prodsec-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 145 files.

• secdevai-fix

  Apply suggested security fixes from a prior code review. Use when the user wants to remediate security findings with before/after code diffs, severity filtering, and explicit approval before modifying code.

  experimental/secdevai-fix/SKILL.md on GitHub (opens in a new tab)

• secdevai-oci-image-security

  Analyze OCI container images for security vulnerabilities, misconfigurations, supply chain risks, and hardening gaps. Use when reviewing container images from Red Hat, Quay.io, Docker Hub, or any OCI-compliant registry. Covers CVE analysis, config security, EOL component detection, credential exposure, and TLS/crypto misconfigurations.

  experimental/secdevai-oci-image-security/SKILL.md on GitHub (opens in a new tab)

• secdevai-review

  Use when performing security code review of source files, git commits, or entire codebases against OWASP Top 10 (2021), CWE/SANS Top 25, and OWASP WSTG v4.2 patterns; applicable to any language or framework.

  experimental/secdevai-review/SKILL.md on GitHub (opens in a new tab)

• ai-code-review

  Security-focused review of AI-generated or AI-assisted code. Use when reviewing code produced by AI coding assistants, auditing AI-generated patches, verifying AI-assisted contributions before merge, or when a review needs to account for failure modes specific to AI code generation.

  ge-core/ai-code-review/SKILL.md on GitHub (opens in a new tab)

• ai-systems-security

  Secure AI-powered products and infrastructure. Use when integrating LLM APIs, deploying model-serving infrastructure, building agent workflows, connecting MCP servers, or reviewing AI system architecture for security gaps.

  ge-core/ai-systems-security/SKILL.md on GitHub (opens in a new tab)

• authentication

  Enforce standard authentication for external data source connections. Use when integrating, configuring, or reviewing connections from AI systems to external databases, APIs, or data services.

  ge-core/authentication/SKILL.md on GitHub (opens in a new tab)

• container-hardening

  Harden container images and runtime configuration. Use when building, reviewing, or auditing Containerfiles, Dockerfiles, container compose files, or Kubernetes pod security settings.

  ge-core/container-hardening/SKILL.md on GitHub (opens in a new tab)

• dependency-vulnerability-audit

  Supply chain security audit using CLI vulnerability scanners, license compliance checks, and supply chain risk assessment. Use when auditing project dependencies for known CVEs, license concerns, and supply chain health.

  ge-core/dependency-vulnerability-audit/SKILL.md on GitHub (opens in a new tab)

• input-validation-injection

  Apply when reviewing or writing code that processes untrusted input, constructs queries or commands, or handles user-supplied data. Covers SQL, LDAP, OS command injection, prototype pollution, and general validation strategy.

  ge-core/input-validation-injection/SKILL.md on GitHub (opens in a new tab)

• logging

  Enforce logging of access to sensitive external data sources in AI systems. Use when designing, building, or reviewing audit and logging capabilities for AI systems accessing external databases or data services.

  ge-core/logging/SKILL.md on GitHub (opens in a new tab)

• pod-access-control

  Configure Kubernetes RBAC bindings, service accounts, namespaces, resource quotas, and service types for pods. Use when writing, reviewing, or auditing Deployments, ServiceAccounts, Roles, RoleBindings, ResourceQuotas, or Services for least-privilege access control.

  ge-core/pod-access-control/SKILL.md on GitHub (opens in a new tab)

• scc-security

  Review OpenShift Security Context Constraints for correct privilege levels. Use when auditing pod security, reviewing SCC assignments, or configuring container runtime permissions on OpenShift clusters.

  ge-core/scc-security/SKILL.md on GitHub (opens in a new tab)

• secrets-detection-patterns

  Detect hardcoded secrets in source code using pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Use before committing, during code review, or for post-incident history scanning. Self-contained — no external tools required.

  ge-core/secrets-detection-patterns/SKILL.md on GitHub (opens in a new tab)

