安全
安全扫描与漏洞检测
SKILL: Traducción SC en-EN → es-ES
zalaca
Vulture, Vulcan, X1
backend-development
zircote
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
runa-credentials
runafreyjasdottir
"Kista — Runa's self-owned encrypted vault. 8 entry types: credentials, API keys, SSH keys, certificates, notes, TOTP, licenses, identities. Independent access, no external dependencies."
phased-review
swannysec
Multi-stage implementation review with parallel sub-agents, severity-based autonomous fixes, and gated test verification. Runs code quality, architecture, simplicity, documentation, and security reviews in sequence with test gates between each fix stage. Security review is blocked until all other fixes are complete. Use after completing a feature, implementation phase, or release candidate. Supports scope modes: full, code-only, security, simplicity, docs.
safe-skill-install
swannysec
Safe skill installation with supply chain security scanning. Wraps Cisco skill-scanner to vet skills before installation. Supports GitHub repos, skills.sh (npx), Claude marketplace plugins, and local paths. Configurable scan depth with static and behavioral analysis by default. Uses GitHub archive downloads to avoid git execution risks, with hardened git clone fallback. Security decisions are made by a deterministic wrapper script, not the LLM agent.
monaco-payslip-calculator
silvainfm
Calculate Monaco payslips (bulletin de salaire) with social security contributions, taxes, and net salary. Use when user requests Monaco payslip calculations, salary breakdowns for Monaco employees, or needs to compute Monegasque employer/employee contributions.
ai-vuln-harness
daedalus
Design and implement multi-agent vulnerability research harnesses following the Project Glasswing / Cloudflare methodology. Use this skill when building or improving Hunt/Validate/Dedupe/Trace security pipelines, reducing false positives in AI vuln scanning, or operationalizing large-scale LLM-assisted code audit workflows.
simplisticate
HemSoft
V1.0 - Identifies complexity in code and proposes targeted simplifications with risk assessment. Use when reducing code complexity.
security-pattern-check
kjgarza
Identify security vulnerabilities and anti-patterns providing feedback on security issues a senior developer would catch. Use when user mentions security/vulnerability/safety concerns, code involves user input/authentication/data access, working with sensitive data (passwords/PII/financial), code includes SQL queries/file operations/external API calls, user asks about security best practices, or security-sensitive files are being modified (auth, payment, data access).
gha-hardening
swannysec
GitHub Actions security hardening, configuration best practices, and vulnerability detection. Covers workflow syntax, trigger security, permission management, secrets handling, OIDC federation, supply chain protection, self-hosted runner hardening, attack pattern recognition, and security scanning tool rules. 60% security/hardening content, 40% implementation/configuration guidance. Use this skill when users need to: (1) Harden GitHub Actions workflows against injection, supply chain, or privilege escalation attacks (2) Configure workflow permissions, secrets, OIDC, or environment protection rules securely (3) Understand dangerous workflow patterns (pull_request_target + checkout, workflow_run artifact poisoning, script injection via ${{ }}) (4) Choose or configure security scanning tools (zizmor, scorecard, actionlint, poutine, harden-runner, Raven) (5) Respond to supply chain incidents (tj-actions, reviewdog, compromised action tags) (6) Audit workflows for OWASP CI/CD risks, CIS benchmark compliance, or OpenSSF Scorecard checks (7) Write or review workflow YAML (triggers, matrix, reusable workflows, composite actions, caching, artifacts, environments) (8) Secure self-hosted runners (ephemeral patterns, network egress, persistence detection, runner groups)
tutor-buddy
acm-rgb
A pragmatic workflow taking a software project from idea to a secured, GitHub-ready repository, for beginners and vibecoders who want to ship without the usual mistakes. Runs five phases - ideate (have an idea, or get one suggested from the user's profile and current trends), plan (structure, file names, boilerplate, pinned deps), build (execute only the agreed plan, flag deviations first), security-audit (real checks for leaked secrets, vulnerable or typosquatted/hallucinated dependencies, dependency confusion, plus CI and auth hardening, and an honest note on what it cannot verify), and ship (repo hardening and a safe first push). Use whenever someone wants to start a new project or app, has an idea or wants one suggested, asks how to structure or scaffold a project, wants a safety check before shipping, or wants help getting code onto GitHub safely. Triggers include "start a project", "build me an app", "is my project safe", "put this on GitHub", even when tutor-buddy is not named.
