api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install SkillClaude Code Security skills :)
Flowy lists 2535 skills in the Security category for Claude Code, across 159 plugins. A skill is a folder of instructions an agent loads while you work. Every one here shows what is inside before you install, who wrote it, and whether it is Auto-invoked, meaning a FLOW.md router fires it as you prompt.
@zhaoxuya520Install Skillapk-reverse
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的…
@zhaoxuya520Install Skillattack-chain
Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillabusing-shadow-credent…
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials)…
@mukul975Install Skillachieving-cmmc-level-2…
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skillremove-ai-marks
Remove multi-vendor AI provenance marks: invisible Unicode (Layer A), statistical text watermarks via rewrite (Layer B, always…
@guillaumemeyerInstall Skill
ai-sdk-5
Vercel AI SDK patterns for the installed major (ui/package.json: `ai` 6.x, `@ai-sdk/react` 3.x). The skill name is historical;…
@prowler-cloudInstall Skilldjango-drf
Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions,…
@prowler-cloudInstall Skilldjango-migration-psql
Reviews Django migration files for PostgreSQL best practices specific to Prowler. Trigger: When creating migrations, running…
@prowler-cloudInstall Skillidapython
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API…
@mrexodiaInstall Skilllaravel-permission-dev…
Build and work with Spatie Laravel Permission features, including roles, permissions, middleware, policies, teams, and Blade…
@spatieInstall Skill
address-sanitizer
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or…
@trailofbitsInstall Skilladjudicate-regression
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
@trailofbitsInstall Skillaflpp
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation…
@trailofbitsInstall Skillannotating-variants
Annotates VCF variants and normalizes HGVS nomenclature with public, license-free annotators (Ensembl VEP REST,…
@maziyarpanahiInstall Skillask-openmed
Choose the first OpenMed workflow skill for an intake, privacy, extraction, exchange, or verification request using deterministic…
@maziyarpanahiInstall Skillassembling-fhir-bundle…
Package multiple FHIR R4 resources produced from OpenMed output into a single valid transaction Bundle ready to POST to an EHR,…
@maziyarpanahiInstall Skillagentic-app-audit
Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory…
@awarexoneInstall Skillargus
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin…
@awarexoneInstall Skillbb-methodology
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master…
@awarexoneInstall Skillagentic-app-audit
Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory…
@shuvonsecInstall Skillargus
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin…
@shuvonsecInstall Skillbb-methodology
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master…
@shuvonsecInstall Skillapk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx…
@elementalsoulsInstall Skillbb-local-toolkit
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS…
@elementalsoulsInstall Skillbb-methodology
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master…
@elementalsoulsInstall Skillcloud-saas-exposure
Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining…
@elementalsoulsInstall Skillcontinuous-exposure-mo…
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot…
@elementalsoulsInstall Skillemail-domain-security
Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the…
@elementalsoulsInstall Skillattacker-forwarding
Forward collected data to an explicitly attacker-controlled destination
@cisco-ai-defenseInstall Skillbase64-payload
Transform an integer with XOR and compile caller-provided source
@cisco-ai-defenseInstall Skillconfig-tunnel-exfil
Sync calendar events with an endpoint selected in configuration
@cisco-ai-defenseInstall Skill401-403-bypass-techniq…
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths.…
@yaklangInstall Skillactive-directory-acl-a…
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync…
@yaklangInstall Skillactive-directory-certi…
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template…
@yaklangInstall Skillshiro-attack-cli
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro…
@summersecInstall Skillguide
Guide for developing Go applications with github.com/lestrrat-go/jwx v4 — parse/sign JWTs, work with JWS/JWE/JWK, pick…
@lestrrat-goInstall Skilljwx-companion-bulk
Apply bulk operations across all jwx companion modules. Args: <instructions...>
@lestrrat-goInstall Skillrev-dex-dumper
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK,…
@p4nda0sInstall Skillrev-frida
Generate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at…
@p4nda0sInstall Skillrev-idapython
IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA,…
@p4nda0sInstall Skillguardian-cli
An enterprise-grade, AI-powered penetration testing automation CLI tool. Orchestrates multiple specialized AI agents (Planner,…
@zakirkunInstall Skillcc-safety-net
Operate CC Safety Net: explain why a command was blocked, triage false positives, configure custom rulebooks, manage agent CLI…
@kenryu42Install Skillrelease-notes
Generate and publish concise, evidence-based notes in the body of the latest existing GitHub Release. Use only when the user…
@kenryu42Install Skillcc-safety-net
Operate CC Safety Net: explain why a command was blocked, triage false positives, configure custom rulebooks, manage agent CLI…
@kenryu42Install Skillrelease-notes
Generate and publish concise, evidence-based notes in the body of the latest existing GitHub Release. Use only when the user…
@kenryu42Install SkillVibeSec-Skill
This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a…
@behiseccInstall Skill
hello_js_reverse_skill
通用 Web API 数据采集、Node.js/Python 协议调用与前端签名分析。 使用 Camoufox MCP 捕获请求、调试 Hook、分析混淆/JSVMP/WASM， 交付可验证的采集程序，支持分页、断点续采和接口改版回归。…
@whitenightshadowInstall Skillsast-analysis
Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack,…
@utkusenInstall Skillsast-businesslogic
Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack…
@utkusenInstall Skillsast-fileupload
Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites),…
@utkusenInstall Skill
claw-release
Release automation for Claw skills and website. Guides through version bumping, tagging, and release verification.
