security-skills-claude-code

In the author's own words, from each skill's SKILL.md.

• cti-domain-research

  Search for threat intelligence, CVEs, malware analysis, breach reports, and security research across 300+ curated security domains (BleepingComputer, Hacker News, Krebs, Unit42, Talos, CISA, Mandiant, Rapid7, Securelist, etc.). Use this skill whenever the user asks to: research a CVE or vulnerability, find what security vendors are saying about a threat actor or malware family, search security bl…

  plugins/phoenix-cti-search/skills/cti-domain-research/SKILL.md on GitHub (opens in a new tab)

• notebooklm

  Use this skill to query your Google NotebookLM notebooks directly from Claude Code for source-grounded, citation-backed answers from Gemini. Browser automation, library management, persistent auth. Drastically reduced hallucinations through document-only responses.

  plugins/phoenix-docs-research/skills/notebooklm/SKILL.md on GitHub (opens in a new tab)

• phoenix-research-pipeline

  Automated research pipeline for Phoenix Security: searches YouTube (yt-dlp), web (Brave API + Scrapling fallback), and Reddit for trending content on any security topic, then pushes curated results into Google NotebookLM with Phoenix-branded analysis prompts (blog, slide deck, video script). Use this skill whenever the user says "research [topic]", "find trending videos on [X]", "push to Notebook…

  plugins/phoenix-docs-research/skills/phoenix-research-pipeline/SKILL.md on GitHub (opens in a new tab)

• project-documenter

  Generate production-grade documentation for any software project. Supports five modes: (0) Express — full pack in one run for new projects; (1) General — README, API docs, modules, changelog; (2) AI/LLM — PROMPTS, LLM_ARCHITECTURE, MODEL_GUARDRAILS, AGENT_WORKFLOWS, AI_RUNBOOK; (3) Architecture — SYSTEM_OVERVIEW, RUNTIME_FLOWS, DATA_CONTRACTS, DEPENDENCY_MAP; (4) Full — all modes with existing-do…

  plugins/phoenix-docs-research/skills/project-documenter/SKILL.md on GitHub (opens in a new tab)

• phoenix-ambiguity-hunter

  Role 05 of the Phoenix Security spec pipeline. Red-teams normative requirements for Phoenix-specific failure modes: multi-tenant isolation gaps, vague integration surface definitions, AI agent safety holes (PSC-08), missing auth controls (PSC-06), reachability vs CVSS conflicts, RFC 2119 drift, competitor brand exposure, and requirements that will cause incorrect code generation or missed securit…

  plugins/phoenix-prd-pipeline/skills/phoenix-ambiguity-hunter/SKILL.md on GitHub (opens in a new tab)

• phoenix-batch-planner

  Role 09 of the Phoenix Security spec pipeline. Slices a Phoenix Security feature into safe, incremental batches sized for a 12-person team (1–3 engineer-days each), with P0 security requirements always in Batch 1, API contracts before consumers, integrations last, explicit rollback strategies for irreversible steps, AI gate flags for LLM-touching batches, and a Cursor plan summary for direct drop…

  plugins/phoenix-prd-pipeline/skills/phoenix-batch-planner/SKILL.md on GitHub (opens in a new tab)

• phoenix-constraint-distiller

  Role 03 of the Phoenix Security spec pipeline. Distils SCOPE_DEFINITION into an ACTIVE_SET of 8–15 compact, testable constraints that govern all downstream requirements — drawing from Phoenix's 12 Standing Constraints (PSC-01 through PSC-12) covering AWS/GCP infra split, 12-person team capacity, multi-tenant isolation, integration surface, AI agent safety posture, and compliance hooks. Use this s…

  plugins/phoenix-prd-pipeline/skills/phoenix-constraint-distiller/SKILL.md on GitHub (opens in a new tab)

• phoenix-context-curator

  Role 01 of the Phoenix Security spec pipeline. Cleans raw input — notes, tickets, Slack threads, customer call transcripts — into a structured CLEAN_CONTEXT block of FACTS, DECISIONS, and OPEN_QUESTIONS, tagged with Phoenix domain vocabulary, customer account labels (Mimecast, Johnson Matthey, Anaplan), and competitor flags. Use this skill when starting a new Phoenix spec, processing raw feature…

  plugins/phoenix-prd-pipeline/skills/phoenix-context-curator/SKILL.md on GitHub (opens in a new tab)

• phoenix-contract-architect

  Role 07 of the Phoenix Security spec pipeline. Turns Phoenix Security requirements into precise implementable contracts: REST API endpoints with Phoenix auth patterns, tenant isolation invariants, cursor-based pagination (for 100K+ vuln record volumes), standard response envelopes, event schemas with idempotency keys, shared types, and a full error taxonomy using Phoenix's numeric error code rang…

  plugins/phoenix-prd-pipeline/skills/phoenix-contract-architect/SKILL.md on GitHub (opens in a new tab)

