Agent skills for Information Security Engineers

173 agent skills are labelled for Information Security Engineers work. They are listed by code score, out of 100.

All 173

iap-agent-platform-troubleshooting google/skills
Diagnoses Identity-Aware Proxy (IAP) denials of outbound requests from Gemini Enterprise Agent Platform agents that run on Agent Runtime and send traffic through Agent Gateway. Us…

Verified96A
skill-scanner getsentry/skills
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whet…

Verified88A
google-cloud-solution-multi-agent-security google/skills
Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGENT), or egress (AGENT_TO_ANYWH…

Verified87A
secops-detection-engineering google/skills
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existi…

Verified87A
api-gateway-backend-security-and-rate-limiting google/skills
Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configur…

Verified86A
google-cloud-recipe-foundation-builder google/skills
Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects,…

Verified85A
cloud-armor-crs-rule-upgrader google/skills
Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to n…

Verified84B
security-model getsentry/skills
Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclus…

Verified84B
codeql trailofbits/skills
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database…

Verified83B
detecting-container-runtime-threats-with-falco mukul975/Anthropic-Cybersecurity-Skills
Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detec…

Verified82B
detecting-typosquatting-packages mukul975/Anthropic-Cybersecurity-Skills
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus…

Verified82B
graph-evolution trailofbits/skills
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexi…

Verified82B
post-patch-validation trailofbits/skills
Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly intr…

Verified82B
semgrep trailofbits/skills
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-sc…

Verified82B
supabase-rls-policies github/awesome-copilot
Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, view…

Verified81B
detecting-ai-model-prompt-injection-attacks mukul975/Anthropic-Cybersecurity-Skills
Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (syst…

Verified81B
env-secrets-manager alirezarezvani/claude-skills
Use when auditing .env files, planning credential rotation, chasing a missing env var in production or hardening a repo against leaked secrets. Scans for committed secrets and dri…

Verified81B
mcp-implementation-security-review github/awesome-copilot
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, in…

Verified80B
npm-trusted-publishing github/awesome-copilot
Set up or fix npm trusted publishing (OIDC) in GitHub Actions and remove NPM_TOKEN. Use for ENEEDAUTH, E404 on PUT, E422 repository.url, or migrating off 2FA-bypass tokens before…

Verified80B
benchmarking-kubernetes-with-kube-bench mukul975/Anthropic-Cybersecurity-Skills
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, e…

Verified80B
deploying-decoy-files-for-ransomware-detection mukul975/Anthropic-Cybersecurity-Skills
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrit…

Verified80B
implementing-anti-ransomware-group-policy mukul975/Anthropic-Cybersecurity-Skills
Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack…

Verified80B
crypto-protocol-diagram trailofbits/skills
Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagra…

Verified80B
sarif-parsing trailofbits/skills
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "dedupli…

Verified80B
testing-handbook-generator trailofbits/skills
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requir…

Verified80B
cloudflare-one cloudflare/skills
Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors. Also use when a…

Verified80B
configuring-tls-1-3-for-secure-communications mukul975/Anthropic-Cybersecurity-Skills
Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh. U…

79B
deploying-software-defined-perimeter mukul975/Anthropic-Cybersecurity-Skills
Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero tru…

79B
implementing-ransomware-kill-switch-detection mukul975/Anthropic-Cybersecurity-Skills
Analyzes ransomware kill switch mechanisms, including mutex-based execution guards, domain-based kill switches (e.g. WannaCry-style), and registry termination checks, then impleme…

79B
implementing-supply-chain-security-with-in-toto mukul975/Anthropic-Cybersecurity-Skills
Implements supply chain integrity verification for container builds with the in-toto framework: generating signing keys, defining a supply chain layout, recording pipeline steps a…

79B
performing-post-quantum-cryptography-migration mukul975/Anthropic-Cybersecurity-Skills
Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards. Performs cryptographic inventory scanning to identify quantum-vulner…

79B
information-security-manager-iso27001 alirezarezvani/claude-skills
Use when designing or running an ISO 27001 ISMS in HealthTech or MedTech: risk assessment, control implementation, certification or security incidents. Assesses risk with risk_ass…

