solana-vulnerability-scanner

3.0k

trailofbits

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

algorand-vulnerability-scanner

3.0k

trailofbits

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

QE Security Compliance

215

proffesor-for-testing

Security auditing, vulnerability scanning, and compliance validation for OWASP, SOC2, GDPR, and other standards.

security

188

aiskillstore

Security validation, vulnerability scanning, and compliance checking.

ops-security-audit

122

LerianStudio

Structured workflow for infrastructure security audits including compliance validation, vulnerability assessment, and security posture review.

security-patterns

97

yonatangross

Security patterns for authentication, defense-in-depth, input validation, OWASP Top 10, LLM safety, and PII masking. Use when implementing auth flows, security layers, input sanitization, vulnerability prevention, prompt injection defense, or data redaction.

discover-security

76

rand

Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.

XSS Testing Patterns

71

PramodDutta

Cross-site scripting vulnerability testing covering reflected, stored, and DOM-based XSS with sanitization validation and CSP bypass detection.

OWASP Security Testing

71

PramodDutta

Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication, and authorization testing.

security-audit

67

mswell

Comprehensive security code audit using multi-phase analysis (Assessment → STRIDE Threat Modeling → Code Review → Report). Use when asked to perform security review, vulnerability assessment, code audit, pentest code review, find security bugs, or analyze code for vulnerabilities. Optimized for bug bounty hunting with concrete evidence and exploitability validation.

pentest-metasploit

64

AgentSecOps

Penetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in authorized security assessments, (2) Demonstrating exploit impact for security research, (3) Testing defensive controls in controlled environments, (4) Conducting authorized penetration tests with proper scoping and authorization, (5) Developing post-exploitation workflows for red team operations.

api-security

37

jefflester

API security best practices and common vulnerability prevention. Enforces security checks for authentication, input validation, SQL injection, XSS, and OWASP Top 10 vulnerabilities. Use when building or modifying APIs.

security-audit

31

bybren-llc

RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes, or scanning for security issues.

security

29

omer-metin

One breach = game over. Threat modeling, OWASP Top 10, secure coding, security architecture, zero trust. The complete security skill for protecting your application from day one. Security isn't a feature you add later - it's a mindset that shapes every decision. This skill covers application security, not infrastructure security. Use when "security, owasp, xss, sql injection, csrf, authentication, authorization, secrets, api key, vulnerability, secure coding, security headers, rate limiting, input validation, sanitize, escape, security, owasp, authentication, authorization, vulnerabilities, secure-coding" mentioned.

security-owasp

29

omer-metin

Expert at securing web applications against OWASP Top 10 vulnerabilities. Covers authentication, authorization, input validation, XSS prevention, CSRF protection, secure headers, and security testing. Treats security as a first-class requirement, not an afterthought. Use when "security, OWASP, XSS, CSRF, SQL injection, authentication security, authorization, input validation, secure headers, vulnerability, penetration testing, security, owasp, authentication, authorization, xss, csrf, injection, headers" mentioned.

code-review

27

Klimabevaegelsen

Activates when reviewing code, checking for security issues, or validating best practices. Use this skill for: security audits, performance reviews, React 19 pattern validation, TypeScript strict mode compliance, and OWASP vulnerability checks. Keywords: review, security, performance, audit, OWASP, vulnerability, best practice, lint

Security Auditing

20

jeanluciano

Audit security with vulnerability scanning, input validation checks, and auth/authz review against OWASP Top 10. Use when implementing authentication, reviewing security-sensitive code, or conducting security audits.

audit-skill

17

jgtolentino

Comprehensive audit capabilities for security, code quality, module structure, compliance, and performance analysis. Use this skill when performing security audits, code reviews, vulnerability assessments, module structure validation, or generating audit reports.

Sentinel

8

simota

A static security analysis agent. Responsible for detecting hardcoded secrets, preventing SQL injection, performing input validation, configuring security headers, and scanning dependencies for CVEs. Used for security audits and when vulnerability fixes are required.

vulnerability-validation

8

Factory-AI

Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.

