Skills DirectorySecurity
Security skills for Claude Code and other coding agents
381 skills for finding and fixing vulnerabilities, ranked by installs.
Security skills fall into three groups. Hardening checklists tell the agent what to look for in its own output: injection, unsafe deserialisation, missing auth checks, secrets in code. Tooling skills teach a specific analyser such as CodeQL or Semgrep. Offensive skills, mostly from CTF collections, explain exploitation techniques so the agent can reason about an attack rather than guess.
security-and-hardening from addyosmani is the general checklist. secrets-management from wshobson covers vaults, rotation and keeping keys out of repositories. constant-time-analysis from Trail of Bits is an example of the narrow, expert kind. The ctf-web skill from ljagiello is the entry point to the offensive set.
This tag is noisy: the crawler also matches skills that mention "auth" because they call an authenticated API, such as the Google Workspace CLI set. Those are not security tools. And treat security skills like any other install: they run with your agent's permissions, so read the scripts.
Good first picks
60 of 381 skills shown, most installed first.
Search all 3893 skills- brandkit
leonxlnx/taste-skill
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.
- imagegen-frontend-mobile
leonxlnx/taste-skill
Elite mobile app image-generation skill for creating premium, app-native screen concepts and flows. Designed for iOS, Android, and cross-platform mobile products. Prioritizes clean hierarchy, comfortably readable text, strong multi-screen consistency, controlled color palettes, non-generic creative direction, textured surfaces, image-led composition, tasteful custom iconography, and clean phone mockup framing. By default, screens should be shown inside a subtle premium iPhone or similar phone mockup with a visible frame, while the main focus stays on the app content itself. This skill generates images only. It does not write code.
- archify
tt-a1i/archify
Create validated architecture, workflow, sequence, data-flow, lifecycle/state, entity-relationship, class/interface, tree, timeline, and execution waterfall diagrams as explorable standalone HTML with inline SVG, dark/light themes, optional motion, and image/SVG/WebM export. Accept plain-language requirements or Mermaid; inspect repository evidence for code-backed diagrams. Use when visualizing infrastructure, cloud/security networks, API calls, data pipelines, ETL/ELT, state machines, database schemas, class contracts, module hierarchies, incident/release histories, or request and agent-run timings. Also use for everyday subjects with steps, parts, relationships, or states: leave and travel plans, applications and approvals, renting conversations, money or document flows, and order progress. Not for numeric charts or dashboards.
- caveman-setup
JuliusBrussee/caveman
Wire a repository through the Caveman Cloud gateway so every LLM request is measured, with no behavior change. Use for "set up caveman" or adding LLM spend observability.
- gws-gmail
googleworkspace/cli
Gmail: Send, read, and manage email.
- gws-gmail-send
googleworkspace/cli
Gmail: Send an email.
- gws-drive
googleworkspace/cli
Google Drive: Manage files, folders, and shared drives.
- code-review-and-quality
addyosmani/agent-skills
Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch. Use when asked to review a diff or a pull request, even when the diff is pasted inline.
- security-and-hardening
addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
- sms
coreyhaines31/marketingskills
When the user wants to plan, build, or optimize SMS, MMS, or WhatsApp marketing — including welcome flows, abandoned cart texts, post-purchase, win-back, promotional sends, or transactional/auth SMS. Also use when the user mentions "SMS marketing," "text message campaigns," "SMS sequence," "SMS automation," "abandoned cart text," "post-purchase SMS," "Klaviyo SMS," "Postscript," "Attentive," "Twilio," "A2P 10DLC," "TCPA," "SMS compliance," "short code," "toll-free SMS," "MMS campaign," "should I do SMS," "SMS vs email," "WhatsApp marketing," "WhatsApp Business API," "WhatsApp templates," or "click-to-WhatsApp." For email sequences, see emails. For SMS copy framing, see copywriting. For opt-in popups that capture phone numbers, see popups.
- gws-calendar
googleworkspace/cli
Google Calendar: Manage calendars and events.
- gws-sheets
googleworkspace/cli
Google Sheets: Read and write spreadsheets.
- gws-docs
googleworkspace/cli
Read and write Google Docs.
- deprecation-and-migration
addyosmani/agent-skills
Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when migrating a database schema in production, such as renaming or dropping a column without downtime (expand/contract). Use when deciding whether to maintain or sunset existing code.
- doubt-driven-development
addyosmani/agent-skills
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
- ponytail-review
DietrichGebert/ponytail
Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.
- gws-sheets-read
googleworkspace/cli
Google Sheets: Read values from a spreadsheet.
- gws-docs-write
googleworkspace/cli
Google Docs: Append text to a document.
- gws-calendar-agenda
googleworkspace/cli
Google Calendar: Show upcoming events across all calendars.
- gws-drive-upload
googleworkspace/cli
Google Drive: Upload a file with automatic metadata.
