Gives security testers ready-made attack material for authorized work: fuzzing payloads, common password lists, sensitive-data patterns, exploit test files, and LLM safety test prompts. Pulled from SecLists and usable directly from an AI coding agent.
Claude Code
$ npx -y skills add Eyadkelleh/awesome-skills-security --agent claude-code
Codex
$ npx skills add Eyadkelleh/awesome-skills-security -a codex
Cursor
$ npx skills add Eyadkelleh/awesome-skills-security -a cursor
Gemini CLI
$ npx skills add Eyadkelleh/awesome-skills-security -a gemini-cli
GitHub Copilot
$ npx skills add Eyadkelleh/awesome-skills-security -a github-copilot
OpenCode
$ npx skills add Eyadkelleh/awesome-skills-security -a opencode
Windsurf
$ npx skills add Eyadkelleh/awesome-skills-security -a windsurf
A curated collection of security testing resources packaged as agent skills, available on skills.sh
Repository: Eyadkelleh/awesome-skills-security · skills.sh: Eyadkelleh/awesome-skills-security
This repository contains a curated collection of security testing resources from SecLists packaged as Agent Skills for use with Claude Code, Cursor, Codex, and 60+ other supported agents. These skills provide instant access to essential wordlists, payloads, patterns, and web shells for authorized security testing, penetration testing, CTF competitions, and security research.
The goal of this project is to provide organized, immediately accessible security testing resources that integrate seamlessly with AI agent workflows for:
The easiest way to get started is to install from the skills.sh directory using the open agent skills CLI:
# List all available skills in this repository
npx skills add Eyadkelleh/awesome-skills-security --list
# Install all 7 security skills
npx skills add Eyadkelleh/awesome-skills-security --skill '*' -y
# Install specific skills
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing --skill llm-testing -y
# Install to a specific agent (e.g. Cursor or Claude Code)
npx skills add Eyadkelleh/awesome-skills-security -a cursor -y
npx skills add Eyadkelleh/awesome-skills-security -a claude-code -y
# Install globally (available across all projects)
npx skills add Eyadkelleh/awesome-skills-security --skill '*' -g -y
Browse and discover this collection on skills.sh: skills.sh/Eyadkelleh/awesome-skills-security
After installing, verify the skills are available:
# List installed skills
npx skills list
# Or ask your agent to use a skill
"Use the security-fuzzing skill to show me SQL injection payloads"
Once installed, you'll have access to:
"No skills found"
Eyadkelleh/awesome-skills-securitynpx skills add Eyadkelleh/awesome-skills-security --list to verify discoverySKILL.md must have valid YAML frontmatter with name (lowercase, hyphens) and description"Skill not loading in agent"
.cursor/skills/)npx skills add Eyadkelleh/awesome-skills-security --skill <name> -yNeed help?
All skills live under skills/ and are discoverable by the skills.sh CLI. Each skill has a SKILL.md with name and description frontmatter.
| Skill ID | Description | Install command |
|---|---|---|
security-fuzzing | SQL, NoSQL, command injection, and LDAP fuzzing payloads | npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -y |
security-passwords | Curated password wordlists for authorized credential testing | npx skills add Eyadkelleh/awesome-skills-security --skill security-passwords -y |
security-patterns | API keys, credit cards, emails, and sensitive data patterns | npx skills add Eyadkelleh/awesome-skills-security --skill security-patterns -y |
security-payloads | XSS, XXE, template injection, and file upload payloads | npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -y |
security-usernames | Common username wordlists for enumeration | npx skills add Eyadkelleh/awesome-skills-security --skill security-usernames -y |
security-webshells | Web shell samples for detection and defensive testing | npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -y |
llm-testing | LLM bias, data leakage, alignment, and adversarial testing prompts | npx skills add Eyadkelleh/awesome-skills-security --skill llm-testing -y |
security-fuzzing)Essential fuzzing payloads for vulnerability testing
security-passwords)Curated password lists for authorized credential testing
security-patterns)Sensitive data patterns for security testing
security-payloads)Specialized attack payloads for testing
security-usernames)Common username wordlists
security-webshells)Web shell samples for detection and analysis
llm-testing)Comprehensive AI/ML security testing prompts
npx skills — the skills.sh install CLI)Install skills into your agent using the skills.sh ecosystem:
# See what's available
npx skills add Eyadkelleh/awesome-skills-security --list
# Install everything
npx skills add Eyadkelleh/awesome-skills-security --skill '*' -y
# Install to Cursor only
npx skills add Eyadkelleh/awesome-skills-security -a cursor --skill '*' -y
# Update installed skills later
npx skills update -y
Skills are installed to your agent's skills directory (e.g. .cursor/skills/ for Cursor, .claude/skills/ for Claude Code). Use -g for a global install available across all projects.