• secure-by-design

  Apply Secure by Design, by Default, and in Deployment (SD3) principles. Use when reviewing default configurations, setup processes, update mechanisms, or evaluating whether a system fails open or closed.

  ge-core/secure-by-design/SKILL.md on GitHub (opens in a new tab)

• web-application-security

  Review web application security controls against OWASP-aligned risks. Use when building, auditing, or reviewing server-side web applications that handle user input, sessions, authentication, or access control.

  ge-core/web-application-security/SKILL.md on GitHub (opens in a new tab)

• address-sanitizer

  AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C/C++ code to find buffer overflows and use-after-free bugs.

  module/skills/address-sanitizer/SKILL.md on GitHub (opens in a new tab)

• admin-interface-security

  Secure the administrative interface of model registries. Use when building, deploying, or reviewing model registry access controls and admin interfaces.

  module/skills/admin-interface-security/SKILL.md on GitHub (opens in a new tab)

• aflpp

  AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C/C++ projects.

  module/skills/aflpp/SKILL.md on GitHub (opens in a new tab)

• agent-identity

  Enforce that AI agents have their own identity separate from human users. Use when designing, building, or reviewing agent identity management, agent authentication, or agent permission models.

  module/skills/agent-identity/SKILL.md on GitHub (opens in a new tab)

• agent-to-agent-auth

  Enforce SPIFFE/SPIRE plus mTLS for agent-to-agent communication. Use when designing, building, or reviewing authentication between AI agents or multi-agent systems.

  module/skills/agent-to-agent-auth/SKILL.md on GitHub (opens in a new tab)

• agent-to-mcp-server-auth

  Enforce authentication for agents connecting to MCP servers via MCP clients. Use when designing or reviewing how AI agents authenticate to MCP servers.

  module/skills/agent-to-mcp-server-auth/SKILL.md on GitHub (opens in a new tab)

• agentic-actions-auditor

  Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlist…

  module/skills/agentic-actions-auditor/SKILL.md on GitHub (opens in a new tab)

• algorithm-selection

  Apply when selecting, reviewing, or configuring cryptographic algorithms, cipher suites, protocol versions, or key exchange mechanisms. Covers banned/deprecated/recommended algorithms, post-quantum readiness, key management, and OpenSSL API migration.

  module/skills/algorithm-selection/SKILL.md on GitHub (opens in a new tab)

• apache-camel-security

  Secure Apache Camel route deployments across endpoint, payload, route, and configuration layers. Use when building, reviewing, or auditing Camel routes, integration pipelines, or Camel-based microservices.

  module/skills/apache-camel-security/SKILL.md on GitHub (opens in a new tab)

• atheris

  Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.

  module/skills/atheris/SKILL.md on GitHub (opens in a new tab)

• audit-context-building

  Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

  module/skills/audit-context-building/SKILL.md on GitHub (opens in a new tab)

• authentication-enforcement

  Enforce authentication and authorization at the API gateway for AI systems. Use when designing, building, or reviewing API gateways that front inference engines, LLM APIs, or AI model endpoints.

  module/skills/authentication-enforcement/SKILL.md on GitHub (opens in a new tab)

• authorization

  Enforce authorization checks for external data source access in AI systems. Use when designing, configuring, or reviewing access controls between AI components and external databases or data services.

  module/skills/authorization/SKILL.md on GitHub (opens in a new tab)

• avoid-api-keys

  Avoid using API keys in production AI systems. Use when reviewing authentication mechanisms, designing production deployments, or auditing credential management in AI and agentic systems.

  module/skills/avoid-api-keys/SKILL.md on GitHub (opens in a new tab)

• aws-security

  Enforce AWS security baselines for IAM, networking, logging, and managed services like RDS. Use when building, reviewing, or auditing AWS infrastructure, IAM policies, VPC configuration, or RDS deployments.

  module/skills/aws-security/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• superpowersby obra An agentic skills framework & software development methodology that works. 300k stars · 15 skills
• skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory. 293k stars · 30 skills
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• skillsby anthropics Public repository for Agent Skills 181k stars · 19 skills