Security
Security scanning and vulnerability detection
audit-security
by nullvoidundefined
Use this agent to conduct a security audit (CISO perspective) of a codebase: auth bypasses, CSRF, prompt injection, dependency CVEs, secrets management, credential exposure across git history and Claude Code session transcripts. Use when the user asks for a security audit, before any launch, or after touching auth, sessions, or secret handling. Produces docs/audits/YYYY-MM-DD-security.md and commits it. Has explicit authorization to read .env.example but never .env or any live credential file.
AWS Penetration Testing
by automindtechnologie-jpg
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
DevOps Automator
by anorbert-cmyk
DevOps / Platform Engineer focused on safe automation, repeatable environments, and fast delivery.
trivy
by lorenzogirardi
Security vulnerability scanning using Trivy for ecommerce project. Scans dependencies, container images, and IaC. Blocks CRITICAL and HIGH severity. Triggers on "trivy", "vulnerability scan", "security scan", "container scan", "cve", "dependency scan", "npm audit", "docker scan", "security check". PROACTIVE: MUST invoke before committing code with new dependencies.
skillcheck
by atbender
LLM-powered security auditor for Claude Code skills. Analyzes skills for security risks before installation.
code-review
by mishankov
Perform comprehensive software code reviews focused on correctness, regressions, security, reliability, performance, and test quality. Use when asked to review pull requests, commits, branches, patches, or source files and deliver prioritized findings with severity, concrete impact, and file/line references.
code-review-checklist
by htooayelwinict
Review code changes for correctness, security, performance, and maintainability. Use for PR reviews, code audits, pre-merge checks, or quality validation of Laravel + React + Python code. EXCLUSIVE to reviewer agent.
senior-security
by 8-Sync-Dev
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography selection tables, and a map of the security scanners to reach for.
Quality Engineer Agent
by gajakannan
Opinionated AI‑agent development framework with a reference Insurance CRM implementation.
securing-ai-generated-code
by chrbailey
Reviews AI-generated code for security vulnerabilities before commit. Checks for injection flaws, privilege escalation, hardcoded secrets, insecure defaults, and missing input validation. Use when reviewing code written by AI coding agents, after code generation, or before committing AI-assisted changes.
writing-meeting-notes
by danbars
Use when a meeting just occurred and notes need to be turned into a clear summary with decisions, action items, owners, and dates.
Solaudit - Smart Contract Security Scanner
by NguyenMinhGitHub
Solidity smart contract security auditor. Detect reentrancy, overflow, access control issues. 50+ vulnerability patterns. CI/CD ready. Free CLI tool.
information-security-manager-iso27001
by nimeshgurung
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
AWS Penetration Testing
by jcastillotx
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
security-scan
by IHKREDDY
Run security checks before PR including secrets, vulnerabilities, and best practices
supabase-postgres-best-practices
by kunhai-88
"Supabase 出品的 Postgres 性能优化与最佳实践。在编写、评审或优化 Postgres 查询、表结构设计或数据库配置时使用。"
asking-questions
by arielperez82
Guidance for asking clarifying questions when user requests are ambiguous, have multiple valid approaches, or require critical decisions. Use when implementation choices exist that could significantly affect outcomes.
Elixir Code Review Skill
by vircung
Use this skill to ensure Elixir code meets BEAM VM best practices, security standards, and performance requirements while maintaining the functional programming paradigms that make Elixir powerful.
elm-security-review
by bromanko
This skill should be used when the user asks for "security review", "vulnerability scan", "audit Elm security", "security audit", "find vulnerabilities", "check for security issues", or wants a deep security analysis of Elm code including port safety, JSON decoder validation, and XSS prevention.
k8s-manifest-generator
by baotoq
Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests, creating K8s resources, or implementing production-grade Kubernetes configurations.
security-and-hardening
by MGallo-Code
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
gzs-dependency-risk-audit
by tvproductions
Assess a project's direct and transitive dependency risks using manifests, lockfiles, authoritative advisories, compatibility constraints, maintenance signals, licenses, provenance, and actual repository usage. Use for dependency-risk, supply-chain, vulnerability, abandonment, or license audits; not for automatically upgrading packages or performing a general security review.
angular-enterprise-review
by JoseGusnay
"Professional Code Auditor for Angular Enterprise Architecture. Performs strict reviews against SOLID, Smart/Dumb patterns, naming conventions, and testing standards."
Burp Suite Web Application Testing
by automindtechnologie-jpg
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.