owasp-top-10
OWASP Top 10:2025 security vulnerabilities. Covers access control, injection, supply chain, cryptographic failures, and more. Use for security reviews. USE…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-17 00:11
Security & auditing
7,112 results
Ethical Hacking Methodology
This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct…
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise…
alicloud-security-id-verification-cloudauth
Manage Alibaba Cloud ID Verification (Cloudauth) via OpenAPI/SDK. Use whenever the user is working on identity-verification resource operations, config…
google-cloud-scc-remediation
Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic…
auditing-terraform-infrastructure-for-security
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM…
alicloud-security-center-sas
Manage Alibaba Cloud Security Center (Sas) via OpenAPI/SDK. Use whenever the user needs Security Center resource operations, configuration updates, status…
Pentest Commands
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john",…
solana-security-standard
Use the SOL-0XX Solana security standard to scan, detect, and prevent 37 classes of Solana program vulnerabilities ($514M+ in real exploits) across AI tools,…
varlock
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are…
auth0-php-api
Use when protecting PHP API endpoints with JWT Bearer token validation or scope checks. Integrates auth0/auth0-php in API mode for stateless APIs receiving…
didit-id-document-verification
Verifies identity documents and digital ID wallets through Didit's standalone APIs. Use when an agent needs to verify a passport, ID card, driver's license or…
auditing-kubernetes-cluster-rbac
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account…
software-security-appsec
Reviews application security and guides AppSec design. Use when reviewing auth, authentication, authorization, sessions, data handling, supply chain, or AppSec…
php-codeigniter-audit
CodeIgniter framework feature security audit tool. Performs white-box static auditing of CodeIgniter mechanisms such as CSRF, XSS output filtering, database query construction, routing and validator configuration, and session cookie security, and maps them to a general vulnerability type system (CSRF/AUTH/XSS/SQL/CFG/SESS, etc.).
performing-csrf-attack-simulation
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized…
pii-redaction-logging-policy-builder
Prevents logging sensitive user data with redaction rules, logging policies, and safe log formatting. Use for "PII redaction", "log privacy", "GDPR logging",…
jellyfin-security-plugin
Add native two-factor authentication, passkeys, SSO, brute-force protection, and audit logging to Jellyfin media servers via server-side plugin.
skill-vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,…
sops-secret-access
Use when a repo stores tool config, API keys, registry URLs, environment variables, or component registry settings in SOPS-encrypted files such as…
supabase-evidence
Initialize and manage the evidence collection directory for professional security audits with documented proof of findings.
bug-bounty
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed…
secrets-env-manager
Validates environment variables in CI, prevents secret leaks, enforces masking, and provides fail-fast validation with clear documentation. Use for "secrets…
drm-pentesting-toolkit
Plugin-based DRM pentesting toolkit with GUI for device management, PSSH extraction, license key retrieval, and content downloading