcesFSecurity toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.securityrustgoVotes: 0GitHub stars: 27
Rafter -- Security Toolkit for AI Coding AgentsCRafter is a security CLI that protects your codebase from leaked secrets, dangerous commands, and vulnerable dependencies. It works offline with zero config. No API key, no account, no telemetry. This file teaches AI agents how to install and use Rafter. If you are an AI coding agent, follow these instructions.securitypythonrustVotes: 0GitHub stars: 27
SupportATriage a GitHub issue using diagnostics archives and logs. Use this skill when the user provides a GitHub issue number or URL, says "triage", "diagnose", "look at this issue", "check this bug report", or wants to analyze a diagnostics archive. Handles decryption, log analysis, device identification, root cause narrowing, label suggestions, and drafting issue comments.securityrustgoVotes: 0GitHub stars: 222
SigcliCGuide Claude to use SigCLI correctly — check auth, login, get credentials, configure providers, and onboard new websites. Trigger when using sig commands, editing ~/.sig/config.yaml, or needing authenticated API access.securityrustgoVotes: 0GitHub stars: 293
HostingerBOwns Hostinger account work and the transport that carries it — `hostinger` MCP tools, REST under `HOSTINGER_API_TOKEN`, or SSH on the box — with the safety law over irreversible acts: snapshot first, firewall sync, async polling, hPanel-only escapes. Reaches domains, DNS zones, WHOIS; VPS lifecycle, firewalls, SSH keys, recovery; Docker Compose deploy and rollback; shared hosting, WordPress, databases; ecommerce stores; Reach deliverability and segments; the billing catalog `item_id` every p...securitytypescriptpythonVotes: 0GitHub stars: 2
Security AuditAAudit development-environment secrets, supply chains, macOS security controls, and Claude/Codex agent permissions. Use for environment security reviews, secrets checks, dependency audits, or periodic security posture assessments; use specialist skills for app-binary assessments or application-code reviews.securityshelltestingVotes: 0GitHub stars: 12
Audit Mac AppAAudit a macOS .app before running it or granting permissions, especially when the user asks whether a Mac app is safe, suspicious, malware, from an unknown developer, or requests screen recording, accessibility, camera, microphone, input monitoring, or other sensitive permissions.securityrustgoVotes: 0GitHub stars: 12
Code AuditAAudit code for actual defects, including bugs, application security issues, error handling gaps, and correctness problems. Not for readability, architecture, test coverage, performance-only, or broad environment security reviews.securityrustgoVotes: 0GitHub stars: 12