AI-agent-master-cyber-skills-list

In the author's own words, from each skill's SKILL.md — showing the first 30 of 751 files.

• building-adversary-infrastructure-tracking-system

  Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.

  skills/building-adversary-infrastructure-tracking-system/SKILL.md on GitHub (opens in a new tab)

• dependency-scanning

  Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.

  skills/dependency-scanning/SKILL.md on GitHub (opens in a new tab)

• implementing-infrastructure-as-code-security-scanning

  This skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses detecting misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before deployment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource pro…

  skills/implementing-infrastructure-as-code-security-scanning/SKILL.md on GitHub (opens in a new tab)

• implementing-mobile-application-management

  Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Acti…

  skills/implementing-mobile-application-management/SKILL.md on GitHub (opens in a new tab)

• implementing-ransomware-backup-strategy

  Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO requirements, implements backup credential isolation to prevent ransomware from compromising backup infrastructure, and establishes automated restore testing.…

  skills/implementing-ransomware-backup-strategy/SKILL.md on GitHub (opens in a new tab)

• implementing-secret-scanning-with-gitleaks

  This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.

  skills/implementing-secret-scanning-with-gitleaks/SKILL.md on GitHub (opens in a new tab)

• implementing-secrets-management-with-vault

  This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secret…

  skills/implementing-secrets-management-with-vault/SKILL.md on GitHub (opens in a new tab)

• implementing-supply-chain-security-with-in-toto

  Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.

  skills/implementing-supply-chain-security-with-in-toto/SKILL.md on GitHub (opens in a new tab)

• incident-response

  Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.

  skills/incident-response/SKILL.md on GitHub (opens in a new tab)

• penetration-testing

  Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.

  skills/penetration-testing/SKILL.md on GitHub (opens in a new tab)

• performing-deception-technology-deployment

  Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.

  skills/performing-deception-technology-deployment/SKILL.md on GitHub (opens in a new tab)

• None

  Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies ve

  skills/performing-web-application-scanning-with-nikto/SKILL.md on GitHub (opens in a new tab)

• securing-github-actions-workflows

  This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.

  skills/securing-github-actions-workflows/SKILL.md on GitHub (opens in a new tab)

• ai-agent-security

  Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

  skills/application-security/ai-agent-security/SKILL.md on GitHub (opens in a new tab)

• ai-red-teaming

  Run structured AI red team exercises for jailbreak resistance, data exfiltration risk, harmful output controls, and agent tool abuse resilience.

  skills/application-security/ai-red-teaming/SKILL.md on GitHub (opens in a new tab)

• ai-security-hardening

  Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks. Covers input validation, output filtering, access control, model API security, and compliance controls for production AI systems.

  skills/application-security/ai-security-hardening/SKILL.md on GitHub (opens in a new tab)

• burpsuite-project-parser

  Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

  skills/application-security/burpsuite-project-parser/SKILL.md on GitHub (opens in a new tab)

• codeql

  Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality suite) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models…

  skills/application-security/codeql/SKILL.md on GitHub (opens in a new tab)

• dast-scanning

  Perform dynamic application security testing with OWASP ZAP, Burp Suite, and Nikto. Test running applications for security vulnerabilities through automated and manual testing. Use when testing web applications, APIs, or performing penetration testing.

  skills/application-security/dast-scanning/SKILL.md on GitHub (opens in a new tab)

• differential-review

  Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.

  skills/application-security/differential-review/SKILL.md on GitHub (opens in a new tab)

• fastapi-security

  Use when assessing security for Python FastAPI applications. Focuses on Pydantic exploitation, dependency injection gaps, OpenAPI exposure, ASGI middleware security, and Python-specific vulnerabilities like template injection and SSRF.

  skills/application-security/fastapi-security/SKILL.md on GitHub (opens in a new tab)

• ffuf-web-fuzzing

  Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans, analyzing ffuf output, or building fuzzing strategies for web targets.

  skills/application-security/ffuf-web-fuzzing/SKILL.md on GitHub (opens in a new tab)

• firebase-apk-scanner

  Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.

  skills/application-security/firebase-apk-scanner/SKILL.md on GitHub (opens in a new tab)

• firebase-security

  Security assessment methodology for Google Firebase applications, covering Firestore, Realtime Database, Cloud Storage, and Cloud Functions.

  skills/application-security/firebase-security/SKILL.md on GitHub (opens in a new tab)

• fp-check

  Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.

  skills/application-security/fp-check/SKILL.md on GitHub (opens in a new tab)

• ghost-proxy

  Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by method/path/status/host, and inspecting full raw HTTP entries for security analysis. Use when the user asks to "start the proxy", "…

  skills/application-security/ghost-proxy/SKILL.md on GitHub (opens in a new tab)

• ghost-repo-context

  Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis.

  skills/application-security/ghost-repo-context/SKILL.md on GitHub (opens in a new tab)

• ghost-scan-code

  Ghost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for issues like SQL injection, XSS, BOLA, BFLA, SSRF, and other OWASP categories. Supports applications (backend, frontend, mobile) and libraries (prototype pollution, unsafe deserialization, ReDoS, path traversal, zip slip). Use when the user asks for a code security audit,…

  skills/application-security/ghost-scan-code/SKILL.md on GitHub (opens in a new tab)

• ghost-scan-deps

  Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or…

  skills/application-security/ghost-scan-deps/SKILL.md on GitHub (opens in a new tab)

• ghost-scan-secrets

  Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for credentials, find hardcoded API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.

  skills/application-security/ghost-scan-secrets/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 136k stars · 7 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 127k stars · 1 skill