Posted Updated Agent Skills / Security & Privacy2 hours read (About 13812 words)

Security & Privacy | Agent Skills

Security & Privacy

Security and privacy workflows help agents identify risks, review access and compliance requirements, and apply focused security guidance.

Catalog snapshot: November 2, 2026

Category menu

Skills in this category

addyosmani/accessibility

Catalog entry: Skills by - Google Chrome team - Addy Osmani (Web Quality)
Source documentation: https://github.com/addyosmani/web-quality-skills/blob/main/skills/accessibility/SKILL.md

Function: WCAG compliance, screen reader support, and keyboard navigation

When to use it: Use when asked to “improve accessibility”, “a11y audit”, “WCAG compliance”, “screen reader support”, “keyboard navigation”, or “make accessible”.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Accessibility (a11y)
  • Evidence-led audit workflow
  • WCAG Principles: POUR
  • Conformance levels
  • Perceivable
  • Text alternatives (1.1)
  • Color contrast (1.4.3, 1.4.6)
  • Media alternatives (1.2)
  • Operable
  • Keyboard accessible (2.1)
  • Focus visible (2.4.7)
  • Focus not obscured (2.4.11) — new in 2.2
  • Skip links (2.4.1)
  • Target size (2.5.8) — new in 2.2
  • Dragging movements (2.5.7) — new in 2.2
  • Timing (2.2)

addyosmani/best-practices

Catalog entry: Skills by - Google Chrome team - Addy Osmani (Web Quality)
Source documentation: https://github.com/addyosmani/web-quality-skills/blob/main/skills/best-practices/SKILL.md

Function: Security, modern web APIs, and code quality patterns

When to use it: Use when asked to “apply best practices”, “security audit”, “modernize code”, “code quality review”, or “check for vulnerabilities”.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Best practices
  • Evidence-led audit workflow
  • Security
  • Browser compatibility
  • Doctype declaration
  • Character encoding
  • Viewport meta tag
  • Feature detection
  • Polyfills (when needed)
  • Deprecated APIs
  • Avoid these
  • Event listener passive
  • Console & errors
  • No console errors
  • Error boundaries (React)
  • Global error handler

alinaqi/maggy

Catalog entry: Development and Testing
Source documentation: https://github.com/alinaqi/maggy/blob/main/skills/maggy/SKILL.md

Function: Opinionated project initialization with security-first guardrails, spec-driven atomic todos, LLM testing patterns, and CLI tool orchestration (gh, vercel, supabase)

When to use it: Use when a task needs the capability described in this catalog entry: Opinionated project initialization with security-first guardrails, spec-driven atomic todos, LLM testing patterns, and CLI tool orchestration (gh, vercel, supabase)

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Maggy Skill
  • ⚠️ Execute permission model (important)
  • When Maggy Helps
  • Install and Configure
  • Provider Abstraction
  • Execute Pipeline
  • Competitor Intelligence
  • Not Included
  • Files

aurite-ai/agent-verifier

Catalog entry: Development and Testing
Source documentation: https://github.com/Aurite-ai/agent-verifier/blob/main/README.md

Function: Reviews AI agent code for secrets, unbounded loops, hallucinated tools

When to use it: Use when a task needs the capability described in this catalog entry: Reviews AI agent code for secrets, unbounded loops, hallucinated tools

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • 🔍 Aurite Agent Verifier
  • Why?
  • Author’s Note
  • What You Get
  • Quickstart
  • Install as a Claude Code plugin
  • Learn More
  • Contributions
  • Table of Contents
  • Architecture
  • Available Skills
  • Installation
  • Recommended
  • Updating Installed Skills
  • From NPM Registry
  • Usage

This catalog entry points to a collection. The scanned repository lists 5 distinct skill-file paths.

Sample members: verification · verify-language · verify-patterns · verify-quality · verify-security

auth0/auth0-android

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to native Android apps using the Auth0 SDK

When to use it: Adding login and logout screens to an Android app with Auth0 Web Auth Storing user tokens securely with biometric protection on Android Setting up passwordless authentication in a Kotlin mobile app Handling multi-factor authentication flows in an Android project Connecting an Android app to a protected API using Auth0 access tokens

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-angular

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to Angular apps using @auth0/auth0-angular

When to use it: Adding login and signup to an Angular SPA with redirect-based auth Protecting specific routes so only authenticated users can access them Attaching access tokens to outgoing API calls automatically Showing user profile data like name and avatar after login Gating features behind authentication state using Angular observables

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-express

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add session-based authentication to Express.js apps

When to use it: Adding login and logout to an Express.js web app without writing OAuth flows by hand Protecting admin or dashboard routes so only authenticated users can access them Reading user profile data from Auth0 sessions in route handlers Setting up callback and redirect URLs for an OpenID Connect flow in Express Restricting access to specific Express routes while keeping the homepage public

