Security

Security audits, vulnerabilities, compliance, auth, secrets, and safe automation

skills in category: 29,069
pages available: 1,212

Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.

Open in full browser

Browse security skills

Showing 2,329–2,352 of 29,069 skills

Restaking EigenlayerADetect restaking / AVS bugs — EigenLayer / Symbiotic / Karak operator slashing edge cases, withdrawal-queue gaming, cascading-slashing across AVSs, LST depeg solvency, AVS opt-in granularity. Activate on EigenLayer / Symbiotic / Karak imports, StrategyManager, DelegationManager, EigenPod, AVS registration, slasher contracts.securitygitsecurityVotes: 0GitHub stars: 36
ReentrancyADetect reentrancy vulnerabilities — classic, cross-function, and cross-contract (especially read-only reentrancy). Activate whenever Solidity/Vyper code performs external calls, low-level call/transfer/send, ERC-721 safeTransfer with a receiver hook, or any pattern where control flow leaves the contract before state finalization.securityrustgoVotes: 0GitHub stars: 36
Erc4337 Account AbstractionADetect ERC-4337 account-abstraction bugs — validateUserOp storage-rule violations, paymaster postOp DoS, session-key scope bypasses, signature aggregation issues, EIP-7702 delegation risks. Activate on `validateUserOp`, `validatePaymasterUserOp`, `postOp`, `UserOperation`, `EntryPoint`, `IAccount`, `IPaymaster`, session-key modules, ERC-7579 modules, EIP-7702 authorization payloads.securityVotes: 0GitHub stars: 36
Cross Chain MessagingADetect cross-chain messaging bugs — replay protection gaps, untrusted-remote acceptance, default-config inheritance, validator-set misconfig, force-include vulnerabilities, chainId / domain-separator omissions. Activate on `_lzReceive`, `ccipReceive`, `handle` (Hyperlane), `receiveMessage`, `verifyVAA`, IRouterClient, IMailbox, EndpointV2, OApp/OFT, LayerZero / CCIP / Hyperlane / Wormhole / Axelar / Polyhedra integration code.securityrustgoVotes: 0GitHub stars: 36
CosmwasmADetect bug classes specific to CosmWasm (Rust) contracts — missing info.sender authorization in execute handlers, unbounded map iteration → gas/DoS, reply/submessage reply_id confusion, migrate admin backdoors, addr_validate vs raw string addresses, unchecked info.funds, Uint128 overflow, query reentrancy, and migration/version state. Activate on any `.rs` file with `use cosmwasm_std`, `#[entry_point]`, `ExecuteMsg`, `InstantiateMsg`, `QueryMsg`, `cw_storage_plus`, or `DepsMut`.securityrustapiVotes: 0GitHub stars: 36
Access ControlADetect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation paths. Activate on any function that mutates state, transfers funds, mints tokens, sets admin parameters, upgrades implementations, or pauses/unpauses.securitygoVotes: 0GitHub stars: 36
Skills DirectorySkills Directory 3 slots · $399/mo · one ad per page · sponsors can never buy grades.See placements
Security And HardeningAUse when handling sensitive data, authentication, network communication, or before shipping to the Play Store. Three-tier framework (Always Do, Ask First, Never Do) with Android-specific security patterns, plus data privacy and compliance (GDPR/CCPA, Play Data safety, account deletion).securityjavascriptrustVotes: 0GitHub stars: 2
Addyosmani Security And HardeningAHardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.securityjavascripttypescriptVotes: 0GitHub stars: 2
Addyosmani Code Review And QualityAConducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.securityrustgoVotes: 0GitHub stars: 2
Arxiv 2609 28900 Codetta Multi Agent CollusionAResearch paper: Codetta: High-Capacity, Keyless, and Undetectable Multi-Agent Collusion.securitygosecurityVotes: 0GitHub stars: 3
Arxiv 2609 28693 Progressive Skill Discovery Access ControlAResearch paper: Progressive Skill Discovery as Access Control for Tool-Using LLM Agents: Structural Governance through Role-Scoped Capability Delivery.securitygosecurityVotes: 0GitHub stars: 3
Quantum Auction Summation ReductionsAReductions between quantum auctions and secure summation.securitygoawsVotes: 0GitHub stars: 3
