All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,067
- 1,212
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 2,305–2,328 of 29,067 skills
- Mobile Security CoderExpert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.Votes: 0GitHub stars: 8
- Backend Security CoderExpert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.Votes: 0GitHub stars: 8
- Api Security Best PracticesImplement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilitiesVotes: 0GitHub stars: 8
- Extracting Credentials From Memory DumpExtract cached credentials, password hashes, Kerberos tickets, and authenticationVotes: 0GitHub stars: 4
- PrCreate a feature branch, commit changes, push, and open a PR to main.Votes: 0GitHub stars: 2
- Audit SecurityScan the codebase for security vulnerabilities. Check OWASP top 10, input validation, auth, crypto, and known BACKLOG security items.Votes: 0GitHub stars: 2
- Secure Coding PracticesAudit code against a 14-domain secure coding checklist derived from OWASP's living sources — the Developer Guide, Cheat Sheet Series, and Proactive Controls — with the original OWASP Secure Coding Practices Quick Reference Guide noted only as the archived historical origin. Covers 14 critical domains including input validation, output encoding, authentication, session management, access control, cryptographic practices, error handling & logging, data protection, communication security, system...Votes: 0GitHub stars: 2
- Owasp Security AuditPerform OWASP-aligned security audits of source code, API handlers, mobile apps, Kubernetes manifests, LLM/agent code, and deployment configuration. Covers the OWASP Top 10 (2025), ASVS 5.0.0 (V1-V17 chapter numbering), MASVS, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the OWASP LLM Top 10 (2026) plus Agentic Applications Top 10 (2026). Use this skill whenever the user asks for a security review, vulnerability audit, threat assessment, compliance check, or hardening guidance — ...Votes: 0GitHub stars: 2
- Verify Libre SecopsInstall the LibreSecOps-Claude-Code plugin pack the way a user does, into a clean Claude Code config and a clean Grok Build home, prove every plugin validates, installs and loads its components, and keep the transcripts. Use when proving a LibreSecOps-Claude-Code PR's Done-when, checking that a plugin change still installs in both CLIs, or reproducing an install bug.Votes: 0GitHub stars: 4
- Review Security IssueGiven a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.Votes: 0GitHub stars: 3
- Identity MapMap a contributor's GitHub handle to their Slack, Discord, Matrix, mailing-list, and social-media identities. Infers each mapping from the sources the session can reach, grades the evidence, and records only what the maintainer confirms, in a project-wide identity file shared by the contributor-growth skills.Votes: 0GitHub stars: 108
- Candidate ScreenSurface details about likely committer and <governance-body> candidates — deliberately more people than would be picked — as an alphabetical list with a short summary, in a verified-private repository. Never a ranking or a readiness verdict.Votes: 0GitHub stars: 108
- CalibrateDerive committer and <governance-body> reference levels from the project's own past nomination decisions on <private-list>, deliberately relaxed below what was elected, and propose them as a numbers-only config diff.Votes: 0GitHub stars: 108
- PaperclipPaperclip is a self-hosted Node.js server and web dashboard that runs a team of AI coding agents (Claude Code, Codex, Gemini CLI, OpenCode, OpenClaw) as a company, with an org chart, goals, tasks, monthly budgets and approval gates. Use when someone wants to install or run Paperclip, hire agents, assign tasks to them, cap agent spend, or script it through the paperclipai CLI or its REST API. Phrases: "set up Paperclip", "run my agents like a company", "too many Claude Code tabs", "give each a...Votes: 0GitHub stars: 155
- Red TeamerAttacks a weft program before it faces the world, hunting every credible hole: an outsider lying through an input, a hallucination the graph trusts, a rogue step with agency, an unguarded path to something that matters. Dispatched by Tangle when the program is high-stakes; reads the weft source, the prompts, and the node code, walks each attack from input to consequence, and reports verified findings with the layer that closes each. Never fixes, never runs the program, never edits.Votes: 0GitHub stars: 1,992
- Red TeamerAttacks a weft program before it faces the world, hunting every credible hole: an outsider lying through an input, a hallucination the graph trusts, a rogue step with agency, an unguarded path to something that matters. Dispatched by Tangle when the program is high-stakes; reads the weft source, the prompts, and the node code, walks each attack from input to consequence, and reports verified findings with the layer that closes each. Never fixes, never runs the program, never edits.Votes: 0GitHub stars: 1,992
- Red TeamerAttacks a weft program before it faces the world, hunting every credible hole: an outsider lying through an input, a hallucination the graph trusts, a rogue step with agency, an unguarded path to something that matters. Dispatched by Tangle when the program is high-stakes; reads the weft source, the prompts, and the node code, walks each attack from input to consequence, and reports verified findings with the layer that closes each. Never fixes, never runs the program, never edits.Votes: 0GitHub stars: 1,992
- Weft SafetyRead when a program talks to a model, messages people, spends money or writes into other systems: the swiss cheese model, the free layers built by default, the layers that cost something and the one-sentence test for when a program is high stakes, the wiring shapes, and the red-teamer pass.Votes: 0GitHub stars: 1,992
- Weft DatabaseRead when a cloud install needs its database: the user has no Postgres for it, or asks which to use. Gets one that scales to zero (Neon), with the user only signing up and pasting one key, and puts its addresses in the fork's secrets. Part of weft-cloud-install.Votes: 0GitHub stars: 1,992
- Nano Add Api Client ConfigurationWire an existing Nano Api Client into this application - adds the App:Apis configuration entry and injects the client into a controller/worker so it can call another Nano service. Use when the user asks to call another Nano service/API from this app, add an API client to a Public API, or compose internal services together in a Nano API, Web, or Console application.Votes: 0GitHub stars: 5
- Nano Add Api Client ConfigurationWire an existing Nano Api Client into this application - adds the App:Apis configuration entry, injects the client into a controller/worker, and nests the target service into this app's local docker-compose (with its own incremental publish step) so it's actually runnable end-to-end. Use when the user asks to call another Nano service/API from this app, add an API client to a Public API, or compose internal services together in a Nano API, Web, or Console application.Votes: 0GitHub stars: 5
- Audit SecurityA project-agnostic, WHOLE-PROJECT security audit - the "subscribe to a security firm" skill. It runs the real scanners (osv-scanner for dependency CVEs, gitleaks for secrets in the working tree AND full git history, semgrep for SAST, trivy for IaC), then performs its OWN LLM-driven whole-repository security review (a full local sweep, NOT a git-diff/PR lens - it replaces Anthropic's diff-scoped /security-review), builds a threat model so findings are ranked by what is actually worth attacking...Votes: 0GitHub stars: 2
- Restaking EigenlayerDetect restaking / AVS bugs — EigenLayer / Symbiotic / Karak operator slashing edge cases, withdrawal-queue gaming, cascading-slashing across AVSs, LST depeg solvency, AVS opt-in granularity. Activate on EigenLayer / Symbiotic / Karak imports, StrategyManager, DelegationManager, EigenPod, AVS registration, slasher contracts.Votes: 0GitHub stars: 36
- ReentrancyDetect reentrancy vulnerabilities — classic, cross-function, and cross-contract (especially read-only reentrancy). Activate whenever Solidity/Vyper code performs external calls, low-level call/transfer/send, ERC-721 safeTransfer with a receiver hook, or any pattern where control flow leaves the contract before state finalization.Votes: 0GitHub stars: 36