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-fastify

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add session-based authentication to Fastify web apps

When to use it: Adding login and logout to a Fastify web app without writing OAuth flows by hand Protecting specific routes so only authenticated users can access them Retrieving the logged-in user’s profile to display on a dashboard Getting an access token from the session to call a downstream API Setting up callback handling for Auth0’s hosted login page in Fastify

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-mfa

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add Multi-Factor Authentication to Auth0-powered apps

When to use it: Adding TOTP or SMS verification to an existing Auth0 login flow Requiring step-up MFA before a user changes payment details Setting up adaptive authentication that triggers MFA only for suspicious logins Meeting PCI-DSS or HIPAA compliance by enforcing multi-factor on every session Configuring WebAuthn passkeys as a second factor for passwordless-ready apps

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-migration

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Migrate users and auth flows from other providers to Auth0

When to use it: Moving a Firebase Auth user base to Auth0 without forcing password resets Running parallel authentication during a phased migration from Cognito Bulk importing users from a custom database into Auth0 Updating Express.js API JWT validation from HS256 to Auth0’s RS256 Lazy-migrating active Supabase users to Auth0 on their next login

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-nextjs

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to Next.js apps

When to use it: Adding login and logout flows to a Next.js App Router project Protecting specific pages so only authenticated users can access them Reading user session data in server components and API routes Setting up OAuth callback handling with Auth0 middleware Migrating auth routes from SDK v3 to the v4 format

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-nuxt

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add Auth0 authentication to Nuxt 3/4 apps with encrypted cookie sessions

When to use it: Adding login and logout flows to a Nuxt 3 app with Auth0 Protecting server routes and API endpoints with session checks Retrieving access tokens to call external APIs on behalf of users Setting up stateful sessions with Redis for distributed Nuxt deployments Configuring role-based route middleware in a Nuxt SSR application

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-react

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to React SPAs using @auth0/auth0-react

When to use it: Adding login and logout buttons to a React SPA Protecting specific routes so only logged-in users can access them Calling a backend API with an Auth0 access token Handling MFA enrollment and verification in a React app Setting up Auth0Provider with the right env vars for Vite or CRA

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-react-native

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to React Native and Expo mobile apps

When to use it: Adding login and signup screens to a React Native app with Auth0’s universal login Setting up biometric authentication for returning users on iOS and Android Calling a protected API from a mobile app using stored access tokens Configuring deep link callbacks for OAuth redirects in Expo projects Migrating an existing React Native app from custom auth to Auth0

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

auth0/auth0-vue

Catalog entry: Skills by Auth0
Source documentation: https://github.com/auth0/agent-skills/blob/main/README.md

Function: Add authentication to Vue.js apps

When to use it: Adding login and logout buttons to a Vue 3 SPA Protecting specific routes with navigation guards that require authentication Fetching access tokens to call a backend API on behalf of the logged-in user Displaying user profile info like name and avatar after login Setting up Auth0 redirect URIs and environment variables for a new Vue project

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Auth0 Agent Skills
  • Prerequisites
  • Install
  • Claude Code
  • Cursor
  • Codex / ChatGPT plugins
  • Antigravity
  • Gemini CLI
  • Any Agent (Skills CLI)
  • ClawHub Marketplace
  • What happens after install
  • Forcing the skill with `/auth0`
  • Migrating from the individual skills
  • Coverage
  • Example prompts
  • Feedback

BehiSecc/vibesec

Catalog entry: Specialized Domains
Source documentation: https://github.com/BehiSecc/VibeSec-Skill/blob/main/SKILL.md

Function: Helps write secure code by preventing common vulnerabilities including IDOR, XSS, SQL injection, SSRF, and weak authentication, approaching code from a bug hunter’s perspective

When to use it: Use when a task needs the capability described in this catalog entry: Helps write secure code by preventing common vulnerabilities including IDOR, XSS, SQL injection, SSRF, and weak authentication, approaching code from a bug hunter’s perspective

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Secure Coding Guide for Web Applications
  • Overview
  • Access Control Issues
  • Core Requirements
  • Authorization Checks Checklist
  • Common Pitfalls to Avoid
  • Implementation Pattern
  • Client-Side Bugs
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Secret Keys and Sensitive Data Exposure
  • Open Redirect
  • Protection Strategies
  • Bypass Techniques to Block
  • IDN Homograph Attack Protection
  • Password Security

better-auth/best-practices

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/blob/main/better-auth/best-practices/SKILL.md

Function: Best practices for Better Auth integration

When to use it: Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Better Auth Integration Guide
  • Documentation Version
  • Setup Workflow
  • Quick Reference
  • Environment Variables
  • File Location
  • CLI Commands
  • Core Config Options
  • Database
  • Session Management
  • User & Account Config
  • Email Flows
  • Security
  • Hooks
  • Plugins
  • Client

better-auth/create-auth

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/blob/main/better-auth/create-auth/SKILL.md

