security AI Agent Skills

securityclawhubmalware-detection

clawdex by Koi

1.8k

openclaw

Security check for ClawHub skills powered by Koi. Query the Clawdex API before installing any skill to verify it's safe.

electron-ipc-security-audit

Analyze Electron IPC implementations for security vulnerabilities including contextIsolation, nodeIntegration, preload scripts, and channel validation

electronsecurityipc+2

electron-main-preload-generator

electrondesktopsecurity+2

Generate secure main process and preload script boilerplate with proper context isolation, IPC patterns, and security best practices for Electron applications

linux-gpg-signing

Sign Linux packages with GPG keys for secure distribution

linuxgpgsigning+2

sandbox-entitlements-auditor

securitysandboxentitlements+2

Audit and recommend minimal sandbox entitlements for secure desktop applications

macos-codesign-workflow

macoscodesigningdeveloperid+2

Execute macOS code signing with Developer ID and hardened runtime requirements

macos-entitlements-generator

macosentitlementssandbox+2

Generate entitlements.plist with appropriate sandbox capabilities for macOS applications

keychain-credential-manager

securitycredentialskeychain+2

Manage credentials in OS keychains across Windows, macOS, and Linux

ev-certificate-validator

A5c Ai Babysitter Ev Certificate Validator

Validate EV code signing certificate chain and timestamp for Windows SmartScreen

windowscodesigningev-certificate+2

windows-authenticode-signer

windowscodesigningauthenticode+2

Sign Windows executables with Authenticode using signtool, supporting EV and standard certificates

Waynesutton Convexskills Convex Security Audit

convex-security-audit

339

Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

convexsecurityaudit+3

Waynesutton Convexskills Convex Security Check

convex-security-check

339

Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

convexsecurityauthentication+2

orchestrationhookslifecycle+5

hooks-system

241

MadAppGang

Comprehensive lifecycle hook patterns for Claude Code workflows. Use when configuring PreToolUse, PostToolUse, UserPromptSubmit, Stop, or SubagentStop hooks. Covers hook matchers, command hooks, prompt hooks, validation, metrics, auto-formatting, and security patterns. Trigger keywords - "hooks", "PreToolUse", "PostToolUse", "lifecycle", "tool matcher", "hook template", "auto-format", "security hook", "validation hook".

141 days ago

audit

241

MadAppGang

On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".

devauditsecurity+2

github-workflow-automation

githubgithub-actionsci-cd+4

Advanced GitHub Actions workflow automation with AI swarm coordination, intelligent CI/CD pipelines, and comprehensive repository management

qe-security-testing

Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.

securityowaspsast+4

qe-n8n-security-testing

Credential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n workflow security.

n8nsecuritycredentials+4

qcsd-cicd-swarm

QCSD Verification phase swarm for CI/CD pipeline quality gates using regression analysis, flaky test detection, quality gate enforcement, and deployment readiness assessment. Consumes Development outputs (SHIP/CONDITIONAL/HOLD decisions, quality metrics) and produces signals for Production monitoring.

qcsdverificationcicd+11

n8n Security Testing

Detect credential exposure, validate OAuth flows, test API key management, and verify data sanitization for n8n workflows. Use this when validating n8n workflow security.

n8nsecuritycredentials+4

security-testing

Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.

securityowaspsast+4

qcsd-development-swarm

QCSD Development phase swarm for in-sprint code quality assurance using TDD adherence, code complexity analysis, coverage gap detection, and defect prediction. Consumes Refinement outputs (BDD scenarios, SFDIPOT priorities) and produces signals for Verification.

qcsddevelopmenttdd+9

security-visual-testing

securityvisual-testingpii+4

Security-first visual testing combining URL validation, PII detection, and visual regression with parallel viewport support. Use when testing web applications that handle sensitive data, need visual regression coverage, or require WCAG accessibility compliance.