Arxiv 2609 39788 Safety Of Latent Communication In Multi Agent SystemsAResearch paper: Safety of Latent Communication in Multi-Agent Systems. Demonstrates that benign link training in latent communication increases harmful compliance relative to text-based communication. Develops RL-based attack raising harmful-compliance from 27.9 to 76.9, and shows reward adaptation enables repair without updating agents.securitygogitVotes: 0GitHub stars: 3
Ai Code Generation GuardrailsAAutonomous AI code generation safety guardrail register: static AST analysis, forbidden import filters, and zero-day vulnerability checks.securitytypescriptpythonVotes: 0GitHub stars: 6
ReviewAFull QA review pipeline covering security audit (OWASP Top 10), performance analysis, accessibility check (WCAG 2.2 AA), and code quality reviewsecuritytypescriptpythonVotes: 0GitHub stars: 46
Provider Access SubmitAEnd-to-end execution of a scouted third-party provider access campaign. Use when a Provider Access Launch task is ready_to_submit or scouted easy_execute and needs account or app registration, scopes, reviewer assets, Vault credential custody, the canonical connection, and real verification.securitygoshellVotes: 0GitHub stars: 3
Provider Access ScoutADecision-ready scouting record for a user-connected provider access campaign. Use when an assigned Provider Access Launch task needs its easiest official route, minimum scopes, cost, account needs, approval path, implementation consumer, and easy-execute verdict established before submission. NOT for client Local Listings distribution.securitygoapiVotes: 0GitHub stars: 3
Provider Access ChaseAFollow-up sweep for pending third-party provider access campaigns. Use when the recurring 30-minute Provider Access Launch dispatcher wakes, or for a manual status check of due email threads, developer portals, support cases, or review deadlines.securitygoapiVotes: 0GitHub stars: 3
Persistence Repair PatrolAScheduled patrol that finds real persistence and error bugs and fixes them. Use when running the system-error repair patrol automation, or when stuck rows, SLA breaches, the system_errors queue, or app_log ERROR rows need a repair rather than a report.securitypythongoVotes: 0GitHub stars: 3
Mcp Server AuditFSecurity audit of Model Context Protocol (MCP) servers — tool poisoning, prompt injection via tool descriptions and results, unscoped/over-privileged tools, path traversal in file tools, command injection in shell/exec tools, SSRF in fetch tools, secret leakage through tool output, missing approval gates on state-changing actions, confused-deputy and rug-pull tool redefinition, token passthrough, and unsafe stdio/HTTP transport config. Covers auditing both first-party and third-party MCP serv...securitypythonrustVotes: 0GitHub stars: 5,270
Llm RedteamALLM application red-teaming — prompt injection (direct + indirect), jailbreak, system-prompt leak, data exfiltration, guardrail bypass, multi-turn crescendo, cross-lingual + cipher + invisible-unicode token smuggling, excessive agency / tool abuse, insecure output handling. Canonical OWASP LLM Top 10 + ASI01-ASI10 mapping. Use when a target exposes a chat/completions/assistant/copilot endpoint, an AI feature that consumes user text or documents, or any /v1/chat, /api/chat, /mcp surface.securitygosqlVotes: 0GitHub stars: 5,270
Cloud PentestBPost-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers IAM enumeration and privilege escalation (iam:PassRole, CreatePolicyVersion, AssumeRole chains, GCP service-account impersonation, Azure managed-identity abuse), IMDSv1/v2 metadata credential theft, STS token abuse, S3/GCS/Blob bucket takeover and object exfil, Lambda/Cloud Functions env-var secrets, cross-account and cross-service pivoting, and turning leaked ...securityrustgoVotes: 0GitHub stars: 5,270
Angular Upgrade Angular Upgrade Validation GateAValidates each Angular major hop with repository-specific build, test, and lint checks before allowing the next upgrade step.securitytypescriptrustVotes: 0GitHub stars: 4
Angular Security Angular Dependency Vulnerability TriageATriage Angular dependency vulnerabilities by separating real blockers from low-risk advisories.securitytypescriptgoVotes: 0GitHub stars: 4