79B
auditing-kubernetes-rbac-privilege-escalation mukul975/Anthropic-Cybersecurity-Skills
Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which s…

78B
configuring-oauth2-authorization-flow mukul975/Anthropic-Cybersecurity-Skills
Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implemen…

78B
implementing-continuous-security-validation-with-bas mukul975/Anthropic-Cybersecurity-Skills
Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, S…

78B
implementing-dmarc-dkim-spf-email-security mukul975/Anthropic-Cybersecurity-Skills
Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, includi…

78B
implementing-privileged-access-management-with-cyberark mukul975/Anthropic-Cybersecurity-Skills
Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session…

78B
readonly-sql-guard davila7/claude-code-templates
Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production/ERP/analytics database (a "query" MCP tool, text-to-SQL, an adm…

78B
ai-security alirezarezvani/claude-skills
Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITRE ATLAS and scores robustness…

78B
gke-workload-identity google/skills
Configures and diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find defau…

78B
mermaid-to-proverif trailofbits/skills
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifyi…

78B
rust-review trailofbits/skills
Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime…

78B
agent-security-hardening affaan-m/ECC
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use whe…

77B
configuring-microsegmentation-for-zero-trust mukul975/Anthropic-Cybersecurity-Skills
Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in ze…

77B
defending-llms-with-guardrails mukul975/Anthropic-Cybersecurity-Skills
Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspe…

77B
designing-adversary-engagement-with-mitre-engage mukul975/Anthropic-Cybersecurity-Skills
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the E…

77B
detecting-container-drift-at-runtime mukul975/Anthropic-Cybersecurity-Skills
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and…

77B
detecting-dependency-confusion mukul975/Anthropic-Cybersecurity-Skills
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `conf…

77B
detecting-qr-code-phishing-with-email-security mukul975/Anthropic-Cybersecurity-Skills
Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR…

77B
implementing-azure-ad-privileged-identity-management mukul975/Anthropic-Cybersecurity-Skills
Configure Microsoft Entra Privileged Identity Management (PIM) to convert standing privileged assignments into eligible, time-bound roles requiring justification, MFA, and approva…

77B
iam-helper-for-privileged-access-management google/skills
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, re…

77B
tm7-threat-model github/awesome-copilot
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a…

76B
supply-chain-guard davila7/claude-code-templates
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, fil…

76B
assuredworkloads-frameworks-author google/skills
Authors custom cloud controls and customized frameworks for Assured Workloads when built-in resources cannot satisfy core requirements. Use when creating or synthesizing custom da…

76B
firebase-security-rules-auditor firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type saf…

76B
deploying-cloud-deception-with-decoy-resources mukul975/Anthropic-Cybersecurity-Skills
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them…

75B
implementing-aes-encryption-for-data-at-rest mukul975/Anthropic-Cybersecurity-Skills
Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use wh…

75B
implementing-aws-iam-permission-boundaries mukul975/Anthropic-Cybersecurity-Skills
Configures AWS IAM permission boundaries that cap the maximum permissions an identity-based policy can grant to a user or role, so effective permissions are the intersection of th…

75B
performing-ssl-certificate-lifecycle-management mukul975/Anthropic-Cybersecurity-Skills
Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, usi…

75B
android-permissions-security android/skills
Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining custom permissions, securing…

75B
convex-authz openclaw/clawhub
Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and wri…

75B
gha-security-review getsentry/skills
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workf…

75B
security-and-hardening addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or…

74B
agent-owasp-compliance github/awesome-copilot
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before productio…

74B
building-role-mining-for-rbac-optimization mukul975/Anthropic-Cybersecurity-Skills
Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to discover optimal RBAC roles from existing user-permission assi…

74B
implementing-api-gateway-security-controls mukul975/Anthropic-Cybersecurity-Skills
Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and th…

74B
implementing-attack-path-analysis-with-xm-cyber mukul975/Anthropic-Cybersecurity-Skills
Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward c…

