Security & Compliance Skills
902 curated security and compliance skills for AI coding agents. Access control, vulnerability scanning, compliance audit - all license-verified.
Reverse Engineering Malware With Ghidra
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.
by mukul975/Anthropic-Cybersecurity-Skills / skills/reverse-engineering-malware-with-ghidra
Reverse Engineering Ransomware Encryption Routine
Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/reverse-engineering-ransomware-encryption-routine
Reverse Engineering Rust Malware
Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated strings, crate dependency extraction, and Rust-specific control flow analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/reverse-engineering-rust-malware
Risk Assessment
Identify, assess, and mitigate operational risks. Trigger with "what are the risks", "risk assessment", "risk register", "what could go wrong", or when the user is evaluating risks associated with a project, vendor, process, or decision.
by anthropics/knowledge-work-plugins / operations/skills/risk-assessment
Risk Management Specialist
Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis. Use when user mentions risk management, ISO 14971, risk analysis, FMEA, fault tree analysis, hazard identification, risk control, risk matrix, benefit-risk analysis, residual risk, risk acceptability, or post-market risk.
by alirezarezvani/claude-skills / ra-qm-team/skills/risk-management-specialist
Safe Encryption
Encrypt, decrypt, and manage keys with the SAFE CLI — a modern GPG alternative with post-quantum support.
by grittygrease/safe-encryption-skill
SAST Configuration
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
by wshobson/agents / plugins/security-scanning/skills/sast-configuration
Sast Sca Security Analyzer
Use when: performing SAST (Static Application Security Testing), SCA (Software Composition Analysis), scanning source code or binaries for security flaws, auditing third-party dependency vulnerabilities, checking policy compliance, generating structured security reports, identifying CWE-mapped flaws with file/line precision, reviewing open-source license risk, or producing CI/CD-gate security findings.
by github/awesome-copilot / agents/sast-sca-security-analyzer.agent.md
Scanning Container Images With Grype
Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.
by mukul975/Anthropic-Cybersecurity-Skills / skills/scanning-container-images-with-grype
Scanning Docker Images With Trivy
Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati
by mukul975/Anthropic-Cybersecurity-Skills / skills/scanning-docker-images-with-trivy
Scanning Infrastructure With Nessus
Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.
by mukul975/Anthropic-Cybersecurity-Skills / skills/scanning-infrastructure-with-nessus
Scanning Kubernetes Manifests With Kubesec
Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.
by mukul975/Anthropic-Cybersecurity-Skills / skills/scanning-kubernetes-manifests-with-kubesec
Scanning Network With Nmap Advanced
Performs advanced network reconnaissance using Nmap's scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate services, detect vulnerabilities, and fingerprint operating systems across authorized target networks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/scanning-network-with-nmap-advanced
Secret Scanning
Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.
by github/awesome-copilot / skills/secret-scanning
Secret Scanning Skill
Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.
by github/copilot-plugins / plugins/advanced-security/skills/secret-scanning
Secrets Management
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
by wshobson/agents / plugins/cicd-automation/skills/secrets-management
Secure Code Guardian
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
by Jeffallan/claude-skills / skills/secure-code-guardian
Securing API Gateway With AWS Waf
Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-api-gateway-with-aws-waf
Securing AWS Iam Permissions
This skill guides practitioners through hardening AWS Identity and Access Management configurations to enforce least privilege access across cloud accounts. It covers IAM policy scoping, permission boundaries, Access Analyzer integration, and credential rotation strategies to reduce the blast radius of compromised identities.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-aws-iam-permissions
Securing AWS Lambda Execution Roles
Securing AWS Lambda execution roles by implementing least-privilege IAM policies, applying permission boundaries, restricting resource-based policies, using IAM Access Analyzer to validate permissions, and enforcing role scoping through SCPs.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-aws-lambda-execution-roles
Securing Azure With Microsoft Defender
This skill instructs security practitioners on deploying Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments. It covers enabling Defender plans for servers, containers, storage, and databases, configuring security recommendations, managing Secure Score, and integrating with the unified Defender portal for centralized threat management.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-azure-with-microsoft-defender
Securing Container Registry Images
Securing container registry images by implementing vulnerability scanning with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring registry access controls, and building CI/CD pipelines that prevent deploying unscanned or unsigned images.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-container-registry-images
Securing Container Registry With Harbor
Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replicatio
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-container-registry-with-harbor
Securing GitHub Actions Workflows
This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-github-actions-workflows
Securing Helm Chart Deployments
Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-helm-chart-deployments
Securing Historian Server In Ot Environment
This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data used for safety analysis, regulatory reporting, and process optimization.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-historian-server-in-ot-environment
Securing Kubernetes On Cloud
This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-kubernetes-on-cloud
Securing Remote Access To Ot Environment
This skill covers implementing secure remote access to OT/ICS environments for operators, engineers, and vendors while preventing unauthorized access that could compromise industrial operations. It addresses jump server architecture, multi-factor authentication, session recording, privileged access management, vendor remote access controls, and compliance with IEC 62443 and NERC CIP-005 remote access requirements.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-remote-access-to-ot-environment
Securing Serverless Functions
This skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.