Function: Create authentication setup with Better Auth

When to use it: Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Create Auth Skill
  • Phase 1: Planning (REQUIRED before implementation)
  • Step 1: Scan the project
  • Step 2: Ask planning questions
  • Step 3: Summarize the plan
  • Phase 2: Implementation
  • Installation
  • Environment Variables
  • Server Config (auth.ts)
  • Client Config (auth-client.ts)
  • Route Handler Setup
  • Database Migrations
  • Database Adapters
  • Drizzle + PostgreSQL Setup
  • Drizzle Config (`drizzle.config.ts`)
  • Common Plugins

better-auth/emailAndPassword

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/blob/main/better-auth/emailAndPassword/SKILL.md

Function: Email and password authentication with Better Auth

When to use it: Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Quick Start
  • Email Verification Setup
  • Requiring Email Verification
  • Client Side Validation
  • Callback URLs
  • Password Reset Flows
  • Security Considerations
  • Sending the Password Reset
  • Password Hashing
  • Custom Hashing Algorithm

better-auth/explain-error

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/tree/main/better-auth/explain-error

Function: Explain Better Auth error messages

When to use it: Looking up what INVALID_SESSION error means in Better Auth Adding proper catch blocks for Better Auth auth failures in a Next.js route Finding related error codes when debugging a RATE_LIMIT_EXCEEDED issue Generating production-ready error handling for Better Auth OAuth callback errors Understanding when a Better Auth error is retryable vs fatal

Usage guidance is taken from the skill’s own trigger description or usage section.

No individual SKILL.md was retrieved; this entry is based on the catalog description and available repository README.

better-auth/organization

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/blob/main/better-auth/organization/SKILL.md

Function: Organization management with Better Auth

When to use it: Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Setup
  • Client-Side Setup
  • Creating Organizations
  • Controlling Organization Creation
  • Creating Organizations on Behalf of Users
  • Active Organizations
  • Members
  • Adding Members (Server-Side)
  • Assigning Multiple Roles
  • Removing Members
  • Updating Member Roles
  • Membership Limits
  • Invitations
  • Setting Up Invitation Emails
  • Sending Invitations
  • Shareable Invitation URLs

better-auth/providers

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/tree/main/better-auth/providers

Function: Better Auth authentication providers

When to use it: Looking up the required env vars for GitHub OAuth in Better Auth Checking which callback URL format Better Auth expects for Google sign-in Comparing setup steps between Discord and Twitter OAuth providers Generating integration code for a specific provider while writing auth routes Reviewing special requirements for passwordless authentication setup

Usage guidance is taken from the skill’s own trigger description or usage section.

No individual SKILL.md was retrieved; this entry is based on the catalog description and available repository README.

better-auth/twoFactor

Catalog entry: Skills by Better Auth Team
Source documentation: https://github.com/better-auth/skills/blob/main/better-auth/twoFactor/SKILL.md

Function: Two-factor authentication with Better Auth

When to use it: Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Setup
  • Client-Side Setup
  • Enabling 2FA for Users
  • TOTP (Authenticator App)
  • Displaying the QR Code
  • Verifying TOTP Codes
  • TOTP Configuration Options
  • OTP (Email/SMS)
  • Configuring OTP Delivery
  • Sending and Verifying OTP
  • OTP Storage Security
  • Backup Codes
  • Displaying Backup Codes
  • Regenerating Backup Codes
  • Using Backup Codes for Recovery
  • Backup Code Configuration

binance/query-token-audit

Catalog entry: Skills by Binance
Source documentation: https://github.com/binance/binance-skills-hub/blob/main/skills/binance-web3/query-token-audit/SKILL.md

Function: Audit token security to detect scams, honeypots, and malicious contracts across BSC, Base, Solana, and Ethereum

When to use it: Use when users ask “is this token safe?”, “check token security”, “audit token”, or before any swap.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Query Token Audit Skill
  • Overview
  • Use Cases
  • Supported Chains
  • API: Token Security Audit
  • Method: POST
  • User Agent Header
  • Notes

coinbase/authenticate-wallet

Catalog entry: Skills by Coinbase
Source documentation: https://github.com/coinbase/agentic-wallet-skills/blob/main/README.md

Function: Handle sign-in for the Coinbase payments wallet via email OTP

When to use it: Logging into your Coinbase wallet before sending USDC Re-authenticating after a session expires mid-transaction Setting up wallet access on a new machine for the first time Checking wallet authentication status before running a balance query Recovering from ‘not signed in’ errors during a trade