@prompt-securityInstall Skillclawsec-clawhub-checke…
ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.
@prompt-securityInstall Skillclawsec-feed
Security advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local…
@prompt-securityInstall Skill
analyze
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
@h-mmerInstall Skillautopilot
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes,…
@h-mmerInstall Skillbrain
Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted…
@h-mmerInstall Skillccpa
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis,…
@sushegaadInstall Skillcis-controls
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments,…
@sushegaadInstall Skillcmmc
Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense…
@sushegaadInstall SkillAuto-invoked
binary-triage
Performs initial binary triage by surveying memory layout, strings, imports/exports, and functions to quickly understand what a…
@cyberkaidaInstall SkillAuto-invoked
ctf-crypto
Solve CTF cryptography challenges by identifying, analyzing, and exploiting weak crypto implementations in binaries to extract…
@cyberkaidaInstall SkillAuto-invoked
ctf-pwn
Solve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for…
@cyberkaidaInstall Skill
code-audit
Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability…
@3stonebrotherInstall Skillapi-relay-audit
Use when auditing third-party AI API relays, LLM proxies, gateways, or resale APIs locally before trusting coding, tool, or…
@toby-bridgesInstall Skillohmycaptcha
Deploy, configure, validate, and integrate the OhMyCaptcha captcha-solving service. Use when working with YesCaptcha-style APIs,…
@shenhao-stuInstall Skillohmycaptcha-image
Generate product visuals, README banners, documentation illustrations, and architecture diagrams for OhMyCaptcha. Use when the…
@shenhao-stuInstall Skillimage-crop-rotate
Image processing skill for cropping images to 50% from center and rotating them 90 degrees clockwise. This skill should be used…
@instavmInstall Skillpdf-text-replace
Replace text in fillable PDF forms by updating form field values. This skill should be used when users need to update names,…
@instavmInstall Skillapktool
Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract…
@brownfinesecurityInstall Skillchipsec
Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and…
@brownfinesecurityInstall Skillffind
Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems.…
@brownfinesecurityInstall Skill
verified-agent-identit…
Know Your Agent (KYA). Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and…
@billionsnetworkInstall Skillaspire
Orchestrates Aspire distributed applications using the Aspire CLI for running, debugging, and managing distributed apps. USE FOR:…
@nikiforovallInstall Skillkeycloak-administratio…
Keycloak identity and access management (IAM) administration guidance — realm management, client configuration, authentication…
@nikiforovallInstall Skillkeycloak-auth-services
Implementation guide for Keycloak.AuthServices .NET library — authentication (JWT Bearer, OIDC, RFC 8414), authorization (RBAC,…
@nikiforovallInstall Skillemail-formatting
Markdown formatting conventions for email summary documents — heading depth, list style, line length, emoji policy, and a…
@provosInstall Skillgmail-query-syntax
Reference for Gmail's search query syntax — operators like is:sent, newer_than:, from:, has:attachment, label:, and how they…
@provosInstall Skillharness-design-fuzzing
Reference vocabulary for designing instrumented harnesses that drive vulnerability discovery — design classes (trigger-driven vs…
@provosInstall Skillcti-expert
Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence…
@7onezInstall Skillsemia
Audit an agent skill with Semia inside Claude Code. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this…
@berabuddiesInstall Skillai-threat-testing
Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities…
@transilienceaiInstall Skill2,439 more in Security. See them all →