• phoenix-final-gate

  Role 10 of the Phoenix Security spec pipeline. Makes the final SHIP / NO_SHIP decision for a Phoenix Security feature spec by checking 8 hard blockers: critical ambiguities remaining, unverified MUSTs, multi-tenant isolation gaps (PSC-03), auth layer coverage (PSC-06), AI agent safety violations (PSC-08), scope creep vs SCOPE_DEFINITION, P0 security not in Batch 1, and active enterprise account r…

  plugins/phoenix-prd-pipeline/skills/phoenix-final-gate/SKILL.md on GitHub (opens in a new tab)

• phoenix-orchestrator

  Run the full Phoenix Security spec pipeline (roles 01–10) from raw context to a ship-ready PRD — automatically chaining context curation, scope cutting, constraint distillation, requirements engineering, ambiguity hunting, security threat modelling, contract design, verification mapping, batch planning, and final gate review. Use this skill whenever someone says "run the spec pipeline", "build a…

  plugins/phoenix-prd-pipeline/skills/phoenix-orchestrator/SKILL.md on GitHub (opens in a new tab)

• phoenix-pipeline-navigator

  Interactive guide and launcher for the Phoenix Security spec pipeline. Asks where you are in the process, what you want to do next, and routes you to the right skill with the correct inputs. Use this skill whenever someone says "where do I start", "what should I do next", "help me with the pipeline", "I have some notes what do I do", "which skill do I need", "I'm stuck on the spec", "pipeline hel…

  plugins/phoenix-prd-pipeline/skills/phoenix-pipeline-navigator/SKILL.md on GitHub (opens in a new tab)

• phoenix-requirements-engineer

  Role 04 of the Phoenix Security spec pipeline. Converts Phoenix Security feature intent into testable RFC 2119 requirements with structured IDs (R-FUNC, R-SEC, R-REL, R-INT, R-PERF, R-UX, R-DX, R-COMP), P0/P1/P2 priorities, and full traceability to active constraints. Covers functional, integration (GitHub AS, Snyk, Qualys, Wiz, Jenkins, Backstage), reliability, performance, UX/DX, and compliance…

  plugins/phoenix-prd-pipeline/skills/phoenix-requirements-engineer/SKILL.md on GitHub (opens in a new tab)

• phoenix-scope-cutter

  Role 02 of the Phoenix Security spec pipeline. Converts CLEAN_CONTEXT into an explicit, minimal SCOPE_DEFINITION — goals, non-goals, in/out boundaries, assumptions, success metrics, and gating questions — anchored to Phoenix's product pillars and 12-person team constraints. Use this skill when you have a cleaned context block and need to define what the feature actually is and isn't, prevent scop…

  plugins/phoenix-prd-pipeline/skills/phoenix-scope-cutter/SKILL.md on GitHub (opens in a new tab)

• phoenix-security-engineer

  Role 06 of the Phoenix Security spec pipeline. Produces a threat model and security requirements grounded in Phoenix Security's actual architecture: 6 trust boundaries (tenant↔platform, platform↔integrations, platform↔AI/LLM, platform↔CI/CD, platform↔AWS, CTI↔GCP), high-value asset inventory (vuln data, API keys, reachability results, SBOM, AI I/O, board reports), MITRE ATT&CK technique mapping,…

  plugins/phoenix-prd-pipeline/skills/phoenix-security-engineer/SKILL.md on GitHub (opens in a new tab)

• phoenix-verification-matrix

  Role 08 of the Phoenix Security spec pipeline. Maps every MUST/MUST NOT to a concrete proof method using Phoenix's proof type hierarchy: unit-test, integration-test, contract-test, static-analysis, infra-check, load-test, manual-review. Enforces that security requirements use static-analysis + unit-test minimum, multi-tenancy requirements use integration-test, AI agent requirements use manual-rev…

  plugins/phoenix-prd-pipeline/skills/phoenix-verification-matrix/SKILL.md on GitHub (opens in a new tab)

• prd-generator

  Generate a full security-focused PRD (Product Requirements Document) from a plain-language feature description. Use this skill whenever someone wants to create a PRD, product spec, feature spec, requirements document, or says things like "write a PRD for", "create a spec for", "plan this feature", "document this feature", or "I need a requirements doc". The skill produces: (1) a structured PRD in…

  plugins/phoenix-prd-pipeline/skills/prd-generator/SKILL.md on GitHub (opens in a new tab)

