Best Security agent skills, page 2

Solana Vulnerability Scanner

trailofbits/skills

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.

Offensive Mobile

SnailSploit/Claude-Red

Mobile (Android + iOS) application penetration testing methodology.

Browser Cdp

zenstory-ai/oh-story-claudecode

Use this skill when you need to control a Chrome browser via CDP (Chrome DevTools Protocol) to reuse existing login sessions.

GitHub

TokenRhythm/opensquilla

GitHub operations via gh CLI: issues, PRs, CI runs, code review, API queries.

Audit Verify Explain Grade 5

MengTo/Skills

Audit work, verify claims with concrete evidence, and explain the result in simple grade-5 language.

Time Blocking Scheduler

iflytek/skillhub

Draft flexible daily or weekly schedules around a user's priorities, availability, energy patterns, and fixed commitments.

Hunt Ato

elementalsouls/Claude-BugHunter

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains.

Hunt Csrf

elementalsouls/Claude-BugHunter

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET…

Hunt LLM AI

elementalsouls/Claude-BugHunter

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).

Broken Authentication

zebbern/claude-code-guide

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password…

Pentest Commands

zebbern/claude-code-guide

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto"…

An

BuilderIO/skills

Open and operate Agent-Native workspace apps through Dispatch MCP, with inline app surfaces, browser-session authentication, and current screen state.

LinkedIn Post Writer

sergebulaev/linkedin-skills

Draft a new LinkedIn post from scratch using one of 20 2026 hook formulas (anaphora, R.I.P., time-anchor, curiosity-gap, contrarian, controlled A/B, false-binary, and more) plus a founders-edition…

LinkedIn Profile Optimizer

sergebulaev/linkedin-skills

Audit and rewrite a LinkedIn profile end-to-end for 2026: headline, About 7-step, Featured, banner, photo, Experience metrics, Skills, custom URL, recommendations.

Observal Admin

Observal/Observal

Administers Observal users, settings, diagnostics, review queues, security events, audit logs, SAML, SCIM, the local Observal server, its upgrades and rollback, and its own PostgreSQL and ClickHouse…

Backlink Audit

nowork-studio/notfair-plugin

Backlink / off-page SEO audit. Works WITHOUT a paid tool by default — it uses the Google Search Console Links report (your top linking sites, most-linked pages, and anchor text) plus any backlink…

Lean Ctx Review

yvgude/lean-ctx

Review how the lean-ctx ctx* MCP tools performed in the current session and file upstream issues for confirmed problems.

Criticism Self Criticism

HughYau/qiushi-skill

批评与自我批评：在工作完成、阶段验收、收到批评或同类错误反复出现时，对成果和过程做诚实、具体、基于事实的审视，输出可执行的改进项，并处理外来批评而不辩解。触发信号包括 review、复盘、审查、"帮我看看有没有问题"、"你确定吗"；任务刚开始或只是单步查询时不触发。 English: Criticism and self-criticism.

Pinme R2

glitternetwork/pinme

Use when a PinMe Cloudflare Worker needs R2 object storage, including secure file or image upload, streaming download, metadata lookup, deletion, listing, Range requests, or R2+D1 coordination.

Ctf Malware

ljagiello/ctf-skills

Provides malware analysis and network traffic techniques for CTF challenges.

Ctf Pwn

ljagiello/ctf-skills

Provides binary exploitation techniques for CTF challenges.

Omh Failure Signal Audit

rlaope/oh-my-hermes

[omh] Hidden or swallowed errors suspected: find swallowed errors, unsafe fallbacks, hidden UI/runtime failures, and missing propagation before they become false green status.

Loop Library

Forward-Future/loopy

Compatibility alias for Loopy. Use only when an existing installation or older instruction explicitly invokes loop-library; use Loopy for new installations and requests.

Loopy

Forward-Future/loopy

Discover, find, compare, audit, repair, adapt, craft, run, debrief, save, and prepare repeatable AI-agent loops for publication.

Comet Review

rpamis/comet

Manually review the implementation diff for the current Comet change.

J Space

Tiger3807861189/J-Space-Cognition-Suite

Operate a selective workspace for complex reasoning, long tasks, repository engineering, coordinated agents, and authorized security analysis.

Web Perf

cloudflare/skills

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

Orchestrator Container Spawn

samugit83/redamon

Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling.

Web Quality Audit

addyosmani/web-quality-skills

Run an evidence-led web quality audit covering performance, accessibility, SEO, best practices, and agentic browsing.

Performance

addyosmani/web-quality-skills

Optimize web performance for faster loading and better user experience.

AWS Security

aws/agent-toolkit-for-aws

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and…

AWS Auth

aws/agent-toolkit-for-aws

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.

Email Domain Security

elementalsouls/Claude-OSINT

Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone.

Osint Methodology

elementalsouls/Claude-OSINT

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

Skillshare

runkids/skillshare

Manage skills, agents, extras, hooks, plugins, and MCP connection settings with the Skillshare CLI.

Supabase

supabase/agent-skills

Use when doing ANY task involving Supabase.

Simple Formatter

cisco-ai-defense/skill-scanner

Formats text according to specified style guidelines.

Commissaire Aux Comptes

romainsimon/paperasse

Commissaire aux comptes IA pour l'audit des comptes annuels d'entreprises françaises.

Controleur Fiscal

romainsimon/paperasse

Inspecteur des finances publiques IA. Simule un contrôle fiscal DGFIP complet sur les comptes d'une entreprise française (SASU, EURL, SAS, SARL).

Agent Skills Platform

FrancyJGLisboa/agent-skills-platform

Create cross-platform agent skills from workflow descriptions.

Blog Audit

AgriciDaniel/claude-blog

Full-site blog health assessment scanning all blog files for quality scores, orphan pages, topic cannibalization, stale content, and AI citation readiness.

App Store Featured

appeeky/aso-skills

When the user wants to get featured on the App Store or understand the editorial process.

Agent Hierarchy

cbrock84/headcount

Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a…

Fastify Best Practices

mcollina/skills

Guides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript.

Einhorn Forensic Short

questflowai/investorskills

Use when evaluating David Einhorn-style forensic shorts and longs: accounting red flags, governance problems, capital allocation failures, and evidence-based short theses.

Integrate Harness

a5c-ai/babysitter

Use when adding a new agent harness (CLI-based coding agent) adapter to adapters.

Thinking Red Team

tjboudreaux/cc-thinking-skills

For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.

Agentlas Security Scan

agentlas-ai/Agentlas-OS

Use when an agent folder must pass the Agentlas Cloud 2-stage security scan (static rules + BYOK LLM judgment) before private sync or public publish, or when asked to run/interpret hephaestus…