All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,393–19,416 of 31,807 skills
- Remediation EngineSecure code fixer — takes findings from other security skills (code-audit, vulnerability-scanner, etc.) and implements the actual code fixes safely, preserving functionality, for any language or stack. Use whenever the user asks to fix, patch, or remediate previously identified vulnerabilities directly in their codebase, not just describe the fix.Votes: 0GitHub stars: 2
- Penetration TestingStructured self-assessment checklist that simulates how a professional security review would probe an application (recon, auth/authorization testing, input testing) for planning and reporting purposes. Use when the user wants a pentest-style checklist or assessment plan for a system they own/operate, or wants to understand what a professional assessment would look for before hiring one or running automated tools.Votes: 0GitHub stars: 2
- Malware AnalysisDefensive triage for suspicious files, scripts, or dependencies the user has already encountered (e.g. a suspicious npm package, an unexpected script in a repo, a file behaving oddly). Use only to identify and explain suspicious behavior in code the user already has, to help them decide whether to remove/report it — never to create, improve, or "test" malicious payloads.Votes: 0GitHub stars: 2
- Frontend SecurityFrontend/client-side security auditor covering React, Next.js, Vue, and general SPA/SSR concerns — server components, server actions, middleware, cookies, CSP headers, hydration, and client-side XSS. Use when reviewing a frontend application's client-side and edge-runtime security specifically, for any project.Votes: 0GitHub stars: 2
- Dependency SecurityDependency and supply-chain vulnerability scanner for npm, pip, composer, gradle, cargo, and other package ecosystems. Use whenever the user wants to check for known CVEs, outdated packages, or supply-chain risk in package.json, requirements.txt, composer.json, build.gradle, Cargo.toml, or similar manifest/lockfiles, for any project.Votes: 0GitHub stars: 2
- Database SecurityDatabase security auditor covering PostgreSQL, MySQL, SQL Server, MongoDB, and Supabase/Firebase-style backends. Use when the user asks about database security, Row Level Security (RLS) policies, exposed database access, ORM-related SQL injection, or backend-as-a-service data access rules for any project.Votes: 0GitHub stars: 2
- Code AuditElite full-codebase security auditor for any language or stack (JavaScript, TypeScript, Python, Java, Kotlin, PHP, Go, Rust, C/C++, Ruby, C#). Trigger this whenever the user asks to review, audit, scan, harden, or "check the security" of any project, before deploying/shipping/launching a site or app, after adding authentication or payment logic, after merging a large feature, or whenever the words "security review", "audit my code", "is this safe to deploy", "vulnerability check" appear. This...Votes: 0GitHub stars: 2
- Cloud SecurityCloud and infrastructure configuration security auditor for Vercel, Netlify, AWS, Azure, Google Cloud, and Supabase/Firebase project settings. Use when reviewing deployment configuration, environment variable management, IAM permissions, storage bucket access, or general cloud misconfiguration — rather than the application code itself.Votes: 0GitHub stars: 2
- Backend SecurityBackend/server-side security auditor for Node.js, Express, NestJS, FastAPI, Django, Flask, Spring, Ruby on Rails, and similar frameworks. Use when reviewing server-side application logic, error handling, logging, file upload handling, or general middleware configuration specifically — separate from database or API-contract concerns.Votes: 0GitHub stars: 2
- Authentication SecurityDeep-dive auditor for authentication and session management — login, signup, password handling, JWT, OAuth, MFA, password reset, and session lifecycle. Use whenever the user is building or reviewing a login system, password logic, token/session handling, an OTP flow, or an OAuth/SSO integration, for any application in any stack.Votes: 0GitHub stars: 2
- Api SecurityFocused API security auditor for REST, GraphQL, and webhook endpoints in any stack. Use when the user is building or reviewing an API layer, mentions rate limiting, API keys, webhooks, CORS, or specifically wants "API security" checked — as opposed to a full-project audit.Votes: 0GitHub stars: 2
- Variant AnalysisDiscover vulnerability variants by identifying similar code patterns across a codebase using CodeQL and Semgrep pattern matching, finding instances where a known bug class may recur.Votes: 0GitHub stars: 40
- Static AnalysisRun CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.Votes: 0GitHub stars: 40
- Semgrep Rule CreatorCreate custom Semgrep rules for detecting project-specific vulnerabilities, enforcing coding standards, and building domain-specific security checks with proper testing and metadata.Votes: 0GitHub stars: 40
- Memory ForensicsMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.Votes: 0GitHub stars: 40
- Medusa SecurityAI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities. Wraps Medusa CLI with SARIF/JSON parsing, structured finding output, OWASP mapping, and remediation guidance.Votes: 0GitHub stars: 40
- K8s Security PoliciesImplement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.Votes: 0GitHub stars: 40
- Insecure DefaultsDetect hardcoded credentials, default passwords, fail-open configurations, insecure default settings, and other security misconfigurations that ship as default behavior in applications.Votes: 0GitHub stars: 40
- Google WorkspaceGoogle Workspace integration skill for Gmail, Calendar, Drive, Docs, and Sheets via Python client libraries and MCP serversVotes: 0GitHub stars: 40
- Gemini Cli SecurityAI-powered code vulnerability analysis and dependency scanning using Gemini CLI security extension patterns. Detects hardcoded secrets, injection attacks, weak cryptography, authentication flaws, and LLM prompt injection. Also scans dependencies against the OSV.dev vulnerability database.Votes: 0GitHub stars: 40
- Fix ReviewVerify fix commits address security findings without introducing new bugs or regressions. Analyzes diffs for anti-patterns like removed validation, weakened access control, reduced error handling, reordered external calls, and changed integer operations. Generates structured FIX_REVIEW_REPORT with finding status tracking.Votes: 0GitHub stars: 40
- Fintech EngineerFintech engineering expertise — payment processing (Stripe, Plaid), PCI DSS compliance, financial data modeling (double-entry bookkeeping), fraud detection patterns, bank-grade security (encryption, tokenization), open banking APIs, cryptocurrency/blockchain integration, regulatory compliance (KYC/AML), and idempotent financial transaction design. Use for payment systems, banking apps, trading platforms, and fintech infrastructure.Votes: 0GitHub stars: 40
- Fiber Routing And Csrf ProtectionFocuses on routing, CSRF protection, context handling, and template usage within the internal handlers directory.Votes: 0GitHub stars: 40
- Differential ReviewPerform security-focused review of code diffs and pull requests, identifying newly introduced vulnerabilities, security regressions, and unsafe patterns in changed code.Votes: 0GitHub stars: 40