74B
implementing-image-provenance-verification-with-cosign mukul975/Anthropic-Cybersecurity-Skills
Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulcio, Rekor transparency log), SLSA attestations, and enforcing…

74B
implementing-zero-trust-network-access-with-zscaler mukul975/Anthropic-Cybersecurity-Skills
Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications t…

74B
migrating-to-post-quantum-cryptography mukul975/Anthropic-Cybersecurity-Skills
Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybr…

74B
performing-kubernetes-cis-benchmark-with-kube-bench mukul975/Anthropic-Cybersecurity-Skills
Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing r…

74B
validating-tpm-measured-boot-attestation mukul975/Anthropic-Cybersecurity-Skills
Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes…

74B
secrets-vault-manager alirezarezvani/claude-skills
Use when setting up HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GCP Secret Manager, rotating secrets or auditing secret access. Generates config with vault_config_gen…

74B
gke-workload-security google/skills
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`…

74B
trailmark-structural trailofbits/skills
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and versio…

74B
vector-forge trailofbits/skills
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test…

74B
zeroize-audit trailofbits/skills
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verificat…

74B
cloudflare-one-migrations cloudflare/skills
Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.

74B
1password NousResearch/hermes-agent
Set up op CLI, sign in, and read or inject secrets.

73B
security-research code-yeongyu/oh-my-openagent
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibr…

73B
security-review github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities th…

73B
configuring-host-based-intrusion-detection mukul975/Anthropic-Cybersecurity-Skills
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OS…

73B
deploying-edr-agent-with-crowdstrike mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboar…

73B
detecting-spearphishing-with-email-gateway mukul975/Anthropic-Cybersecurity-Skills
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection…

73B
implementing-llm-guardrails-for-security mukul975/Anthropic-Cybersecurity-Skills
Implements input/output validation guardrails for LLM applications using NVIDIA NeMo Guardrails (Colang), custom Python validators for PII detection, and the Guardrails AI framewo…

73B
implementing-next-generation-firewall-with-palo-alto mukul975/Anthropic-Cybersecurity-Skills
Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware policies, User-ID identity-based enforcement, zone-based security…

73B
implementing-taxii-server-with-opentaxii mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for autom…

73B
integrating-sast-into-github-actions-pipeline mukul975/Anthropic-Cybersecurity-Skills
Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Securi…

73B
performing-dmarc-policy-enforcement-rollout mukul975/Anthropic-Cybersecurity-Skills
Execute a phased DMARC rollout by inventorying sending sources, configuring SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine to p=reject…

73B
skill-inspector NVIDIA/SkillSpector
Review AI agent skills before installation using NVIDIA SkillSpector and source-aware semantic review. Use when asked whether a skill or downloaded skill folder is safe, trustwort…

73B
android-intent-security android/skills
Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in AndroidManifest.xml (activities, se…

73B
sharp-edges trailofbits/skills
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic libr…

73B
analyzing-sbom-for-supply-chain-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the…

72B
building-phishing-reporting-button-workflow mukul975/Anthropic-Cybersecurity-Skills
Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that cl…

72B
implementing-google-workspace-phishing-protection mukul975/Anthropic-Cybersecurity-Skills
Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation d…

72B
implementing-google-workspace-sso-configuration mukul975/Anthropic-Cybersecurity-Skills
Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service Provider, to central…

72B
implementing-hipaa-security-rule-safeguards mukul975/Anthropic-Cybersecurity-Skills
Implement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePHI): conduct the required risk analysis, deploy the administrat…

72B
implementing-kubernetes-network-policy-with-calico mukul975/Anthropic-Cybersecurity-Skills
Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based se…

72B
implementing-network-access-control mukul975/Anthropic-Cybersecurity-Skills
Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configuration to enforce identity-based access policies, posture asses…

72B
implementing-opa-gatekeeper-for-policy-enforcement mukul975/Anthropic-Cybersecurity-Skills
Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource r…

72B
implementing-proofpoint-email-security-gateway mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.