by mukul975/Anthropic-Cybersecurity-Skills / skills/securing-serverless-functions
Security
OWASP security patterns, secrets management, security testing
by alinaqi/maggy / skills/security
Security Alert Triage
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.
by elastic/agent-skills / skills/security/alert-triage
Security And Hardening
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
by addyosmani/agent-skills / skills/security-and-hardening
Security Audit
Comprehensive security audit of codebase using multiple security-auditor agents. Use before production deployments or after major features.
by TaylorHuston/local-life-manager / .claude/skills/security-audit
Security Best Practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
by foryourhealth111-pixel/Vibe-Skills / bundled/skills/security-best-practices
Security Case Management
Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.
by elastic/agent-skills / skills/security/case-management
Security Dashboard
GitHub security alerts command center -- triage Dependabot, code scanning, and secret scanning alerts entirely from the editor. Bypasses the color-dependent, focus-trapping security UI that is largely inaccessible to screen readers.
by Community-Access/accessibility-agents / codex-skills/security-dashboard
Security Detection Rule Management
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
by elastic/agent-skills / skills/security/detection-rule-management
Security Generate Security Sample Data
Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC.
by elastic/agent-skills / skills/security/generate-security-sample-data
Security Monitoring
Automate security monitoring, threat detection, incident response, and compliance workflows
by claude-office-skills/skills / security-monitoring
Security Ownership Map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.
by foryourhealth111-pixel/Vibe-Skills / bundled/skills/security-ownership-map
Security Requirement Extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
by wshobson/agents / plugins/security-scanning/skills/security-requirement-extraction
Security Review
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
by github/awesome-copilot / skills/security-review
Security Review
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
by getsentry/skills / skills/security-review
Security Reviewer
Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.
by foryourhealth111-pixel/Vibe-Skills / bundled/skills/security-reviewer
Security Reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
by Jeffallan/claude-skills / skills/security-reviewer
Security Standards
Comprehensive secure coding standards based on OWASP Top 10 2025, with 55+ anti-patterns, detection regex, framework-specific fixes for modern web and backend frameworks, and AI/LLM security guidance.
by github/awesome-copilot / instructions/security-and-owasp.instructions.md
Security Threat Model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
by foryourhealth111-pixel/Vibe-Skills / bundled/skills/security-threat-model
Senhasegura
Senhasegura PAM platform integration — A2A OAuth 2.0, PAM Core credentials, SSH key rotation, DSM CLI for CI/CD, External Secrets Operator (Kubernetes), MySafe, and a runnable MCP server. USE WHEN senhasegura, segura, A2A application, DSM CLI, runb, MySafe, ExternalSecret + senhasegura, OAuth client_credentials for PAM, credential custody release, /iso/coe/senha endpoint, SCIM provisioning. NOT FOR HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, 1Password, or generic OAuth 2.0 flows (use those directly).
by julianobarbosa/claude-code-skills / skills/senhasegura
Senhasegura Skill
Senhasegura Skill linked from Juliano Barbosa Claude Code Skills, with the upstream skill instructions available on GitHub.
