클로드 코드와 코딩 에이전트용 보안 스킬
취약점을 찾고 고치는 스킬 381개, 설치 많은 순.
보안 스킬은 세 갈래입니다. 강화 점검표는 에이전트가 자기 결과물에서 무엇을 봐야 하는지 알려 줍니다. 인젝션, 안전하지 않은 역직렬화, 빠진 권한 확인, 코드에 박힌 비밀키 같은 것입니다. 도구 스킬은 CodeQL이나 Semgrep 같은 특정 분석기를 가르칩니다. 공격 스킬은 대부분 CTF 모음에서 왔으며, 에이전트가 추측 대신 공격을 추론할 수 있도록 익스플로잇 기법을 설명합니다.
addyosmani의 security-and-hardening이 일반 점검표입니다. wshobson의 secrets-management는 비밀 저장소, 키 교체, 저장소에 키가 들어가지 않게 하는 법을 다룹니다. Trail of Bits의 constant-time-analysis는 좁고 전문적인 종류의 예이고, ljagiello의 ctf-web은 공격 기법 묶음의 입구입니다.
이 카테고리는 잡음이 있습니다. 구글 워크스페이스 CLI 묶음처럼 인증된 API를 호출해서 "auth"를 언급하는 스킬도 함께 잡힙니다. 그런 것은 보안 도구가 아닙니다. 보안 스킬도 다른 설치와 똑같이 에이전트 권한으로 실행되니 스크립트를 읽어 보세요.
먼저 볼 만한 스킬
설치 많은 순으로 381개 중 60개 표시
스킬 3893개 전체 검색- brandkit
leonxlnx/taste-skill
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.
- imagegen-frontend-mobile
leonxlnx/taste-skill
Elite mobile app image-generation skill for creating premium, app-native screen concepts and flows. Designed for iOS, Android, and cross-platform mobile products. Prioritizes clean hierarchy, comfortably readable text, strong multi-screen consistency, controlled color palettes, non-generic creative direction, textured surfaces, image-led composition, tasteful custom iconography, and clean phone mockup framing. By default, screens should be shown inside a subtle premium iPhone or similar phone mockup with a visible frame, while the main focus stays on the app content itself. This skill generates images only. It does not write code.
- archify
tt-a1i/archify
Create validated architecture, workflow, sequence, data-flow, lifecycle/state, entity-relationship, class/interface, tree, timeline, and execution waterfall diagrams as explorable standalone HTML with inline SVG, dark/light themes, optional motion, and image/SVG/WebM export. Accept plain-language requirements or Mermaid; inspect repository evidence for code-backed diagrams. Use when visualizing infrastructure, cloud/security networks, API calls, data pipelines, ETL/ELT, state machines, database schemas, class contracts, module hierarchies, incident/release histories, or request and agent-run timings. Also use for everyday subjects with steps, parts, relationships, or states: leave and travel plans, applications and approvals, renting conversations, money or document flows, and order progress. Not for numeric charts or dashboards.
- caveman-setup
JuliusBrussee/caveman
Wire a repository through the Caveman Cloud gateway so every LLM request is measured, with no behavior change. Use for "set up caveman" or adding LLM spend observability.
- gws-gmail
googleworkspace/cli
Gmail: Send, read, and manage email.
- gws-gmail-send
googleworkspace/cli
Gmail: Send an email.
- gws-drive
googleworkspace/cli
Google Drive: Manage files, folders, and shared drives.
- code-review-and-quality
addyosmani/agent-skills
Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch. Use when asked to review a diff or a pull request, even when the diff is pasted inline.
- security-and-hardening
addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
- sms
coreyhaines31/marketingskills
When the user wants to plan, build, or optimize SMS, MMS, or WhatsApp marketing — including welcome flows, abandoned cart texts, post-purchase, win-back, promotional sends, or transactional/auth SMS. Also use when the user mentions "SMS marketing," "text message campaigns," "SMS sequence," "SMS automation," "abandoned cart text," "post-purchase SMS," "Klaviyo SMS," "Postscript," "Attentive," "Twilio," "A2P 10DLC," "TCPA," "SMS compliance," "short code," "toll-free SMS," "MMS campaign," "should I do SMS," "SMS vs email," "WhatsApp marketing," "WhatsApp Business API," "WhatsApp templates," or "click-to-WhatsApp." For email sequences, see emails. For SMS copy framing, see copywriting. For opt-in popups that capture phone numbers, see popups.
- gws-calendar
googleworkspace/cli
Google Calendar: Manage calendars and events.
- gws-sheets
googleworkspace/cli
Google Sheets: Read and write spreadsheets.
- gws-docs
googleworkspace/cli
Read and write Google Docs.
- deprecation-and-migration
addyosmani/agent-skills
Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when migrating a database schema in production, such as renaming or dropping a column without downtime (expand/contract). Use when deciding whether to maintain or sunset existing code.
- doubt-driven-development
addyosmani/agent-skills
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
- ponytail-review
DietrichGebert/ponytail
Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.
- gws-sheets-read
googleworkspace/cli
Google Sheets: Read values from a spreadsheet.
