All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,761
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 9,241–9,264 of 29,761 skills
- Antigravity Akf Trust MetadataThe AI native file format. EXIF for AI — stamps every file with trust scores, source provenance, and compliance metadata. Embeds into 20+ formats (DOCX, PDF, images, code). EU AI Act, SOX, HIPAA auditing.Votes: 0GitHub stars: 2
- Antigravity Agents V2 PyBuild container-based Foundry Agents with Azure AI Projects SDK (ImageBasedHostedAgentDefinition). Use when creating hosted agents with custom container images in Azure AI Foundry.Votes: 0GitHub stars: 2
- Antigravity Agentic Actions AuditorAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.Votes: 0GitHub stars: 2
- Antigravity Active Directory AttacksProvide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.Votes: 0GitHub stars: 2
- Antigravity 007Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.Votes: 0GitHub stars: 2
- DockerfileGenerates and validates production-ready multi-stage Dockerfiles and .dockerignore files with BuildKit features, pnpm monorepo support, OCI labels, and security hardening. Use when creating, editing, reviewing, or validating Dockerfiles for Node.js, Python, Go, Java, or Rust.Votes: 0GitHub stars: 2
- Example SkillOne or two sentences naming the SITUATION, INPUTS, and OUTCOME so Claude knows exactly when to fire this skill. This text is always in context — be specific but tight. Example: "Assess an API endpoint against the OWASP API Top 10 and produce a ranked findings table. Use when reviewing a REST/GraphQL API for authz, rate-limiting, or schema-abuse issues."Votes: 0GitHub stars: 8
- Owasp Web Top10Assess a web application against the OWASP Top 10 (2021), producing a per-category finding set with severity and remediation. Use when reviewing or pentesting a web app for the most common, highest-impact web risks. Authorized testing only.Votes: 0GitHub stars: 8
- Access Control TestTest a web app's authorization: IDOR/BOLA, missing function-level access control, privilege escalation (horizontal and vertical), and forced browsing. Use to validate OWASP A01 on an authorized target — the most prevalent web risk.Votes: 0GitHub stars: 8
- Vulnerability PrioritizationRank a set of vulnerabilities by real-world risk using CVSS (severity), EPSS (exploit probability), CISA KEV (known exploited), and asset/exposure context — so remediation effort goes to what actually matters first. Use when a triaged finding list needs a defensible "fix this first" order.Votes: 0GitHub stars: 8
- StrideRun a STRIDE threat model over a system: build/ingest a DFD, then enumerate Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege threats per element and trust-boundary crossing, with mitigations. Use when threat modeling an application, service, or design.Votes: 0GitHub stars: 8
- Risk RankRank a set of enumerated threats or findings by risk (likelihood × impact) and map each to a prioritized mitigation. Use after STRIDE/PASTA enumeration or any time you have a threat/finding list that needs prioritization.Votes: 0GitHub stars: 8
- PastaRun the PASTA (Process for Attack Simulation and Threat Analysis) seven-stage, risk-centric threat model that ties technical threats to business impact. Use for a deeper, attacker-simulation threat model where business risk alignment matters (vs. the faster STRIDE pass).Votes: 0GitHub stars: 8
- Pipeline Integrity ReviewReview a CI/CD pipeline for supply-chain tampering risk — build isolation, runner/agent trust, secret exposure, mutable dependencies, and poisoned-pipeline (PPE) / unauthorized-workflow paths. Use when hardening GitHub Actions, GitLab CI, Jenkins, or similar against build-system compromise.Votes: 0GitHub stars: 8
- Pentest ReportAssemble a complete penetration test / security assessment report from a set of findings and engagement scope. Use at the end of an engagement to produce the deliverable document. Composes individual findings and an executive summary.Votes: 0GitHub stars: 8
- Secure PipelineReview or design the security of a CI/CD pipeline: shift-left scanning gates (SAST/SCA/secret/IaC), software supply-chain integrity (SBOM, pinning, signing/ provenance), and pipeline hardening (least-privilege runners, isolation, protected branches). Use to build security into the SDLC or assess a pipeline's controls.Votes: 0GitHub stars: 8
- Security Design ReviewReview a system or architecture design for security — trust boundaries, control selection, secure-by-design principles, defense-in-depth, and security requirements — and produce prioritized design recommendations. Use when assessing or shaping an architecture/design (not testing a running system).Votes: 0GitHub stars: 8
- Prd Security InjectionRead a PRD, feature brief, or an AI coding assistant's plan/prompt that has no security content, and inject concrete, testable security requirements and an acceptance checklist back into it — before code is written. Use for "vibe coded" or fast/AI-assisted features where security was never mentioned in the prompt, PRD, or design doc, not for reviewing a design that already exists (that's `security-design-review`).Votes: 0GitHub stars: 8
- Secret GuardDetect hardcoded secrets, cloud keys (AWS/GCP/Azure), tokens, .env files, and sensitive config before they're committed or pushed, and verify .gitignore covers the patterns that must never be tracked. Use when the user is about to commit/push, asks "did I leak a secret", "check for hardcoded keys", "is my .gitignore missing anything", or when reviewing any diff that touches config/env files. This is the manual/interactive counterpart to the enforced git hooks this plugin installs — see README...Votes: 0GitHub stars: 8
- Secure ReviewManual, adversarial secure code review focused on exploitable vulnerabilities — OWASP Top 10, injection, authn/authz, business-logic abuse, crypto, SSRF, deserialization, secrets, race conditions. Reviews the current git diff by default, or a path/PR. Supports phase-scoped commands (auth, bizlogic, injection, headers, pii, deadcode, all) and poc/fix/chain/triage follow-ups. Complements `sast-review` (scanner triage) with human-style reasoning over the full change, especially business-logic fl...Votes: 0GitHub stars: 8
- Sca ReviewAnalyze a project's dependencies (software composition analysis): generate/inspect an SBOM, find known-vulnerable and risky components, and prioritize upgrades. Use when reviewing third-party/open-source risk in a codebase or build.Votes: 0GitHub stars: 8
- Adversary EmulationPlan and run an objectives-based adversary-emulation engagement: select a relevant threat actor, build an ATT&CK-mapped emulation plan across the attack lifecycle, execute within rules of engagement, and assess detection/response. Use for full-scope red-team work. Strictly authorized engagements only.Votes: 0GitHub stars: 8
- Exposure DiscoveryDiscover an organization's public exposures — leaked credentials and secrets, exposed services and storage, source-code/config leaks, and breach data — from public sources. Use to find what's already exposed about a target (offense) or to reduce your own exposure (defense). Authorized scope.Votes: 0GitHub stars: 8
- Network PentestRun an authorized network penetration test: host discovery, port/service enumeration, vulnerability identification, exploitation, and lateral movement/pivoting — within an agreed scope and rules of engagement. Use to actively test internal/external network security you're authorized to assess.Votes: 0GitHub stars: 8