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Coinbase Agentic Wallet Skills
  • What it does
  • Installation
  • Usage
  • Contributing
  • Updating the `awal` version
  • License

composiohq/composio

Catalog entry: Skills by Composio Team
Source documentation: https://github.com/ComposioHQ/skills/blob/main/skills/composio/SKILL.md

Function: Connect AI agents to 1000+ external apps with managed authentication

When to use it: Sending a Gmail draft from a terminal command without writing any code Connecting a multi-tenant AI agent to each user’s own Slack workspace Searching 1000+ tool integrations by use case to find the right action Triggering a GitHub issue creation from an AI agent mid-conversation Listening for real-time events from external apps to drive agent workflows

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • When to Apply
  • Setup
  • 1. Use Apps via Composio CLI
  • 2. Building Apps and Agents with Composio

danoszz/penthera

Catalog entry: n8n Automation
Source documentation: https://github.com/danoszz/penthera/blob/main/skills/penthera/SKILL.md

Function: Offline rule-based security checks for repos, dependencies and agent configs

When to use it: Use when the user asks to scan, audit, harden, fix, or review the security of their own app, staging URL, localhost, repo, dependencies, or agent setup. Do NOT use for targets without explicit authorization.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Penthera Security Scanner
  • Critical: Authorization gate
  • Preflight
  • Resolve CLI command
  • Decision tree
  • Default safe behavior
  • Reply with the brief
  • Destructive mode gate
  • Workflow 1: Pre-release audit
  • Workflow 2: Repo + live combined
  • Workflow 3: CI / baseline regression
  • Workflow 4: Scan and fix
  • Fix-mode gate
  • Workflow 5: Owner reports & questionnaire responses
  • Authenticated scans
  • Workflow 6: Agent config audit

firebase/firebase-auth-basics

Catalog entry: Skills by Firebase
Source documentation: https://github.com/firebase/agent-skills/blob/main/skills/firebase-auth-basics/SKILL.md

Function: Set up Firebase Authentication with sign-in providers

When to use it: Use this skill when the user’s app requires user sign-in, user management, or secure data access using auth rules.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Prerequisites
  • Core Concepts
  • Users
  • Identity Providers
  • Tokens
  • Workflow
  • 1. Provisioning
  • 2. Client Setup & Usage
  • 3. Security Rules

firebase/firebase-basics

Catalog entry: Skills by Firebase
Source documentation: https://github.com/firebase/agent-skills/blob/main/skills/firebase-basics/SKILL.md

Function: Handle Firebase CLI install, auth, and day-to-day workflow

When to use it: Setting up a new Firebase project from scratch in the terminal Logging into Firebase on a remote server without a browser Switching between multiple Firebase projects during development Troubleshooting a broken Firebase CLI installation after an update Adding a new Firebase service like Hosting or Firestore to an existing project

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Prerequisites
  • Firebase Usage Principles
  • References
  • Common Issues

firebase/firebase-security-rules-auditor

Catalog entry: Skills by Firebase
Source documentation: https://github.com/firebase/agent-skills/blob/main/skills/firebase-security-rules-auditor/SKILL.md

Function: Audit Firestore security rules and flag risky patterns

When to use it: Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don’t use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Overview
  • Scoring Criteria
  • Assessment: Security Validator (Red Team Edition)
  • Mandatory Audit Checklist:
  • Admin Bootstrapping & Privileges:
  • Scoring Criteria (1-5):

firecrawl/firecrawl-build-interact

Catalog entry: Skills by Firecrawl Team
Source documentation: https://github.com/firecrawl/skills/blob/main/README.md

Function: Multi-step Firecrawl browser flows: clicks, form fills, pagination, and auth-aware navigation

When to use it: Logging into a dashboard and scraping data behind auth Clicking through paginated search results to collect entries Filling and submitting a multi-step web form from app code Driving infinite-scroll feeds to capture all items Navigating JS-heavy single-page apps that reveal content on interaction

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Firecrawl Skills
  • Install
  • Catalog layout
  • Contributing: where does my PR go?
  • Skills
  • Core (`skills/core/`)
  • Build (`skills/build/`)
  • Workflows (`skills/workflows/`)
  • MCP Server
  • Plugins
  • Prerequisites
  • Which skills do I need?
  • Docs (Source of Truth)
  • License

garrytan/cso

Catalog entry: Skills by Garry Tan (gstack)
Source documentation: https://github.com/garrytan/gstack/blob/main/cso/SKILL.md

Function: Chief Security Officer: OWASP Top 10 + STRIDE threat model with zero false-positive exclusions

When to use it: Scanning git history for leaked AWS keys and OAuth tokens before a repo goes public Auditing GitHub Actions workflows for pull_request_target misuse and unpinned third-party actions Checking webhook handlers for missing HMAC signature verification across the entire codebase Running LLM feature audits to trace user input paths that reach system prompts Tracking security posture trends across audit runs before a SOC 2 or compliance review

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • /cso — evidence before assurance
  • Arguments
  • Mode Resolution
  • Section index — Read each section when its situation applies
  • Phase 0: Application model and readiness
  • Phase 1: Attack surface census
  • Phase 12: Evidence rubric and independent challenge
  • Phase 13: Report and repair artifacts
  • Phase 14: Recovery and current-source rechecks

google/cloud/google-cloud-recipe-auth

Catalog entry: Skills by Google Cloud
Source documentation: https://github.com/google/skills/blob/main/skills/cloud/google-cloud-recipe-auth/SKILL.md

Function: Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and b...

