All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,293
- 1,304
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 16,321–16,344 of 31,293 skills
- HotspotsMaps security-sensitive code locations in a codebase to focus review effort.Votes: 0GitHub stars: 20
- Header InjectionDetects HTTP response header construction from user input vulnerable to CRLFVotes: 0GitHub stars: 20
- Hardcoded SecretsDetects API keys, passwords, tokens, and credentials embedded directly inVotes: 0GitHub stars: 20
- File UploadDetects file upload handlers that accept executable content or write to web-Votes: 0GitHub stars: 20
- Exceptional ConditionsDetects error handlers that leak stack traces or fail open on exception. UseVotes: 0GitHub stars: 20
- CsrfDetects forms and state-changing endpoints missing CSRF protection. Use whenVotes: 0GitHub stars: 20
- Cryptographic FailuresDetects weak or broken cryptography that lets attackers recover plaintextVotes: 0GitHub stars: 20
- Crypto Library MisuseDetects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive directly (AEAD encrypt/decrypt, ECDSA/DSA sign, raw hash, RSA decrypt). Distinct from cryptographic-failures, which covers application-layer choices like MD5 for passwords; this skil...Votes: 0GitHub stars: 20
- Contract ReviewDeep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.Votes: 0GitHub stars: 20
- Concurrency CorrectnessDetects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory_order_*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/...Votes: 0GitHub stars: 20
- Broken Access ControlDetects missing ownership checks, broken role enforcement, and IDORVotes: 0GitHub stars: 20
- Authentication FailuresDetects weak password storage, flawed JWT validation, sessions survivingVotes: 0GitHub stars: 20
- Third Party Integrator3rd party API integration expert for cogni-template nodes. Use this skill whenever a node needs to connect to an external API, add a 3rd party service, wrap an SDK, handle webhooks, or design an adapter. Routes the decision between MCP, App Capability, and Port/Adapter patterns using a structured decision matrix grounded in the repo's hexagonal architecture. Enforces top-0.1% standards: Zod-first contracts, typed error hierarchies, pinned API versions, graceful degradation, structured observa...Votes: 0GitHub stars: 4
- X Twitter ScraperBuild GitHub Copilot workflows with Xquik X API SDKs, REST endpoints, hosted Apify Actor runs, MCP tools, TweetClaw OpenClaw plugin installs, signed webhooks, tweet search, user lookup, follower exports, media actions, and agent automation.Votes: 0GitHub stars: 3
- CsoChief Security Officer mode. (gstack)Votes: 0GitHub stars: 3
- Arduino Azure Iot Edge IntegrationDesign and implement Arduino integration with Azure IoT Hub and IoT Edge, including secure provisioning, resilient telemetry, command handling, and production guardrails.Votes: 0GitHub stars: 3
- Apple Appstore ReviewerServes as a reviewer of the codebase with instructions on looking for Apple App Store optimizations or rejection reasons.Votes: 0GitHub stars: 3
- Nerds OpensourceOpen source werken bij de overheid: EUPL, publieke code, open-tenzij, licenties, CONTRIBUTING.md, Code of Conduct, secrets management.Votes: 0GitHub stars: 13
- Wifi PentestWiFi security assessment skills: covering wireless network reconnaissance, WPA/WPA2 handshake capture and offline cracking, WPS PIN brute forcing, Evil Twin attacks, wireless sniffing, and deauthentication attacks.Votes: 0GitHub stars: 70
- Web XxeXML External Entity (XXE) injection exploits vulnerable XML parsers to read local files, initiate SSRF attacks, exfiltrate data through out-of-band channels, and cause denial of service.Votes: 0GitHub stars: 70
- Web SsrfServer-Side Request Forgery (SSRF) attacks including basic, blind, and advanced bypass techniques, internal port scanning, cloud metadata extraction (AWS/GCP/Azure), protocol smuggling (gopher://, dict://, file://), and chained RCE exploitation.Votes: 0GitHub stars: 70
- Web SqliSQL injection attacks and defense - covering all major SQLi types including error-based, union-based, blind (boolean/time), double query (error-based), stacked queries, and out-of-band injection.Votes: 0GitHub stars: 70
- Web Auth BypassAuthentication Bypass refers to attackers exploiting design flaws or implementation vulnerabilities in authentication mechanisms to bypass the normal authentication process and gain unauthorized access.Votes: 0GitHub stars: 70
- Web Access ControlBroken Access Control (OWASP Top 10 2025 - A01) attacks and defense — covering core attack surfaces including IDOR (Insecure Direct Object Reference), vertical/horizontal privilege escalation, path traversal, and permission bypass.Votes: 0GitHub stars: 70