by julianobarbosa/claude-code-skills / skills/senhasegura-skill
Senior SecOps Engineer
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review or audit, responding to a CVE or security incident, hardening infrastructure, implementing authentication or secrets management, running penetration test prep, checking OWASP Top 10 exposure, or enforcing security controls in CI/CD pipelines.
by alirezarezvani/claude-skills / engineering-team/skills/senior-secops
Sentinel
Analyzing code statically for security flaws: hardcoded secret detection, SQL injection prevention, input validation, security headers, and dependency CVE scanning. Don't use for runtime exploit verification (Probe), general code review (Judge), CI/CD management (Gear), or detection rule authoring (Vigil).
by simota/agent-skills / sentinel
Sentry (Read-only Observability)
Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.
by foryourhealth111-pixel/Vibe-Skills / bundled/skills/sentry
SE: Security
Security-focused code review specialist with OWASP Top 10, Zero Trust, LLM security, and enterprise security standards
by github/awesome-copilot / agents/se-security-reviewer.agent.md
Sherlock
OSINT username search across 400+ social networks. Hunt down social media accounts by username.
by NousResearch/hermes-agent / optional-skills/security/sherlock
Signed Audit Trails Recipe
Step-by-step cookbook for setting up cryptographically signed audit trails on Claude Code tool calls. Use when explaining, evaluating, or demonstrating the pattern before committing to the protect-mcp runtime hooks. Covers Cedar policy, Ed25519 receipts, offline verification, tamper detection, CI/CD integration, and SLSA composition.
by wshobson/agents / plugins/signed-audit-trails/skills/signed-audit-trails-recipe
Skill Scanner
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
by getsentry/skills / skills/skill-scanner
Skill Security Framing
URL validation and content sanitization for untrusted sources — use when handling external input safely
by nyldn/claude-octopus / skills/skill-security-framing
Sox Testing
Generate SOX sample selections, testing workpapers, and control assessments. Use when planning quarterly or annual SOX 404 testing, pulling a sample for a control (revenue, P2P, ITGC, close), building a testing workpaper template, or evaluating and classifying a control deficiency.
by anthropics/knowledge-work-plugins / finance/skills/sox-testing
Stackhawk Security Onboarding
Automatically set up StackHawk security testing for your repository with generated configuration and GitHub Actions workflow
by github/awesome-copilot / agents/stackhawk-security-onboarding.agent.md
Stride Analysis Patterns
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
by wshobson/agents / plugins/security-scanning/skills/stride-analysis-patterns
Suspicious Email Analyzer
Analyze emails for phishing, scam indicators, and security threats
by claude-office-skills/skills / suspicious-email
Termination Review
Termination review — high-risk flag detection, severance + release, and final pay timing by jurisdiction. Jurisdiction-specific rules and release consideration periods are researched per review, not stored. Use when the user says "reviewing a termination", "can we fire this person", "term review", or describes a termination scenario.