qe-security-visual-testing

securityvisual-testingpii+4

fastapijwtauthentication+2

api-jwt-authenticator

188

aiskillstore

A conceptual skill for securing FastAPI REST APIs with JWT authentication

securitynetworkisolation+2

network-security-setup

132

Microck

Configure Claude Code sandbox network isolation with trusted domains, custom access policies, and environment variables

code-reviewsecurityperformance+2

code-review

127

femto

Performs thorough code reviews with focus on best practices, security, performance, and maintainability. Use this skill when reviewing pull requests, auditing code quality, or getting feedback on implementations.

security-patterns

securityauthenticationauthorization+7

Security patterns for authentication, defense-in-depth, input validation, OWASP Top 10, LLM safety, and PII masking. Use when implementing auth flows, security layers, input sanitization, vulnerability prevention, prompt injection defense, or data redaction.

audit-full

securityarchitectureaudit+3

Full-codebase audit using 1M context window. Security, architecture, and dependency analysis in a single pass. Use when you need whole-project analysis.

review-pr

code-reviewpull-requestquality+2

PR review with parallel specialized agents. Use when reviewing pull requests or code.

mcp-patterns

MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, adding authentication, creating interactive UIs, hardening MCP security, or debugging MCP integrations.

mcpservertools+7

environment-variablesdeploymentsecurity+4

env-manager

bobmatnyc

Environment variable validation, synchronization, and management across local development, CI/CD, and deployment platforms

AIMDS

ruvnet

AI Manipulation Defense System implementation with Midstream, AgentDB, and lean-agentic

securityai-defenserust+3

API Fuzzing

API endpoint fuzzing for discovering unexpected behaviors, crashes, and security vulnerabilities through malformed requests, boundary values, and protocol violations.

apifuzzingrest+2

API Rate Limiting Testing

rate-limitingapithrottling+2

Testing API rate limiting implementations including throttling behavior, burst handling, rate limit headers, and distributed rate limiting patterns.

XSS Testing Patterns

xsssecurityweb-security+2

Cross-site scripting vulnerability testing covering reflected, stored, and DOM-based XSS with sanitization validation and CSP bypass detection.

Security Threat Modeling

threat-modelsecurityappsec+2

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations to produce actionable AppSec-grade threat models.

Code Review Excellence

code-reviewquality-assurancefeedback+4

Master code review best practices with constructive feedback patterns, quality assurance standards, review checklists, security considerations, and collaborative improvement techniques for high-quality software delivery.

OWASP ZAP Security Scanner

Automated web application security scanning using OWASP ZAP for finding XSS, SQL injection, CSRF, and other OWASP Top 10 vulnerabilities.

zapowaspsecurity+2

JWT Security Testing

jwtsecurityauthentication+2

Comprehensive JWT token security testing including signature verification, expiration checks, algorithm confusion attacks, and claim validation.

Semgrep SAST Analysis

Static application security testing using Semgrep for finding vulnerabilities, code smells, and enforcing security policies across codebases.

semgrepsastsecurity+2

OAuth2 Security Testing

oauthsecurityauthentication+2

Security testing for OAuth2 implementations including authorization code flow, PKCE, token handling, redirect URI validation, and scope enforcement.

Secret Detection & Prevention

secret-detectionsecuritygitleaks+2

Automated detection and prevention of leaked secrets, API keys, passwords, and tokens in code using tools like gitleaks, trufflehog, and pre-commit hooks.

CodeQL Security Analysis

Advanced security analysis using GitHub CodeQL to find zero-day vulnerabilities, injection flaws, and security anti-patterns in source code.

codeqlsecuritygithub+2

Security Ownership Map

securityownershipbus-factor+2

Analyze git repositories to build security ownership topology, compute bus factor for sensitive code, detect orphaned security-critical files, and export ownership graphs for visualization.

BurpSuite Security Testing

burpsuitesecuritypentest+2

Web application security testing using BurpSuite for proxy-based interception, scanning, and manual penetration testing of web applications.

SOC 2 Compliance Testing

Testing SOC 2 compliance controls including security monitoring, change management, access reviews, and incident response procedures.

soc2compliancesecurity+2

OWASP Security Testing

Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication, and authorization testing.

owaspsecurityzap+3