72B
implementing-scim-provisioning-with-okta mukul975/Anthropic-Cybersecurity-Skills
Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account creation, attribute…

72B
secure-code-guardian Jeffallan/claude-skills
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing pas…

72B
1password spinabot/brigade
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.

72B
fp-check trailofbits/skills
Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked…

72B
ruzzy trailofbits/skills
Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C…

72B
trailmark-summary trailofbits/skills
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural o…

72B
throwaway-machine smol-machines/smolvm
Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify, with no network unless explicitly granted, and collects artifacts from a writable output direc…

72B
azure-keyvault-py microsoft/skills
Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage. Triggers: "key vault", "SecretClient", "KeyClient", "CertificateClient", "s…

72B
entra-agent-id microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path,…

72B
firestore-rules-creation firebase/agent-skills
Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subage…

72B
requesting-code-review NousResearch/hermes-agent
Pre-commit review: security scan, quality gates, auto-fix.

71B
desktop-security-update lobehub/lobehub
Inspect, mark, or revoke vulnerable LobeHub Desktop versions through the existing release workflow and signed R2 security policy. Use for forced security updates across Stable, Ca…

71B
security-audit cloudflare/security-audit-skill
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, s…

71B
sast-configuration wshobson/agents
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps…

71B
github-actions-hardening github/awesome-copilot
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss…

71B
configuring-snort-ids-for-intrusion-detection mukul975/Anthropic-Cybersecurity-Skills
Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when de…

71B
detecting-indirect-prompt-injection mukul975/Anthropic-Cybersecurity-Skills
Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scan…

71B
detecting-misconfigured-azure-storage mukul975/Anthropic-Cybersecurity-Skills
Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerSh…

71B
implementing-aws-security-hub mukul975/Anthropic-Cybersecurity-Skills
Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations,…

71B
implementing-cloud-waf-rules mukul975/Anthropic-Cybersecurity-Skills
Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and…

71B
implementing-disk-encryption-with-bitlocker mukul975/Anthropic-Cybersecurity-Skills
Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying…

71B
implementing-immutable-backup-with-restic mukul975/Anthropic-Cybersecurity-Skills
Implements ransomware-resistant backups using restic with S3-compatible Object Lock (AWS S3, MinIO, Backblaze B2), automating backup creation, integrity checks via restic check --…

71B
implementing-just-in-time-access-provisioning mukul975/Anthropic-Cybersecurity-Skills
Implements Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access, covering approval workflows, automatic expiration/revo…

71B
implementing-ransomware-backup-strategy mukul975/Anthropic-Cybersecurity-Skills
Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore errors), configuring RPO/RTO-…

71B
implementing-threat-modeling-with-mitre-attack mukul975/Anthropic-Cybersecurity-Skills
Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investmen…

71B
implementing-zero-trust-in-cloud mukul975/Anthropic-Cybersecurity-Skills
Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verific…

71B
performing-service-account-credential-rotation mukul975/Anthropic-Cybersecurity-Skills
Automates credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk. Use w…

71B
securing-azure-with-microsoft-defender mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and datab…

71B
verifying-build-provenance-with-slsa-sigstore mukul975/Anthropic-Cybersecurity-Skills
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyle…

71B
google-cloud-scc-remediation google/skills
Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic Combinations. Use when asked…

71B
diagramming-code trailofbits/skills
Generates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack surfa…

71B
entry-point-analyzer trailofbits/skills
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by acces…

71B
azure-security-keyvault-keys-dotnet microsoft/skills
Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signi…

71B
django-access-review getsentry/skills
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords…

71B
secret-serialization getsentry/skills
Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript…

71B
opensource-pipeline affaan-m/ECC
Open-source pipeline: fork, sanitize, and package private projects for safe public release. Chains 3 agents (forker, sanitizer, packager). Triggers: '/opensource', 'open source th…

70B
dependency-doctor Shubhamsaboo/awesome-llm-apps
Checks requirements.txt, pyproject.toml, and package.json dependency manifests for surface-level direct-dependency footguns: standard-library shadowing pins, abandoned backports,…