When to use it: Use when a task needs the capability described in this catalog entry: Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and b...

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Authenticating and Authorizing to Google Cloud (IAM)
  • Attribution
  • Authentication
  • Clarifying Questions for the Agent
  • Human Authentication
  • Types of User Identities
  • Methods of Access for Developers and Administrators
  • For End-Users and Customers
  • Service-to-Service Authentication
  • Service Accounts and Service Agents
  • Best Practice: Attaching Service Accounts
  • Special Cases & Advanced Topics
  • Authorization
  • Examples
  • Human-to-Service (Local Python Development)
  • Service-to-Service (Cloud Run to Cloud SQL)

google/cloud/google-cloud-waf-security

Catalog entry: Skills by Google Cloud
Source documentation: https://github.com/google/skills/blob/main/skills/cloud/google-cloud-waf-security/SKILL.md

Function: Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF).

When to use it: Use when a task needs the capability described in this catalog entry: Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF).

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Google Cloud Well-Architected Framework skill for the Security pillar
  • Attribution
  • Overview
  • Workflow
  • Core principles
  • Relevant Google Cloud products
  • Workload assessment questions
  • Validation checklist

mcollina/skills

Catalog entry: Development and Testing
Source documentation: https://github.com/mcollina/skills/blob/main/README.md

Function: 11 skills by Matteo Collina: Node.js, Fastify, TypeScript, OAuth, Git/GitHub, ESLint neostandard, documentation (Diataxis), Node.js core internals, skill optimizer, and more

When to use it: Use when a task needs the capability described in this catalog entry: 11 skills by Matteo Collina: Node.js, Fastify, TypeScript, OAuth, Git/GitHub, ESLint neostandard, documentation (Diataxis), Node.js core internals, skill optimizer, and more

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Matteo Collina’s Skills
  • Available Skills
  • Usage
  • Benchmarking

This catalog entry points to a collection. The scanned repository lists 11 distinct skill-file paths.

Sample members: documentation · fastify · init · linting-neostandard-eslint9 · node · nodejs-core · oauth · octocat
More members are available in the source repository.

microsoft/azure-identity-dotnet

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-dotnet/skills/azure-identity-dotnet/SKILL.md

Function: Microsoft Entra ID authentication

When to use it: Authenticating Azure SDK clients (Blob Storage, Key Vault) without hardcoding secrets Switching from AzureCliCredential locally to ManagedIdentityCredential in production with no code changes Configuring user-assigned managed identity on an AKS workload using a client ID Chaining fallback credentials with ChainedTokenCredential for multi-environment deployments Authenticating against Azure Government or China sovereign cloud endpoints

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Identity library for .NET
  • Installation
  • Environment Variables
  • Service Principal with Secret
  • Service Principal with Certificate
  • Managed Identity
  • DefaultAzureCredential
  • Basic Usage
  • ASP.NET Core with Dependency Injection
  • Customizing DefaultAzureCredential
  • Credential Types
  • ManagedIdentityCredential (Production)
  • ClientSecretCredential
  • ClientCertificateCredential
  • ChainedTokenCredential (Custom Chain)
  • Developer Credentials

microsoft/azure-identity-java

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-java/skills/azure-identity-java/SKILL.md

Function: Microsoft Entra ID authentication

When to use it: Use when implementing DefaultAzureCredential, managed identity, service principal, or any Azure authentication pattern in Java applications.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Identity library for Java
  • Installation
  • Key Concepts
  • DefaultAzureCredential (Recommended)
  • Configure DefaultAzureCredential
  • Managed Identity
  • Service Principal with Secret
  • Service Principal with Certificate
  • Environment Credential
  • Required Environment Variables
  • Azure CLI Credential
  • Interactive Browser
  • Device Code
  • Chained Credential
  • Workload Identity (AKS)
  • Token Caching

microsoft/azure-identity-py

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md

Function: Microsoft Entra ID authentication

When to use it: Authenticating Azure Blob Storage clients in Python with zero credential management Switching from local Azure CLI login to managed identity in production without changing code Getting bearer tokens for Azure OpenAI via get_bearer_token_provider with the OpenAI SDK Setting up workload identity auth for a Python app running on AKS Chaining ManagedIdentityCredential with AzureCliCredential as a dev/prod fallback

