Skip to content

Browse Secure Claude Skills

Search verified agent skills and review security grades before installing · full A–Z index

Cross Team CommB通过 Tailscale、SSH、Gateway API 与 sessions_send 实现跨团队、跨实例的 OpenClaw 协作通信。securitypythonbashVotes: 0GitHub stars: 2
Workspace MingjingA> **版本**：v2.0（增强版） > **角色**：明镜 (Ming Jing - The Aegis of Order) > **背景**：西南政法大学本科 + 哈佛法学院博士，盈科/四大经验 > **模式**：Skill Manifest（只引用，不承载内容） > **更新日期**：2026-05-01securityawssecurityVotes: 0GitHub stars: 2
Security AuditAAnalyze code for security vulnerabilities, potential attack vectors, and compliance with security best practices.securitygosqlVotes: 0GitHub stars: 3
Code SecurityACode security capability pack. Gives AI agents the judgment rules for SAST scanning (Semgrep), DAST testing (Nuclei), secret detection (Gitleaks/TruffleHog), IaC security linting (Checkov), and vulnerability triage (osv-scanner/Grype/Snyk). Research-grounded rules from tool documentation, OWASP guidelines, and real-world pipeline architecture. Use for any application security scanning, secret leak prevention, infrastructure hardening, or vulnerability prioritization task.securitygodockerVotes: 0GitHub stars: 3
Snyk TriageAValidate Snyk SAST / Code findings against repo evidence; emits per-finding verdicts (CONFIRMED / FALSE_POSITIVE / NEEDS_REVIEW / DUPLICATE / NOT_APPLICABLE). Use when a Snyk or Jira-exported scanner report is provided.securityapisecurityVotes: 0GitHub stars: 504
Entra Posture ReviewAReview a Microsoft Entra ID tenant's identity posture from read-only Graph exports, checking Conditional Access basics, security defaults, standing Global Administrators, guests with roles, stale guests, long-lived app secrets, high-risk Graph application permissions, consent and invitation settings and legacy sign-ins. Use when asked \"who are our Global Admins?\", to baseline a tenant, before an ISO 27001 or Essential Eight audit, or after taking one over. Not for Intune devices (intune-bas...securitypythonrustVotes: 0GitHub stars: 2
Self InstallerAAutomated installation and setup of THIS Secure Vibe Coding OS SaaS application. This skill installs the current application only. Use when user says "install app", "setup app", "install this app", "install from readme", or "run the installation". Automates Clerk authentication setup, Convex backend configuration, webhook setup, billing enablement, and application testing using Playwright browser automation.securitybashnodeVotes: 0GitHub stars: 2
Security TestingBTest security features and verify implementation before deployment. Use this skill when you need to test CSRF protection, rate limiting, input validation, verify security headers, run security audits, or check the pre-deployment security checklist. Triggers include "test security", "security testing", "verify security", "security checklist", "pre-deployment", "test CSRF", "test rate limit", "security verification".securityjavascriptgoVotes: 0GitHub stars: 2
Threat ModelingASecurity analysis and threat modeling prompt templates for STRIDE analysis, code review, OWASP compliance, and vulnerability assessment. Use for security planning, pre-deployment reviews, and ongoing threat assessment. Triggers include "STRIDE", "threat model", "security review", "code review", "OWASP", "payment security", "security analysis", "vulnerability assessment".securityrustgoVotes: 0GitHub stars: 2
Prompt EngineeringAComprehensive security prompt templates for implementing secure features with multiple security layers. Use for complex implementations like forms, authenticated endpoints, public APIs, admin features, file uploads, middleware composition, and security testing. Triggers include "secure form", "authenticated endpoint", "public endpoint", "admin action", "file upload", "composable middleware", "security testing", "new security control".securitytypescriptgoVotes: 0GitHub stars: 2
Built In ControlsASimple security prompt templates for quick implementations using existing Secure Vibe Coding OS utilities. Use for straightforward features like contact forms, authenticated updates, and public APIs. Triggers include "contact form", "simple form", "authenticated update", "user update", "public API", "read-only API", "quick secure implementation".securitytypescriptgoVotes: 0GitHub stars: 2
