All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,842
- 1,327
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 18,217–18,240 of 31,842 skills
- Sast BusinesslogicDetect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md. Use when asked to find business l...Votes: 0GitHub stars: 1,358
- Sast AnalysisPerform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.Votes: 0GitHub stars: 1,358
- Skill Security AuditAI技能自动化安全审计与合规检查工具，扫描SKILL.md文件、脚本和配置，发现漏洞、错误配置、弱Guardrails和缺失安全控制，输出分级报告和修复建议。 Use when: "安全审计", "检查skill漏洞", "合规检查", "security audit", "vulnerability scan", "技能安全检查", "security review", "代码审计". 覆盖命名元数据、Guardrails、权限边界、密钥处理、输出安全和交叉引用六大审计维度。Cross-references: security-hardening, secure-key-manager, security-drill. Built by UniqueClub 🌐 https://uniqueclub.aiVotes: 0GitHub stars: 28
- Audit PluginAudits a local plugin directory to ensure it perfectly matches the Agent Skills and Claude Plugin Open Standards.Votes: 0GitHub stars: 5
- Audit PluginAudits a local plugin directory to ensure it perfectly matches the Agent Skills and Claude Plugin Open Standards.Votes: 0GitHub stars: 5
- Privesc LinpeasLinux privilege escalation enumeration and attack surface analysis using LinPEAS (Linux Privilege Escalation Awesome Script). Automates post-exploitation discovery of escalation vectors, misconfigurations, and credential exposure on Linux targets. Use when: (1) Enumerating privilege escalation vectors after initial access on a Linux system, (2) Identifying SUID/SGID binaries, sudo misconfigurations, and capability abuses, (3) Hunting for credentials in config files, history, and logs, (4) Det...Votes: 0GitHub stars: 202
- Ot Security AssessmentOperational Technology (OT) security assessment using a two-stage methodology: (1) Identification/Discovery of OT devices and protocols, and (2) Vulnerability Assessment using online sources and Metasploit. Use when: (1) Conducting authorized OT/ICS security assessments, (2) Identifying and enumerating OT protocols (Modbus, S7, IEC 104, DNP3, BACnet, EtherNet/IP), (3) Discovering industrial control devices and PLCs, (4) Assessing OT protocol vulnerabilities and security weaknesses, (5) Perfor...Votes: 0GitHub stars: 202
- Vuln DefectdojoVulnerability management and findings aggregation using DefectDojo. Centralizes security findings from all SecOpsAgentKit scanners (Semgrep, Bandit, ZAP, Trivy, Grype, Gitleaks, Nuclei, Checkov, Horusec) into a unified platform with automatic deduplication, SLA tracking, risk-based prioritization, and compliance reporting. Use when: (1) Aggregating findings from multiple scanners across products and pipelines, (2) Tracking remediation status and SLA compliance against policy thresholds, (3) D...Votes: 0GitHub stars: 202
- Security AuditConduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation guidance.Votes: 0GitHub stars: 3
- Quick TriagePerform a rapid defensive triage on an authorized code area when time is limited. Use to find the most plausible high-impact issues fast, then recommend the next best review target.Votes: 0GitHub stars: 3
- Query ReviewReview an authorized codebase for ORM misuse, N+1 query patterns, authorization-after-fetch bugs, raw SQL risks, cache key collisions, and missing tenant scopes. Use for data-access layers and security-adjacent performance pitfalls.Votes: 0GitHub stars: 3
- Pr Diff ReviewReview an authorized pull request diff for security regressions. Use when changes modify trust boundaries, auth logic, data-access scope, file handling, logging, headers, or secrets.Votes: 0GitHub stars: 3
- Business Logic ReviewReview an authorized application for business-logic vulnerabilities, workflow abuse, approval bypasses, replay conditions, quota circumvention, plan enforcement bugs, and state-transition errors. Use for billing, invites, approvals, refunds, admin actions, and multi-step workflows.Votes: 0GitHub stars: 3
- Auth ReviewPerform a defensive review of authentication and authorization flows in an authorized codebase. Use for login, session, MFA, OAuth, password reset, cookie security, JWT validation, impersonation, privilege checks, and object-level access control.Votes: 0GitHub stars: 3
- Api ReviewReview an authorized API surface for access control, mass assignment, schema validation, rate limiting, SSRF, error leakage, webhook verification, and unsafe defaults. Use for REST, GraphQL, RPC, and webhook handlers.Votes: 0GitHub stars: 3
- Da ReviewUse when you have an existing plan, design, or implemented code that needs adversarial review to find weaknesses, missing edge cases, and unnecessary complexityVotes: 0GitHub stars: 10
- Wp ManagerManage WordPress sites with cookie auth, page CRUD, duplicate detection, and batch cleanup. Requires curl.Votes: 0GitHub stars: 12
- VaultHashiCorp Vault secrets management reference. Seal/unseal architecture, KV/transit/database/PKI secret engines, auth methods (token/userpass/approle/kubernetes), HCL policies with capabilities, dynamic database and AWS credentials, transit encryption as a service, and HA operations with auto-unseal.Votes: 0GitHub stars: 12
- TripwireTripwire host-based IDS reference. Cryptographic key setup, database initialization, integrity checks, policy rules with severity levels, twcfg.txt configuration, and report analysis with twprint.Votes: 0GitHub stars: 12
- TotpTOTP (RFC 6238) time-based one-time password reference. Covers algorithm internals, Python pyotp/Node.js otpauth/Go implementation, otpauth:// URI format, QR code generation, backup codes, rate limiting, security best practices, and database schema.Votes: 0GitHub stars: 12
- TailscaleTailscale mesh VPN reference built on WireGuard. Zero-config secure networking. Covers MagicDNS, exit nodes, subnet routers, Tailscale SSH, Serve/Funnel for exposing services, ACL policies, Headscale self-hosted control plane, and API access.Votes: 0GitHub stars: 12
- Sysadmin HandbookA collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and m the book of secret knowledge, python, awesome.Votes: 0GitHub stars: 12
- SamlSAML 2.0 enterprise SSO standard reference. Covers SP-initiated login flow, SP metadata XML, python3-saml and passport-saml implementations, IdP setup (Okta/Azure AD/Google), assertions, NameID formats, bindings, and SAML vs OIDC comparison.Votes: 0GitHub stars: 12
- PasswordManage passwords with generation, strength checks, and storage. Use when creating credentials, auditing strength, rotating secrets, checking breaches.Votes: 0GitHub stars: 12