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Identity library for Python
  • Installation
  • Python Version
  • Environment Variables
  • Authentication & Lifecycle
  • DefaultAzureCredential
  • Credential Chain Order
  • Customizing DefaultAzureCredential
  • Exclude Parameters
  • get_bearer_token_provider
  • Credential Types
  • Credential Chains
  • Azure-Hosted Applications
  • Service Principals
  • User Authentication
  • Developer Tools

microsoft/azure-identity-rust

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-rust/skills/azure-identity-rust/SKILL.md

Function: Microsoft Entra ID authentication

When to use it: Authenticating a Rust app to Azure Key Vault using Azure CLI credentials locally Connecting to Azure Blob Storage from an AKS pod with workload identity Rotating service principal secrets in CI without changing application code Using system-assigned managed identity on Azure Functions to access Azure SQL Switching from local DeveloperToolsCredential to ManagedIdentityCredential in production without code changes

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Identity library for Rust
  • Installation
  • Environment Variables
  • Authentication
  • DeveloperToolsCredential (Local Development)
  • ManagedIdentityCredential (Production)
  • ClientSecretCredential (Service Principal)
  • Credential Types
  • Best Practices
  • Reference Links

microsoft/azure-identity-ts

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-typescript/skills/azure-identity-ts/SKILL.md

Function: Microsoft Entra ID authentication

When to use it: Use when configuring authentication with DefaultAzureCredential, managed identity, service principals, or interactive browser login.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Identity library for TypeScript
  • Installation
  • Environment Variables
  • Service Principal (Secret)
  • Service Principal (Certificate)
  • Workload Identity (Kubernetes)
  • DefaultAzureCredential (Recommended for Local Development)
  • Managed Identity
  • System-Assigned
  • User-Assigned (by Client ID)
  • User-Assigned (by Resource ID)
  • User-Assigned (by Object ID)
  • Service Principal
  • Client Secret
  • Client Certificate
  • Interactive Authentication

microsoft/azure-keyvault-py

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md

Function: Secrets, keys, and certificate management

When to use it: Retrieving database credentials at runtime instead of hardcoding them in config files Rotating API keys across multiple services by updating a single vault secret Signing payloads with an RSA key stored in Key Vault without exposing the private key Managing TLS certificate lifecycle for Azure-hosted applications Encrypting sensitive user data using a Key Vault-managed key before writing to storage

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Key Vault SDK for Python
  • Installation
  • Environment Variables
  • Authentication & Lifecycle
  • Secrets
  • SecretClient Setup
  • Secret Operations
  • Keys
  • KeyClient Setup
  • Key Operations
  • Cryptographic Operations
  • Certificates
  • CertificateClient Setup
  • Certificate Operations
  • Client Types Table
  • Async Clients

microsoft/azure-keyvault-secrets-rust

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-rust/skills/azure-keyvault-secrets-rust/SKILL.md

Function: Key Vault secret storage

When to use it: Reading database passwords from Key Vault at app startup instead of hardcoding them Rotating API keys stored in Key Vault without redeploying the Rust service Tagging secrets by environment to separate prod and staging credentials Fetching a specific secret version to audit what value was active on a given date Listing all secrets in a vault to inventory credentials across a project

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Key Vault Secrets library for Rust
  • Installation
  • Environment Variables
  • Authentication
  • Core Workflow
  • Set Secret
  • Update Secret Properties
  • Delete Secret
  • List Secrets (Pagination)
  • Error Handling
  • RBAC Roles
  • Best Practices
  • Reference Links

microsoft/azure-keyvault-secrets-ts

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-typescript/skills/azure-keyvault-secrets-ts/SKILL.md

Function: Secret storage and retrieval

When to use it: Use when storing and retrieving application secrets or configuration values.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Key Vault Secrets SDK for TypeScript
  • Installation
  • Environment Variables
  • Authentication
  • Secrets Operations
  • Create/Set Secret
  • Get Secret
  • List Secrets
  • Delete Secret
  • Keys Operations
  • Create Keys
  • Get Key
  • List Keys
  • Rotate Key
  • Delete Key
  • Cryptographic Operations

microsoft/azure-security-keyvault-keys-dotnet

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-dotnet/skills/azure-security-keyvault-keys-dotnet/SKILL.md

Function: Cryptographic key management

When to use it: Rotating RSA keys on a 90-day schedule with automatic Key Vault policies Encrypting AES session keys with RSA-OAEP before storing them in a database Signing JWTs or payloads with EC keys backed by a Managed HSM Wrapping data encryption keys so plaintext key material never leaves the vault Listing all key versions to audit which version is active in production