- gws-docs-write
googleworkspace/cli
Google Docs: Append text to a document.
- gws-calendar-agenda
googleworkspace/cli
Google Calendar: Show upcoming events across all calendars.
- gws-drive-upload
googleworkspace/cli
Google Drive: Upload a file with automatic metadata.
- gws-calendar-insert
googleworkspace/cli
Google Calendar: Create a new event.
- gws-gmail-triage
googleworkspace/cli
Gmail: Show unread inbox summary (sender, subject, date).
- gws-sheets-append
googleworkspace/cli
Google Sheets: Append a row to a spreadsheet.
- gws-tasks
googleworkspace/cli
Google Tasks: Manage task lists and tasks.
- gws-slides
googleworkspace/cli
Google Slides: Read and write presentations.
- gws-forms
googleworkspace/cli
Read and write Google Forms.
- gws-gmail-read
googleworkspace/cli
Gmail: Read a message and extract its body or headers.
- gws-meet
googleworkspace/cli
Manage Google Meet conferences.
- ponytail-audit
DietrichGebert/ponytail
Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.
- ponytail-audit
DietrichGebert/ponytail
Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.
- gws-keep
googleworkspace/cli
Manage Google Keep notes.
- gws-gmail-watch
googleworkspace/cli
Gmail: Watch for new emails and stream them as NDJSON.
- ponytail-gain
DietrichGebert/ponytail
Show ponytail measured impact as a scoreboard: less code, less cost, more speed, from the agentic benchmark averages. One-shot display.
- gws-gmail-reply
googleworkspace/cli
Gmail: Reply to a message (handles threading automatically).
- ponytail-gain
DietrichGebert/ponytail
Show ponytail's measured savings (code, cost, speed) from the benchmark. One-shot display. Use for /ponytail-gain, "what does ponytail save", "ponytail impact".
- gws-gmail-forward
googleworkspace/cli
Gmail: Forward a message to new recipients.
- gws-workflow
googleworkspace/cli
Google Workflow: Cross-service productivity workflows.
- gws-chat
googleworkspace/cli
Google Chat: Manage Chat spaces and messages.
- gws-gmail-reply-all
googleworkspace/cli
Gmail: Reply-all to a message (handles threading automatically).
- gws-people
googleworkspace/cli
Google People: Manage contacts and profiles.
- gws-workflow-email-to-task
googleworkspace/cli
Google Workflow: Convert a Gmail message into a Google Tasks entry.
- gws-chat-send
googleworkspace/cli
Google Chat: Send a message to a space.
- gws-workflow-meeting-prep
googleworkspace/cli
Google Workflow: Prepare for your next meeting: agenda, attendees, and linked docs.
- firecrawl-dashboard-reporting
firecrawl/firecrawl-workflows
Pull metrics from analytics dashboards and internal web tools with Firecrawl browser. Use when the user needs dashboard reporting, cross-platform metric summaries, authenticated analytics extraction, date-range reports, or structured metrics from web dashboards.
- firecrawl-lead-gen
firecrawl/firecrawl-workflows
Generate structured lead lists from prospect databases and web directories with Firecrawl browser. Use for finding prospects by role, company type, industry, stage, location, technologies, or other criteria and exporting CRM-ready JSON or CSV.
- gws-workflow-standup-report
googleworkspace/cli
Google Workflow: Today's meetings + open tasks as a standup summary.
- gws-workflow-weekly-digest
googleworkspace/cli
Google Workflow: Weekly summary: this week's meetings + unread email count.
- firecrawl-knowledge-ingest
firecrawl/firecrawl-workflows
Ingest public or authenticated knowledge bases and docs portals with Firecrawl browser. Use for JS-heavy docs, login-gated portals, paginated help centers, support knowledge bases, or structured JSON/markdown extraction from documentation sites.
- gws-events
googleworkspace/cli
Subscribe to Google Workspace events.
- gws-events-renew
googleworkspace/cli
Google Workspace Events: Renew/reactivate Workspace Events subscriptions.
- gws-events-subscribe
googleworkspace/cli
Google Workspace Events: Subscribe to Workspace events and stream them as NDJSON.
- gws-workflow-file-announce
googleworkspace/cli
Google Workflow: Announce a Drive file in a Chat space.
- gws-admin-reports
googleworkspace/cli
Google Workspace Admin SDK: Audit logs and usage reports.
- persona-it-admin
googleworkspace/cli
Administer IT — monitor security and configure Workspace.
- gws-modelarmor
googleworkspace/cli
Google Model Armor: Filter user-generated content for safety.
- gws-modelarmor-create-template
googleworkspace/cli
Google Model Armor: Create a new Model Armor template.
- gws-classroom
googleworkspace/cli
Google Classroom: Manage classes, rosters, and coursework.
- gws-modelarmor-sanitize-prompt
googleworkspace/cli
Google Model Armor: Sanitize a user prompt through a Model Armor template.
- gws-modelarmor-sanitize-response
googleworkspace/cli
Google Model Armor: Sanitize a model response through a Model Armor template.
- best-practices
addyosmani/web-quality-skills
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
색인 갱신: 2026-10-17 · 내용 최종 확인일: 2026-09-03