70B
ci-security-scanning-with-strix usestrix/strix
Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

70B
auditing-mcp-servers-for-tool-poisoning mukul975/Anthropic-Cybersecurity-Skills
Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/aut…

70B
auditing-uefi-firmware-with-chipsec mukul975/Anthropic-Cybersecurity-Skills
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI varia…

70B
building-detection-rules-with-sigma mukul975/Anthropic-Cybersecurity-Skills
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating…

70B
building-patch-tuesday-response-process mukul975/Anthropic-Cybersecurity-Skills
Establish a repeatable operational process for triaging, testing, and deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL Server, Azure) via WSUS/SC…

70B
configuring-multi-factor-authentication-with-duo mukul975/Anthropic-Cybersecurity-Skills
Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive authentication pol…

70B
configuring-suricata-for-network-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS,…

70B
configuring-windows-defender-advanced-settings mukul975/Anthropic-Cybersecurity-Skills
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit p…

70B
deploying-osquery-for-endpoint-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Us…

70B
detecting-aws-credential-exposure-with-trufflehog mukul975/Anthropic-Cybersecurity-Skills
Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating s…

70B
implementing-aws-nitro-enclave-security mukul975/Anthropic-Cybersecurity-Skills
Build AWS Nitro Enclave confidential computing environments using nitro-cli to create enclave images, configure attestation-aware KMS policies with PCR condition keys, validate at…

70B
implementing-dragos-platform-for-ot-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups lik…

70B
implementing-hardware-security-key-authentication mukul975/Anthropic-Cybersecurity-Skills
Builds a FIDO2/WebAuthn relying party server with the python-fido2 library, covering registration and authentication ceremonies, YubiKey enrollment, resident key (discoverable cre…

70B
implementing-zero-standing-privilege-with-cyberark mukul975/Anthropic-Cybersecurity-Skills
Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the T…

70B
implementing-zero-trust-network-access mukul975/Anthropic-Cybersecurity-Skills
Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies,…

70B
performing-container-escape-detection mukul975/Anthropic-Cybersecurity-Skills
Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, s…

70B
securing-serverless-functions mukul975/Anthropic-Cybersecurity-Skills
Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions): least-privilege IAM roles, dependency vulnerability scanning, secrets management integr…

70B
find-bugs davila7/claude-code-templates
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current br…

70B
cmmc-readiness alirezarezvani/claude-skills
Use when a defense contractor or subcontractor is preparing for a CMMC 2.0 Level 2 self-assessment or C3PAO assessment, calculating or checking an SPRS score against NIST SP 800-1…

70B
iam-helper-for-policy-simulator google/skills
Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud. Uses the Policy Simulator to replay historical access logs against pro…

70B
skill-security-auditor eigent-ai/eigent
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, pat…

70B
fullstack-guardian Jeffallan/claude-skills
Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from…

70B
healthcheck spinabot/brigade
Host security hardening and risk-tolerance configuration for Brigade deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure r…

70B
algorand-vulnerability-scanner trailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when…

70B
audit-prep-assistant trailofbits/skills
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures acce…

70B
genotoxic trailofbits/skills
Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call gra…

70B
secure-workflow-guide trailofbits/skills
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual…

70B
semgrep-rule-creator trailofbits/skills
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

70B
vulnerability-triage-brocards trailofbits/skills
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a secu…

70B
security-ownership-map tech-leads-club/agent-skills
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visu…

70B
security-check midudev/autoskills
Use when auditing a Rails app for XSS, CSRF, SQLi, IDOR, secrets, or auth bypass. Never print secrets. Trigger words: security, audit, XSS, CSRF, SQL injection, vulnerability.

70B
turnstile-spin cloudflare/skills
Set up, repair, or migrate to Cloudflare Turnstile bot verification in an existing frontend and backend, including server-side Siteverify.

70B
find-bugs getsentry/skills
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current br…

70B
security-ownership-map davila7/claude-code-templates
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visu…

65C
security-ownership-map openai/skills
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visu…

62C

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.