• plan-readiness-review

  Adversarial senior/staff-engineer review of a PRD, plan, spec, RFC, design doc, or implementation plan to decide whether it is implementation-ready — detailed enough that a different senior engineer could build it without inventing requirements, architecture, schemas, API contracts, error handling, or acceptance criteria. Produces a requirement inventory with stable IDs, a per-requirement readine…

  plugins/phoenix-readiness-reviews/skills/plan-readiness-review/SKILL.md on GitHub (opens in a new tab)

• production-readiness-review

  Adversarial senior/staff-engineer review that verifies a real codebase against its PRD, plan, or implementation plan and decides whether it is genuinely complete and production ready — never trusting the plan, the changelog, or the commit messages. Runs a deterministic repo scan, traces every requirement end-to-end through UI, API, service, persistence, jobs, config, migrations and deploy, checks…

  plugins/phoenix-readiness-reviews/skills/production-readiness-review/SKILL.md on GitHub (opens in a new tab)

• opengrep-rule-generator-research

  Use when the user wants to research vulnerabilities and create opengrep/semgrep SAST rules, conduct security research on CVEs or CWEs with web search, generate detection rules from vulnerability analysis, or build comprehensive security scanning coverage for a codebase.

  plugins/phoenix-sast-rules/skills/opengrep-rule-generator-research/SKILL.md on GitHub (opens in a new tab)

• opengrep-rule-generator

  Use when the user wants to create opengrep/semgrep SAST rules, detect vulnerabilities in code, generate security scanning rules from CVEs or vulnerability descriptions, or asks about writing pattern-matching or taint-analysis rules for static analysis.

  plugins/phoenix-sast-rules/skills/opengrep-rule-generator/SKILL.md on GitHub (opens in a new tab)

• 0day-scanner

  LLM-powered zero-day vulnerability analysis of code changes — a commit, a pull request, a file or a branch — in light, standard or deep mode, with cost budgeting and knowledge-graph linking. Use whenever someone asks to scan for vulnerabilities, check for security issues, mentions 0-day or zero-day, or wants a specific commit, PR, diff or branch reviewed for security. Prefers the `analyze_for_zer…

  plugins/phoenix-security-review/skills/0day-scanner/SKILL.md on GitHub (opens in a new tab)

• security-assessment

  Comprehensive OWASP Top 10 2025 and ASVS Level 1 security assessment across a whole codebase, with cost budgeting, knowledge-graph linking and automated test generation. Use whenever someone asks to run a security assessment, a security audit, a security check or a vulnerability assessment; mentions OWASP Top 10 or ASVS; or wants a full security pass before a release. Prefers the `run_security_as…

  plugins/phoenix-security-review/skills/security-assessment/SKILL.md on GitHub (opens in a new tab)

• security-reviewer

  Multi-language security review for web apps, APIs, and CLIs. Use whenever code is added or modified — new endpoints, auth/RBAC changes, template or DOM rendering, outbound HTTP, dependency updates, IaC/config changes, or end-of-feature reviews. Covers Python, JavaScript, TypeScript, Go, Rust, Java/Kotlin, Ruby, C#/.NET, plus shared OWASP Top 10 and ASVS L1 logic. Triggers on phrases like "securit…

  plugins/phoenix-security-review/skills/security-reviewer/SKILL.md on GitHub (opens in a new tab)

• threat-modeling

  Automated STRIDE and DREAD threat modelling from code analysis. Extracts architecture, data flows, entry points and trust boundaries, then produces ranked threats, attack scenarios, mitigations and compliance-ready documentation. Use for security assessment, architecture review, compliance documentation and attack-scenario planning, or whenever someone says threat model this, STRIDE, DREAD, attac…

  plugins/phoenix-security-review/skills/threat-modeling/SKILL.md on GitHub (opens in a new tab)

• tm-quick-security-assessment

  The QUICK tier. Scope to a git worktree/branch and assess only what changed against a base — a fast, threat-model-aware pre-merge security pass (attack-surface delta + OWASP Top 10 on changed files) with the trust-direction gate applied. Composes the security-assessment + 0day-scanner (light) skills. Use for "quick security assessment on this branch", pre-merge review of a worktree/diff, or a fas…

  plugins/phoenix-security-review/skills/tm-quick-security-assessment/SKILL.md on GitHub (opens in a new tab)

• tm-security-review

  The COMPREHENSIVE tier. Build (or ingest) a full STRIDE threat model as input, then run a sophisticated whole-repo adversarial zeroday exploit review (triple-pass HUNT -> JUDGE -> VERIFY) that validates the model against the code and proves a runnable PoC per confirmed finding. Composes the threat-modeling + 0day-scanner (deep) skills. Use for "tm security review", a deep exploit-focused review w…

  plugins/phoenix-security-review/skills/tm-security-review/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 136k stars · 7 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 127k stars · 1 skill