Clone and use directly:
git clone https://github.com/Eyadkelleh/awesome-skills-security.git
cd awesome-skills-security
Reference skills in your conversation with any supported agent:
"Use the security-fuzzing skill to help me test for SQL injection vulnerabilities"
"Show me common passwords from the security-passwords skill"
"Help me detect exposed API keys using the security-patterns skill"
"I need XSS payloads from the security-payloads skill"
Example 1: SQL Injection Testing
"I need to test a login form for SQL injection. Use the security-fuzzing skill to show me relevant payloads"
Example 2: Password Auditing
"Use the security-passwords skill to show me the most common weak passwords to test against our password policy"
Example 3: Code Review for Secrets
"Use the security-patterns skill to help me scan this codebase for exposed API keys and credentials"
Example 4: CTF Challenge
"I'm working on a web exploitation CTF challenge. Use the security-payloads skill to help me approach this"
Example 5: LLM Security Testing
# Test for AI model biases
"Use the llm-testing skill to help me test this AI model for gender bias"
# Check for data leakage vulnerabilities
"Use the llm-testing skill to test for data leakage and privacy issues in this LLM"
# Comprehensive AI safety audit
"I need to perform a red team assessment on this LLM. Use the llm-testing skill to show me prompts for bias detection, alignment testing, and adversarial resistance"
If you cloned the repository, access wordlists directly:
# Example: Load SQL injection payloads
with open('skills/security-fuzzing/references/Fuzzing/quick-SQLi.txt', 'r') as f:
sqli_payloads = f.read().splitlines()
# Example: Load common passwords
with open('skills/security-passwords/references/500-worst-passwords.txt', 'r') as f:
passwords = f.read().splitlines()
# Example: Use in security testing
for payload in sqli_payloads[:10]:
test_injection(target_url, payload)
SQL Injection Testing (Authorized)
1. Ask your agent to use the security-fuzzing skill
2. Request relevant payloads for your target database
3. Test in an authorized scope
4. Document all findings
CTF Challenge
1. Describe the challenge to your agent
2. Ask it to use security-payloads or security-fuzzing as needed
3. Access relevant wordlists from the skill references
Bug Bounty Hunting
1. Ask your agent to use the appropriate security skills for your target
2. Review scope and methodology
3. Use payloads and wordlists from the installed skills
4. Follow responsible disclosure practices
awesome-skills-security/
├── README.md # This file
└── skills/ # skills.sh compatible skill directories
├── security-fuzzing/
│ ├── SKILL.md # Skill metadata
│ └── references/ # SQL/NoSQL/Command injection
├── security-passwords/
│ ├── SKILL.md
│ └── references/ # Password wordlists
├── security-patterns/
│ ├── SKILL.md
│ └── references/ # API keys, sensitive data
├── security-payloads/
│ ├── SKILL.md
│ └── references/ # XSS, XXE, file upload
├── security-usernames/
│ ├── SKILL.md
│ └── references/ # Username wordlists
├── security-webshells/
│ ├── SKILL.md
│ └── references/ # Web shell samples
└── llm-testing/
├── SKILL.md
└── ... # LLM security test prompts
Stars on GitHub
View @eyadkelleh’s profileGives security testers ready-made wordlists, fuzzing payloads, sensitive data patterns and LLM test prompts for authorized penetration testing, bug bounty work and CTF challenges, so the agent can reach for them without you hunting them down.
@eyadkellehReverse engineer anything with agents, from app behavior down to native binaries.
@morlutoA skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
@zhaoxuya520Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
@mukul975Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
@guillaumemeyerInstall it with the command on its page. It includes llm-testing, security-fuzzing, security-passwords. Its skills do not fire on their own yet. Free and open source.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it