by anthropics/claude-for-legal / employment-legal/skills/termination-review
Testing Android Intents For Vulnerabilities
Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-android-intents-for-vulnerabilities
Testing API Authentication Weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token validation assessment, credential security testing, or API auth bypass.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-api-authentication-weaknesses
Testing API For Broken Object Level Authorization
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically replaces them with IDs belonging to other users to determine if the server enforces per-object authorization. This is OWASP API Security Top 10 2023 risk API1. Activates for requests involving BOLA testing, IDOR in APIs, object-level authorization testing, or API access control bypass.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-api-for-broken-object-level-authorization
Testing API For Mass Assignment Vulnerability
Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment testing, parameter binding abuse, auto-binding vulnerability, or API over-posting.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-api-for-mass-assignment-vulnerability
Testing API Security With Owasp Top 10
Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-api-security-with-owasp-top-10
Testing Cors Misconfiguration
Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-cors-misconfiguration
Testing For Broken Access Control
Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-broken-access-control
Testing For Business Logic Vulnerabilities
Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-business-logic-vulnerabilities
Testing For Email Header Injection
Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-email-header-injection
Testing For Host Header Injection
Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-host-header-injection
Testing For JSON Web Token Vulnerabilities
Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-json-web-token-vulnerabilities
Testing For Open Redirect Vulnerabilities
Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-open-redirect-vulnerabilities
Testing For Sensitive Data Exposure
Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-sensitive-data-exposure
Testing For XML Injection Vulnerabilities
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-xml-injection-vulnerabilities
Testing For Xss Vulnerabilities
Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation. The tester identifies all injection points and output contexts, crafts context-appropriate payloads, and bypasses sanitization and CSP protections. Activates for requests involving XSS testing, cross-site scripting assessment, client-side injection testing, or JavaScript injection vulnerability testing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-xss-vulnerabilities
Testing For Xss Vulnerabilities With Burpsuite
Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-xss-vulnerabilities-with-burpsuite
Testing For Xxe Injection Vulnerabilities
Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-for-xxe-injection-vulnerabilities
Testing JWT Token Security
Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-jwt-token-security
Testing Mobile API Authentication
Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-mobile-api-authentication
Testing Oauth2 Implementation Flaws
Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or authorization code flow testing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-oauth2-implementation-flaws
Testing Ransomware Recovery Procedures
Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-ransomware-recovery-procedures
Testing Websocket API Security
Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/testing-websocket-api-security
Test skill
This is a test that everythings is correct
by snyk/agent-scan / tests/mcp_servers/.test-client-invalid/skills/test-skill
Test skill
This skill has no name!
by snyk/agent-scan / tests/mcp_servers/.test-client-invalid/skills/invalid-skill
Threat Mitigation Mapping
Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
by wshobson/agents / plugins/security-scanning/skills/threat-mitigation-mapping
Threat Model Analyst
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.
by github/awesome-copilot / skills/threat-model-analyst
Tracking Threat Actor Infrastructure
Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a
by mukul975/Anthropic-Cybersecurity-Skills / skills/tracking-threat-actor-infrastructure
Triaging Security Alerts In Splunk
Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.
by mukul975/Anthropic-Cybersecurity-Skills / skills/triaging-security-alerts-in-splunk
Triaging Security Incident
Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/triaging-security-incident
Triaging Security Incident With Ir Playbook
Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
by mukul975/Anthropic-Cybersecurity-Skills / skills/triaging-security-incident-with-ir-playbook
Triaging Vulnerabilities With Ssvc Framework
Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
by mukul975/Anthropic-Cybersecurity-Skills / skills/triaging-vulnerabilities-with-ssvc-framework
Validating Backup Integrity For Recovery
Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.
by mukul975/Anthropic-Cybersecurity-Skills / skills/validating-backup-integrity-for-recovery
Varlock Security Skill
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials", "sensitive", "Varlock".
by wrsmith108/varlock-claude-skill / skills/varlock
Vault Setup Skill
Vault Setup Skill linked from Juliano Barbosa Claude Code Skills, with the upstream skill instructions available on GitHub.
by julianobarbosa/claude-code-skills / skills/vault-setup-skill
Venice Auth
Authenticate to the Venice API with a Bearer API key or with an x402 / SIWE wallet. Covers header formats, the SIWE message fields, TTL and nonce rules, the venice-x402-client SDK, and how to choose between the two modes.
by veniceai/skills / skills/venice-auth
VibeSec-Skill
This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.
by BehiSecc/VibeSec-Skill
Wcag Aaa
WCAG AAA conformance specialist. Audits web content against WCAG 2.2 Level AAA success criteria that go beyond the standard AA target. Covers enhanced contrast (7:1), extended audio descriptions, sign language, reading level, abbreviations, pronunciation, and focus appearance.
by Community-Access/accessibility-agents / codex-skills/wcag-aaa
Web Accessibility Wizard
Interactive web accessibility review wizard. Runs a guided, step-by-step WCAG audit of your web application. Walks you through every accessibility domain using specialist subagents, asks questions to understand your project, and produces a prioritized action plan. Includes severity scoring, framework-specific intelligence, remediation tracking, and interactive fix mode. For document accessibility (Word, Excel, PowerPoint, PDF), use the document-accessibility-wizard instead.
by Community-Access/accessibility-agents / codex-skills/web-accessibility-wizard