Audit Trail
reggiechan74
This skill should be used when the user asks to "show audit trail", "why did we make this decision", "what happened after this", "trace this decision", "show decision history", "search audit log", or needs to understand the decision history and rationale behind code changes verified through coherence check.
skill-oracle
Aleffsalmeida
Universal Dynamic Orchestrator for Skills, Agents, Plugins, and MCP servers. Single entry point that indexes the full Claude Code ecosystem (5000+ assets), routes user tasks to domain Master Agents, debates ambiguous matches, suggests related domains proactively, and falls back to find-skills when no local match exists. Use as the FIRST step before any non-trivial task; replaces the legacy local-only skill matcher.
dependency-vulnerability-scanner
Dexploarer
Scans dependencies for known vulnerabilities (npm audit, pip-audit, etc.), generates reports, and suggests fixes. Use when user asks to "check vulnerabilities", "security scan", "audit dependencies", "check CVEs", or "vulnerable packages".
akamai-application-security-api
Lap-Platform
"Akamai: Application Security API skill. Use when working with Akamai: Application Security for activations, api-discovery, configs. Covers 213 endpoints."
sui-keypair-cryptography
RandyPen
"Helps Claude Code understand Sui blockchain keypair and cryptography operations, providing guidelines and examples for key generation, signing, verification, address derivation, and multi-signature scheme support. Use when working with cryptography in Sui development or when the user mentions keypairs, cryptography, signing, or verification."
asvs-audit
ibuildingsnl
OWASP ASVS 5.0 Level 1 security audit with deterministic, evidence-based findings. Use this when asked for a security audit or asvs audit.
Coherence Check
reggiechan74
This skill should be used when the user asks to "check this code", "validate this", "verify this implementation", "is this correct", "review this code", "check for errors", "multi-agent verification", or mentions production-critical code, financial calculations, security implementations, or high-stakes operations. Provides comprehensive multi-agent verification workflow with specialized critic agents.
agent-skills-creator
theneoai
Agent Skills 全生命周期工程化创建与管理器。严格遵循 agentskills.io 开放标准。 核心能力：创建标准化 Skill、多轮评估、多轮训练与迭代优化、多 Agent 协作模式（并行、层次、辩论、Crew）、质量体系建设、CI/CD 流水线生成、OWASP AST10 安全审查、MCP 集成、团队 Skill 仓库治理与自迭代。 当用户要求"创建 Skill""评估/优化 Skill""多轮训练""多 Agent 协作""建立质量标准""生成 CI/CD""安全审查""管理 Skill 工程体系"时触发。 不用于具体业务任务、普通提示词工程或非 Skill 相关操作。
config-auditing
BitYoungjae
"Neovim configuration audit knowledge base. Use when: reviewing config files for issues, checking deprecated APIs, optimizing settings, or performing health checks. Provides checklists, best practices, and version-specific deprecated API detection patterns."
Security Audit Reporter
Eli-yu-first
"Generates comprehensive security audit reports with findings, risk ratings, and remediation timelines"
Acceptance Criteria
reggiechan74
This skill should be used when the user asks to "define acceptance criteria", "what are the success criteria", "set quality gates", "establish acceptance tests", "define what success looks like", or needs to specify pre-declared success criteria before code execution begins.
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
clawpilot
kcchien
Expert skill for OpenClaw (v2026.2.19) — self-hosted AI gateway connecting chat apps (WhatsApp, Telegram, Discord, Slack, iMessage, Signal, LINE, Matrix, Teams, Google Chat, BlueBubbles) to AI agents. Use when user asks about: (1) Installing, configuring, or updating OpenClaw, (2) Setting up or troubleshooting chat channels (e.g. "my WhatsApp bot isn't responding"), (3) Security hardening, auditing, or checking a local OpenClaw installation, (4) Inspecting openclaw.json config, prompts (SOUL.md/AGENTS.md), or session transcripts, (5) Multi-agent routing, session management, agent isolation, (6) Cloud deployment (AWS/GCP/Fly.io/Docker) and remote access (Tailscale/SSH), (7) Upgrading or migrating OpenClaw versions, (8) Discovering or installing OpenClaw skills from ClawHub, (9) Any mention of "openclaw", "openclaw.json", "~/.openclaw", or gateway config. Includes bundled scripts for security audit (CVE detection, OWASP/NIST mapping, supply chain scan), config inspection, prompt checking, and session scanning. Do NOT use for: general chatbot frameworks (Botpress, Rasa, etc.), non-OpenClaw AI gateways, or generic Docker/cloud questions unrelated to OpenClaw deployment.