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure.Security.KeyVault.Keys (.NET)
  • Installation
  • Environment Variables
  • Client Hierarchy
  • Authentication
  • Microsoft Entra Token Credential
  • Service Principal
  • Key Management
  • Create Keys
  • Retrieve Keys
  • Update Key Properties
  • Delete and Purge Keys
  • Backup and Restore
  • Cryptographic Operations
  • Get CryptographyClient
  • Encrypt and Decrypt

microsoft/azure-security-keyvault-keys-java

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md

Function: Cryptographic key management

When to use it: Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Key Vault Keys (Java)
  • Installation
  • Client Creation
  • Key Types
  • Create Keys
  • Create RSA Key
  • Create EC Key
  • Create Symmetric Key (Managed HSM only)
  • Get Key
  • Update Key Properties
  • List Keys
  • Delete Key
  • Cryptographic Operations
  • Encrypt/Decrypt
  • Sign/Verify
  • Wrap/Unwrap Key

microsoft/azure-security-keyvault-secrets-java

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md

Function: Secret management for passwords and keys

When to use it: Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Azure Key Vault Secrets (Java)
  • Installation
  • Client Creation
  • Create/Set Secret
  • Get Secret
  • Update Secret Properties
  • List Secrets
  • Delete Secret
  • Recover Deleted Secret
  • Purge Deleted Secret
  • Backup and Restore
  • Async Operations
  • Configuration Patterns
  • Load Multiple Secrets
  • Secret Rotation Pattern
  • Error Handling

microsoft/fastapi-router-py

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-python/skills/fastapi-router-py/SKILL.md

Function: FastAPI routers with CRUD and auth

When to use it: Use when building REST API endpoints, creating new routes, implementing CRUD operations, or adding authenticated endpoints in FastAPI applications.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • FastAPI Router
  • Quick Start
  • Authentication Patterns
  • Response Models
  • HTTP Status Codes
  • Integration Steps
  • Best Practices
  • Reference Files

microsoft/microsoft-azure-webjobs-extensions-authentication-events-dotnet

Catalog entry: Skills by Microsoft
Source documentation: https://github.com/microsoft/skills/blob/main/.github/plugins/azure-sdk-dotnet/skills/microsoft-azure-webjobs-extensions-authentication-events-dotnet/SKILL.md

Function: Entra ID custom auth events handler

When to use it: Adding department and cost center claims to tokens during Entra sign-in Prefilling registration form fields based on the user’s email domain Blocking sign-ups from specific email domains at attribute submission Sending OTP codes through a custom SMS provider instead of the Entra default Validating and normalizing user-submitted attributes before they are saved to the directory

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Microsoft.Azure.WebJobs.Extensions.AuthenticationEvents (.NET)
  • Installation
  • Supported Events
  • Core Workflows
  • 1. Token Enrichment (Add Custom Claims)
  • 2. Token Enrichment with External Data
  • 3. Attribute Collection - Customize UI (Start Event)
  • 4. Attribute Collection - Validate Submission (Submit Event)
  • 5. Custom OTP Delivery
  • 6. Function App Configuration
  • Key Types Reference
  • Entra ID Configuration
  • Required App Registration Settings
  • Best Practices
  • Error Handling
  • Related SDKs

MiniMax-AI/fullstack-dev

Catalog entry: Skills by MiniMax Team
Source documentation: https://github.com/MiniMax-AI/skills/blob/main/skills/fullstack-dev/SKILL.md

Function: Backend architecture with REST API design, auth flows, real-time features, and database integration

When to use it: Scaffolding a new Express or Django API with proper service layers Wiring up a React frontend to a REST backend with typed API clients and error handling Adding JWT authentication with automatic token refresh to an existing app Implementing file uploads via presigned S3 URLs instead of streaming through the server Setting up SSE or WebSocket endpoints for live notifications or chat

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Full-Stack Development Practices
  • MANDATORY WORKFLOW — Follow These Steps In Order
  • Step 0: Gather Requirements
  • Step 1: Architectural Decisions
  • Step 2: Scaffold with Checklist
  • Step 3: Implement Following Patterns
  • Step 4: Test & Verify
  • Step 5: Handoff Summary
  • Scope
  • Quick Start — New Backend Service Checklist
  • Quick Start — Frontend-Backend Integration Checklist
  • Quick Navigation
  • Core Principles (7 Iron Rules)
  • 1. Project Structure & Layering (CRITICAL)
  • Feature-First Organization
  • Three-Layer Architecture

MiniMax-AI/ios-application-dev

Catalog entry: Skills by MiniMax Team
Source documentation: https://github.com/MiniMax-AI/skills/blob/main/skills/ios-application-dev/SKILL.md

Function: iOS development with UIKit, SnapKit, and SwiftUI covering navigation, Dark Mode, and HIG compliance