Probe

8

simota

Integration with OWASP ZAP and Burp Suite, penetration test planning, DAST execution, and vulnerability scanning. Used when dynamic security testing, penetration testing, or runtime vulnerability validation is required. Complements Sentinel static analysis.

algorand-vulnerability-scanner

7

plurigrid

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). (project, gitignored)

solana-vulnerability-scanner

7

plurigrid

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. (project, gitignored)

security-checklist

6

Zate

This skill should be used for OWASP, security review, authentication, XSS, SQL injection prevention, CSRF, input validation, secure coding, vulnerability scanning

security-analyzer

5

Cornjebus

Comprehensive security vulnerability analysis for codebases and infrastructure. Scans dependencies (npm, pip, gem, go, cargo), containers (Docker, Kubernetes), cloud IaC (Terraform, CloudFormation), and detects secrets exposure. Fetches live CVE data from OSV.dev, calculates risk scores, and generates phased remediation plans with TDD validation tests. Use when users mention security scan, vulnerability, CVE, exploit, security audit, penetration test, OWASP, hardening, dependency audit, container security, or want to improve security posture.

security-review

5

sunnypatneedi

Conduct comprehensive security code reviews covering OWASP Top 10, vulnerability assessment, secure coding practices, input validation, authentication, authorization, and data protection.

k8s-troubleshooting

4

kcns008

Comprehensive Kubernetes and OpenShift cluster health analysis and troubleshooting based on Popeye's issue detection patterns. Use this skill when: (1) Proactive cluster health assessment and security analysis (2) Analyzing pod/container logs for errors or issues (3) Interpreting cluster events (kubectl get events) (4) Debugging pod failures: CrashLoopBackOff, ImagePullBackOff, OOMKilled, etc. (5) Diagnosing networking issues: DNS, Service connectivity, Ingress/Route problems (6) Investigating storage issues: PVC pending, mount failures (7) Analyzing node problems: NotReady, resource pressure, taints (8) Troubleshooting OCP-specific issues: SCCs, Routes, Operators, Builds (9) Performance analysis and resource optimization (10) Security vulnerability assessment and RBAC validation (11) Configuration best practices validation (12) Reliability and high availability analysis

pt-scanning

3

santosomar

Performs authorized security scanning using static, dynamic, and vulnerability-focused methods. Use when mapping exposed services, profiling application behavior, and identifying known weaknesses for validation.

SecurityReview

3

RohiRIK

Security auditing, checklist validation, and vulnerability scanning.

security-implementation-guide

2

organvm-iv-taxis

Comprehensive security patterns for authentication, authorization, input validation, and common vulnerability prevention

securing-serverless-functions

2

mukul975

This skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.

performing-web-application-penetration-test

2

mukul975

Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.

conducting-api-security-testing

2

mukul975

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

fuzzing-apis

1

agent-arc-744

This skill enables Claude to perform automated fuzz testing on APIs to discover vulnerabilities, crashes, and unexpected behavior. It leverages malformed inputs, boundary values, and random payloads to generate comprehensive fuzz test suites. Use this skill when you need to identify potential SQL injection, XSS, command injection vulnerabilities, input validation failures, and edge cases in APIs. Trigger this skill by requesting fuzz testing, vulnerability scanning, or security analysis of an API. The skill is invoked using the `/fuzz-api` command.

OWASP Security Testing

1

KaliBellion

Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication, and authorization testing.

security-review

medy-gribkov

Code security review covering OWASP Top 10, injection prevention (SQL, XSS, command injection), authentication and authorization patterns, secrets management, dependency vulnerability scanning, input validation, CORS, CSRF, rate limiting, and security headers. Language-agnostic with examples in JavaScript, Python, and Go. Use when reviewing code for security or hardening an application.

API Pentest

Poatan222

Targeted API penetration testing using a GTFO-first approach: find the highest-impact vulnerability fast, prove it with a PoC, and move on. Covers five attack families: AuthN/AuthZ, BOLA/IDOR, Input Validation, SSRF, and Business Logic. Each family is a loadable module with specific test cases, payloads, and PoC templates. Trigger when user mentions "API pentest", "API security test", "test this API", "find vulnerabilities in this endpoint", "BOLA", "IDOR", "broken auth", "injection test", "SSRF", "business logic flaw", "API attack", or shares API docs, Swagger/OpenAPI specs, Postman collections, or curl commands.