Skill catalog
408security agent skills synced from skills.sh, with their install counts. Read them here, or let your agent fetch the right one through the Graph-of-Skills MCP server.
Want your agent to use these? Set up Graph-of-Skills
or get a free key.
How these skills are sourced and what we check.
Cannot find one? Your agent can write a skill for your own library.
Have skills of your own? Install one on another machine.
A skill that comes from GitHub shows its npx skills add command on its page.
- claude-security anthropics/claude-plugins-official
Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each…
2,348 installs - experience-lwc-security-validate forcedotcom/sf-skills
Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (`.js`, `.ts`, `.html`, `.css`, `.js-meta.xml`) — the canonical LWS/Product-Security review for LWCs, NOT a g…
2,238 installs - github-actions-hardening github/awesome-copilot
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, pri…
2,169 installs - cc-skill-security-review sickn33/agentic-awesome-skills
This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Use when implementing authentication or authorization, handling user input or file uploads, or creat…
2,146 installs - find-exposed-servers useosint/skills
Find internet-exposed hosts, ports, services and devices using third-party internet-scan data instead of touching the target. Covers Shodan and Censys query syntax, service banners, favicon-hash and TLS-certificate pivo…
1,989 installs - rust-review trailofbits/skills
Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates,…
1,987 installs - codeql github/awesome-copilot
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow f…
1,977 installs - roblox-security tabooharmony/roblox-brain
Use when auditing or hardening Roblox code against exploits: authority, remotes, economy, purchases, and DataStore flows.
1,962 installs - who-owns-this-domain useosint/skills
Establish who registered and who operates a domain using WHOIS, RDAP and DNS. Use when running a whois lookup, querying RDAP, digging A, AAAA, MX, NS, TXT, SOA or CAA records, reading SPF includes, DKIM selectors or DMA…
1,925 installs - secops-triage google/skills
Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priorit…
1,909 installs - secops-investigate google/skills
Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performi…
1,908 installs - mapbox-token-security mapbox/mapbox-agent-skills
Security best practices for Mapbox access tokens, including scope management, URL restrictions, rotation strategies, and protecting sensitive data. Use when creating, managing, or advising on Mapbox token security.
1,906 installs - security cognitedata/builder-skills
MUST be used whenever fixing security issues in a Flows app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report…
1,903 installs - secops-cases google/skills
Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes; updating case priority…
1,901 installs - secops-hunt google/skills
Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events,…
1,901 installs - secops-detection-engineering google/skills
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing log…
1,894 installs - secrets-in-git-history useosint/skills
Mine GitHub, GitLab and git history for identities, infrastructure and leaked credentials using commit author emails, GitHub code search, the commit .patch endpoint, trufflehog, gitleaks, git log pickaxe and full-ref hi…
1,888 installs - aws-secrets-manager aws/agent-toolkit-for-aws
Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so pla…
1,863 installs - recon-a-domain-passively useosint/skills
End-to-end passive reconnaissance for a domain, website or IP — builds an asset inventory covering registration, DNS, subdomains, infrastructure, tech stack, history and ownership without sending a single packet to the…
1,836 installs - planetscale-postgres-safety-review planetscale/skills
Review PlanetScale Postgres for Traffic Control, query tags, roles, pg_strict, backups/PITR, private connectivity, webhooks, branches, and safe agent operation.
1,822 installs - hunt-a-handle useosint/skills
Enumerate a username across hundreds of platforms with sherlock, maigret and WhatsMyName, then correlate and confirm which accounts genuinely belong to the same person. Use for username OSINT and handle enumeration, "fi…
1,807 installs - whose-number-is-this useosint/skills
Investigate a phone number — E.164 normalisation with libphonenumber, phoneinfoga scanning, carrier and line-type identification, VoIP and burner detection, messaging-app registration checks, and reverse-lookup and call…
1,804 installs - mantis-threat-model google/mantis
Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't us…
1,795 installs - follow-the-crypto useosint/skills
Trace cryptocurrency addresses and transactions on public blockchains using block explorers including Etherscan, Blockchair, mempool.space and Blockscout. Covers common-input clustering, ENS resolution, exchange deposit…
1,790 installs - pentest-tools zhaoxuya520/reverse-skill
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
1,789 installs - find-hidden-subdomains useosint/skills
Enumerate an organisation's subdomains and sibling domains from Certificate Transparency logs and passive DNS, without sending traffic to the target. Covers crt.sh and CT log queries, certificate SAN fields, subfinder a…
1,749 installs - security-review sickn33/agentic-awesome-skills
No description provided.
1,727 installs - find-leaks-in-the-wild useosint/skills
Find leaked or mentioned selectors circulating in pastes, leak forums, Telegram channels and dump markets, and judge whether a claimed leak is genuine or a recycled combolist. Covers paste aggregators, site: searches ov…
1,714 installs - android-intent-security android/skills
Best practices for Android Intent security. Use this skill when auditing component configurations in AndroidManifest.xml activities, services, receivers) or source code handling incoming Intents (getIntent, getParcelabl…
1,698 installs - google-like-a-spy useosint/skills
Craft advanced search-engine queries and Google dorks to surface hidden files, documents and mentions. Covers site:, filetype:, inurl:, intitle:, intext: and before:/after: operators, verbatim search, exposed directory…
1,695 installs - owasp-security-check sergiodxa/agent-skills
Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production d…
1,692 installs - gdpr-compliant github/awesome-copilot
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing rete…
1,654 installs - anthropic-cybersecurity-skills reason-machines/security-skills
Use 754 structured cybersecurity skills mapped to MITRE ATT&CK, NIST CSF, ATLAS, D3FEND, and NIST AI RMF for AI-driven security operations
1,651 installs - shannon-ai-pentester reason-machines/trending-skills
Autonomous white-box AI pentester for web applications and APIs using source code analysis and live exploit execution
1,650 installs - apk-reverse zhaoxuya520/reverse-skill
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
1,641 installs - llm-security semgrep/skills
Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'c…
1,605 installs - jwt-security mindrally/skills
Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage
1,577 installs - mantis-summarize google/mantis
Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before t…
1,552 installs - convex-security-audit waynesutton/builder-skills
No description provided.
1,549 installs - threat-modeling-with-aws-security-agent aws/agent-toolkit-for-aws
Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or de…
1,546 installs - mantis-plan google/mantis
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (work…
1,545 installs - mantis-dedupe google/mantis
Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generatio…
1,533 installs - mantis-reproduce google/mantis
Generates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching.
1,525 installs - mantis-calibrate google/mantis
Calculates the final risk score based on empirical evidence and architectural impact. Use when findings have been fully processed by previous stages and you need to append final risk scores to the finding files. Don't u…
1,523 installs - pentesting-with-aws-security-agent aws/agent-toolkit-for-aws
Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtim…
1,523 installs - mantis-history google/mantis
Analyzes the repository's version control system (VCS) history to extract past vulnerabilities, security fixes, and vulnerability patterns. Use as an initial pre-processing step to build a historical vulnerabilities dat…
1,514 installs - agent-owasp-compliance github/awesome-copilot
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance chec…
1,513 installs - mantis-patch google/mantis
Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them. Use when security findings are successfully reproduced and need patches applied an…
1,513 installs - mantis-chain google/mantis
Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for…
1,507 installs - jwt-security-review securityskills/skills
Audit JSON Web Token implementations for algorithm confusion, weak secrets, missing validation, and token lifecycle flaws. Use when a codebase or API uses JWTs for auth.
1,501 installs