All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,705–19,728 of 31,807 skills
- WebsocketsUse when a codebase opens or serves WebSocket connections — an upgrade handler, a socket.io, ws, SignalR, Django Channels, Phoenix or STOMP endpoint, server message handlers, or client-side connection and onmessage code — or when asked about cross-site WebSocket hijacking, origin checks on the handshake, or unvalidated socket messages.Votes: 0GitHub stars: 2
- SecretsUse when reviewing a repository for credentials in source, configuration, environment files, infrastructure manifests or pipeline definitions, for keys and tokens shipped in front-end bundles, mobile builds, source maps, templates or served assets, or for values deleted from the working tree but still present in an earlier commit — or when asked about hardcoded API keys, committed private keys, leaked cloud credentials, or connection strings in code.Votes: 0GitHub stars: 2
- ScanUse when a full security review of a web application codebase is wanted in one step, when asked to "scan", "audit", or "check everything" for vulnerabilities, or when a first pass over an unfamiliar codebase is needed before deciding where to look closer.Votes: 0GitHub stars: 2
- ReportUse when one or more websec detection skills have produced results files and a single consolidated, severity-ranked security report is needed, or when asked to summarise or prioritise security findings across classes.Votes: 0GitHub stars: 2
- Race ConditionsUse when reviewing code that checks a condition and then changes state in a separate step — redeeming coupons or gift cards, decrementing stock, transferring funds, enforcing per-user caps or rate limits, creating an object across several statements, or writing session, cache, and database state one field at a time — or when asked about concurrency bugs, TOCTOU gaps, double-spend, duplicate redemption, or limit overruns.Votes: 0GitHub stars: 2
- Path TraversalUse when request data becomes part of a filesystem path — a filename, document key, template name, download or attachment parameter, archive entry, log or export destination — or when reviewing hand-rolled file serving, and when asked to find path traversal, directory traversal, arbitrary file read or write, local file inclusion, or zip slip issues.Votes: 0GitHub stars: 2
- Os Command InjectionUse when reviewing code that runs external programs — image or document conversion, PDF generation, archive handling, network diagnostics such as ping or nslookup, backup and maintenance scripts, virus scanning, git or cloud CLI wrappers — or when a request value reaches a shell string, or when asked to find command injection, shell injection, or remote code execution through a spawned process.Votes: 0GitHub stars: 2
- OauthUse when reviewing social or delegated sign-in, an authorization callback handler, state or nonce handling, redirect_uri matching, authorization-code exchange, id_token consumption, scope enforcement, PKCE, dynamic client registration, or an identity provider — or when asked about account takeover through a third-party login flow.Votes: 0GitHub stars: 2
- LlmUse when an application embeds a language model — chat endpoints, model SDK calls, prompt templates, retrieval or document context, agent loops — and especially when untrusted text is concatenated into a prompt, when tools or functions exposed to the model perform real actions or run with service credentials, or when model output is rendered into a page, executed, or used to build a query, command, or outbound request.Votes: 0GitHub stars: 2
- JwtUse when a codebase issues or accepts JSON Web Tokens — bearer credentials, session cookies holding a signed token, identity tokens from a login provider, key-set endpoints, or kid, jwk and jku header handling — or when asked about token forgery, algorithm confusion, alg none, weak signing secrets, or missing claim checks.Votes: 0GitHub stars: 2
- Information DisclosureUse when reviewing error handling, debug or diagnostic endpoints, framework debug flags, server banners, directory listing, what a build copies into a served directory, developer comments or credentials in shipped client code, or responses that differ by internal state — or when asked about leaked stack traces, exposed version-control directories, backup files, or verbose errors.Votes: 0GitHub stars: 2
- GraphqlUse when a codebase serves a GraphQL endpoint — schema or SDL files, resolver maps, code-first type definitions, Apollo or similar server setup, a playground, or subscriptions — and especially when introspection or suggestions may be enabled in production, resolvers fetch objects straight from a client-supplied argument, private fields sit on client-facing types, or no depth, complexity, alias, or operation limits are configured.Votes: 0GitHub stars: 2
- DeserializationUse when the application rebuilds objects from bytes it received — serialized session cookies, hidden form state, cached or queued payloads, uploaded files, binary or type-carrying blobs — or when reviewing native object readers and polymorphic type handling, and when asked to find insecure deserialization, object injection, gadget chains, or untrusted pickle, marshal, or binary formatter usage.Votes: 0GitHub stars: 2
- CsrfUse when state-changing endpoints authenticate with session cookies — email or password change, role updates, transfers, deletions — or when anti-forgery middleware is disabled, exempted or unevenly mounted, tokens are compared against a cookie, `Referer` checks or method-override parameters appear, or cookies are set without `SameSite`; also when asked about CSRF or forged requests.Votes: 0GitHub stars: 2
- CryptoUse when a codebase hashes passwords, encrypts or decrypts stored data, generates tokens, salts, nonces or session identifiers, compares a signature or a MAC, derives a key from a passphrase, or sets certificate options on an HTTP client — or when asked about weak or missing encryption, ECB mode, reused IVs, insecure randomness, fast password hashes, timing-unsafe comparison, home-made ciphers, or disabled certificate checks.Votes: 0GitHub stars: 2
- CorsUse when a server sets `Access-Control-Allow-Origin` from the request `Origin`, pairs it with `Access-Control-Allow-Credentials: true`, matches allowed origins with `startsWith`/`endsWith`/`includes` or loose regex, trusts the `null` origin or an `http://` origin, or wildcards authenticated or internal endpoints; also when asked to review cross-origin sharing configuration.Votes: 0GitHub stars: 2
- Business LogicUse when reviewing an application whose rules involve money, quantity, discounts, coupons, limits, quotas, refunds, credits, loyalty points, entitlements, or multi-step flows — or when prices, totals, or eligibility arrive from the client, when one endpoint changes behaviour depending on which parameters are present, or when asked to find logic flaws, workflow bypasses, price manipulation, or abuse-of-function bugs.Votes: 0GitHub stars: 2
- AuthenticationUse when reviewing login, registration, logout, password reset or change, remember-me tokens, multi-factor challenges, or session and cookie configuration — or when asked about brute force, account lockout, credential stuffing, username enumeration, 2FA bypass, weak password hashing, forgeable session tokens, or session fixation.Votes: 0GitHub stars: 2
- AnalysisUse when starting a security review of a web application codebase, when a detection skill reports that architecture.md is missing, or when the codebase has changed enough that the existing architecture summary is stale.Votes: 0GitHub stars: 2
- ForensifyCross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory files across Claude Code, Codex, OpenClaw, and NanoClaw. Produces a structured inventory and narrative briefing with cross-ecosystem risk analysis. Use when the user asks to audit their own setup, check what they have installed, review their agent stack security posture, or understand cross-tool interactions. Use when a user has accumulated skills/plugins/MCP serve...Votes: 0GitHub stars: 205
- Aif Security ChecklistSecurity audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".Votes: 0GitHub stars: 1,145
- Section 11Evidence-based endurance cycling coaching protocol (v11.10). Use when analyzing training data, reviewing sessions, generating pre/post-workout reports, planning workouts, answering training questions, or giving cycling coaching advice. Always fetch athlete JSON data before responding to any training question.Votes: 0GitHub stars: 33
- BlindoracleBlindOracle - Privacy-First Agent InfrastructureVotes: 0GitHub stars: 33
- GomailSend emails via the gomail sender CLI with attachments, templates, and recipient management. Use when sending or testing email delivery from OpenClaw.Votes: 0GitHub stars: 33