- gws-calendar-insert
googleworkspace/cli
Google Calendar: Create a new event.
- gws-gmail-triage
googleworkspace/cli
Gmail: Show unread inbox summary (sender, subject, date).
- gws-sheets-append
googleworkspace/cli
Google Sheets: Append a row to a spreadsheet.
- gws-tasks
googleworkspace/cli
Google Tasks: Manage task lists and tasks.
- gws-slides
googleworkspace/cli
Google Slides: Read and write presentations.
- gws-forms
googleworkspace/cli
Read and write Google Forms.
- gws-gmail-read
googleworkspace/cli
Gmail: Read a message and extract its body or headers.
- gws-meet
googleworkspace/cli
Manage Google Meet conferences.
- ponytail-audit
DietrichGebert/ponytail
Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.
- ponytail-audit
DietrichGebert/ponytail
Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.
- gws-keep
googleworkspace/cli
Manage Google Keep notes.
- gws-gmail-watch
googleworkspace/cli
Gmail: Watch for new emails and stream them as NDJSON.
- ponytail-gain
DietrichGebert/ponytail
Show ponytail measured impact as a scoreboard: less code, less cost, more speed, from the agentic benchmark averages. One-shot display.
- gws-gmail-reply
googleworkspace/cli
Gmail: Reply to a message (handles threading automatically).
- ponytail-gain
DietrichGebert/ponytail
Show ponytail's measured savings (code, cost, speed) from the benchmark. One-shot display. Use for /ponytail-gain, "what does ponytail save", "ponytail impact".
- gws-gmail-forward
googleworkspace/cli
Gmail: Forward a message to new recipients.
- gws-workflow
googleworkspace/cli
Google Workflow: Cross-service productivity workflows.
- gws-chat
googleworkspace/cli
Google Chat: Manage Chat spaces and messages.
- gws-gmail-reply-all
googleworkspace/cli
Gmail: Reply-all to a message (handles threading automatically).
- gws-people
googleworkspace/cli
Google People: Manage contacts and profiles.
- gws-workflow-email-to-task
googleworkspace/cli
Google Workflow: Convert a Gmail message into a Google Tasks entry.
- gws-chat-send
googleworkspace/cli
Google Chat: Send a message to a space.
- gws-workflow-meeting-prep
googleworkspace/cli
Google Workflow: Prepare for your next meeting: agenda, attendees, and linked docs.
- firecrawl-dashboard-reporting
firecrawl/firecrawl-workflows
Pull metrics from analytics dashboards and internal web tools with Firecrawl browser. Use when the user needs dashboard reporting, cross-platform metric summaries, authenticated analytics extraction, date-range reports, or structured metrics from web dashboards.
- firecrawl-lead-gen
firecrawl/firecrawl-workflows
Generate structured lead lists from prospect databases and web directories with Firecrawl browser. Use for finding prospects by role, company type, industry, stage, location, technologies, or other criteria and exporting CRM-ready JSON or CSV.
- gws-workflow-standup-report
googleworkspace/cli
Google Workflow: Today's meetings + open tasks as a standup summary.
- gws-workflow-weekly-digest
googleworkspace/cli
Google Workflow: Weekly summary: this week's meetings + unread email count.
- firecrawl-knowledge-ingest
firecrawl/firecrawl-workflows
Ingest public or authenticated knowledge bases and docs portals with Firecrawl browser. Use for JS-heavy docs, login-gated portals, paginated help centers, support knowledge bases, or structured JSON/markdown extraction from documentation sites.
- gws-events
googleworkspace/cli
Subscribe to Google Workspace events.
- gws-events-renew
googleworkspace/cli
Google Workspace Events: Renew/reactivate Workspace Events subscriptions.
- gws-events-subscribe
googleworkspace/cli
Google Workspace Events: Subscribe to Workspace events and stream them as NDJSON.
- gws-workflow-file-announce
googleworkspace/cli
Google Workflow: Announce a Drive file in a Chat space.
- gws-admin-reports
googleworkspace/cli
Google Workspace Admin SDK: Audit logs and usage reports.
- persona-it-admin
googleworkspace/cli
Administer IT — monitor security and configure Workspace.
- gws-modelarmor
googleworkspace/cli
Google Model Armor: Filter user-generated content for safety.
- gws-modelarmor-create-template
googleworkspace/cli
Google Model Armor: Create a new Model Armor template.
- gws-classroom
googleworkspace/cli
Google Classroom: Manage classes, rosters, and coursework.
- gws-modelarmor-sanitize-prompt
googleworkspace/cli
Google Model Armor: Sanitize a user prompt through a Model Armor template.
- gws-modelarmor-sanitize-response
googleworkspace/cli
Google Model Armor: Sanitize a model response through a Model Armor template.
- best-practices
addyosmani/web-quality-skills
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
Index updated: 2026-10-17 · Content last reviewed: 2026-09-03