Auth AuthorizationAAuthentication and authorization prompt templates for RBAC implementation, permissions systems, ownership verification, and authorization testing. Use when setting up roles, implementing access control, or testing authorization logic. Triggers include "RBAC", "role-based access", "permissions", "ownership", "authorization", "access control", "user roles", "auth testing".securitytypescriptrustVotes: 0GitHub stars: 2
Security PromptsALibrary of battle-tested security prompt templates for secure feature implementation. Use when implementing forms, endpoints, authentication, authorization, file uploads, or conducting security reviews. Triggers include "security prompt", "secure form", "RBAC", "threat model", "STRIDE", "admin endpoint", "file upload", "security testing", "code review", "OWASP".securitytypescriptgoVotes: 0GitHub stars: 2
Security OverviewAUnderstand the defense-in-depth security architecture of Secure Vibe Coding OS. Use this skill when you need to understand the overall security approach, the 5-layer security stack, OWASP scoring, or when to use other security skills. Triggers include "security architecture", "defense in depth", "security layers", "how does security work", "OWASP score", "security overview", "security principles".securitytypescriptgoVotes: 0GitHub stars: 2
Security OperationsCOperational security guidance for deployment, monitoring, and maintenance. Use this skill when you need to understand which middlewares to apply, configure environment variables, monitor security post-deployment, or follow the pre-deployment checklist. Triggers include "security operations", "deployment security", "security monitoring", "environment variables", "when to use middleware", "pre-deployment", "security checklist", "production security".securitytypescriptbashVotes: 0GitHub stars: 2
Supply Chain RisksCUnderstand supply chain vulnerabilities and dependency risks in AI-generated code including outdated packages, malicious packages, and dependency confusion attacks. Use this skill when you need to learn about vulnerable dependencies in AI code, understand supply chain attacks, recognize typosquatting, or identify outdated package suggestions. Triggers include "supply chain attacks", "dependency vulnerabilities", "outdated packages", "malicious npm packages", "typosquatting", "dependency confu...securityjavascriptpythonVotes: 0GitHub stars: 2
Resource ExhaustionAUnderstand resource exhaustion and denial of service vulnerabilities in AI code including unbounded loops, missing rate limits, and uncontrolled resource consumption. Use this skill when you need to learn about DoS vulnerabilities in AI code, understand resource limits, recognize unbounded operations, or prevent resource exhaustion. Triggers include "resource exhaustion", "DoS vulnerabilities", "denial of service", "unbounded resources", "API cost protection", "memory exhaustion", "uncontroll...securityjavascripttypescriptVotes: 0GitHub stars: 2
Injection VulnerabilitiesDUnderstand how AI generates SQL injection, command injection, and XSS vulnerabilities. Use this skill when you need to learn about injection attack patterns in AI code, see real-world examples of injection vulnerabilities, understand why AI generates insecure database queries, or recognize vulnerable code patterns. Triggers include "SQL injection AI", "command injection", "XSS vulnerabilities", "injection attacks", "AI database queries", "shell injection", "cross-site scripting AI code".securityjavascripttypescriptVotes: 0GitHub stars: 2
Information LeakageAUnderstand how AI-generated code exposes sensitive information through hardcoded credentials and verbose logging. Use this skill when you need to learn about hardcoded secrets in AI code, understand logging vulnerabilities, recognize exposed API keys, or prevent information disclosure. Triggers include "hardcoded credentials", "hardcoded secrets", "API keys in code", "information leakage", "verbose logging", "exposed secrets", "AWS keys", "logging vulnerabilities", "sensitive data logs".securityjavascripttypescriptVotes: 0GitHub stars: 2
Business Logic FlawsAUnderstand business logic vulnerabilities in AI code including race conditions, integer overflow, and calculation errors that pass functional tests but create security holes. Use this skill when you need to learn about race conditions in AI code, understand integer overflow vulnerabilities, recognize business logic security flaws, or identify calculation errors. Triggers include "race conditions", "business logic vulnerabilities", "integer overflow", "race condition AI", "flash sale security"...securityjavascripttypescriptVotes: 0GitHub stars: 2