When to use it: Use when: developing iOS apps, implementing UI, reviewing iOS code, working with UIKit/SnapKit/SwiftUI layouts, building iPhone interfaces, Swift mobile development, Apple HIG compliance, iOS accessibility implementation.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • iOS Application Development Guide
  • Quick Reference
  • UIKit
  • SwiftUI
  • Core Principles
  • Layout
  • Typography
  • Colors
  • Accessibility
  • Navigation
  • Privacy & Permissions
  • Checklist
  • Components
  • Privacy
  • System Integration
  • References

mongodb/mongodb-mcp-setup

Catalog entry: Skills by MongoDB
Source documentation: https://github.com/mongodb/agent-skills/blob/main/skills/mongodb-mcp-setup/SKILL.md

Function: Set up the MongoDB MCP server with authentication and connection configuration

When to use it: Use this skill when a user has the MongoDB MCP server installed but hasn’t configured the required environment variables, or when they ask about connecting to MongoDB/Atlas and don’t have the credentials set up.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • MongoDB MCP Server Setup
  • Overview
  • Step 0: Detect Client
  • Step 1: Check Existing Configuration
  • Step 2: Present Configuration Options
  • Step 3a: Connection String Setup
  • 3a.1: Explain How to Find the Connection String
  • Step 3b: Service Account Setup
  • 3b.1: Guide Through Atlas Service Account Creation
  • 3b.2: API Access List Configuration
  • Step 3c: Atlas Local Setup
  • 3c.1: Check Docker Installation
  • 3c.2: Confirm Setup Complete
  • Step 4: Determine Read-Only vs Read-Write Access
  • Step 5: Configure Credentials
  • 5.1: Add credentials

moxno/privacyscrubber-guard

Catalog entry: Development and Testing
Source documentation: https://github.com/moxno/privacyscrubber-mcp/blob/main/skills/privacyscrubber-guard/SKILL.md

Function: Sanitize PII and secrets in RAM before agent calls

When to use it: Use when a task needs the capability described in this catalog entry: Sanitize PII and secrets in RAM before agent calls

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • PrivacyScrubber Guard — Agent Skill
  • Quick Setup
  • Core Agent Workflow

mukul975/Anthropic-Cybersecurity-Skills

Catalog entry: Development and Testing
Source documentation: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/main/README.md

Function: 753 cybersecurity skills across 38 domains: cloud security, pentesting, red teaming, DFIR, malware analysis, threat intel, and more (MITRE ATT&CK mapped)

When to use it: Use when a task needs the capability described in this catalog entry: 753 cybersecurity skills across 38 domains: cloud security, pentesting, red teaming, DFIR, malware analysis, threat intel, and more (MITRE ATT&CK mapped)

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Anthropic Cybersecurity Skills
  • The largest open-source cybersecurity skills library for AI agents
  • Give any AI agent the security skills of a senior analyst
  • Six frameworks, one skill library
  • 🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills
  • MITRE ATT&CK v19.1 — 805/817 skills mapped
  • Quick start
  • 🌍 GARS-2026 — Global Agentic AI Readiness Survey
  • 🚀 Try it on the Playground
  • Why this exists
  • What’s inside — 34 security domains
  • How AI agents use these skills
  • Skill anatomy
  • YAML frontmatter (real example)
  • Markdown body sections
  • MITRE ATLAS 2026.07 — AI/ML adversarial threats

This catalog entry points to a collection. The scanned repository lists 818 distinct skill-file paths.

Sample members: abusing-dpapi-for-credential-access · abusing-shadow-credentials-for-privesc · achieving-cmmc-level-2-compliance · acquiring-disk-image-with-dd-and-dcfldd · analyzing-active-directory-acl-abuse · analyzing-android-malware-with-apktool · analyzing-api-gateway-access-logs · analyzing-apt-group-with-mitre-navigator
More members are available in the source repository.

NeoLabHQ/review

Catalog entry: Development and Testing
Source documentation: https://github.com/NeoLabHQ/context-engineering-kit/blob/master/plugins/review/README.md

Function: Comprehensive PR code review using specialized agents: bug-hunter, security-auditor, code-quality-reviewer, contracts-reviewer, historical-context-reviewer, test-coverage-reviewer

When to use it: Use when a task needs the capability described in this catalog entry: Comprehensive PR code review using specialized agents: bug-hunter, security-auditor, code-quality-reviewer, contracts-reviewer, historical-context-reviewer, test-coverage-reviewer

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Review Plugin
  • Focused on
  • Overview
  • Quick Start
  • Advanced Usage
  • CI/CD Integration
  • Agent Architecture
  • Commands
  • Review Agents
  • Bug Hunter
  • Security Auditor
  • Test Coverage Reviewer
  • Code Quality Reviewer
  • Contracts Reviewer
  • Historical Context Reviewer
  • Change Triage Agents

This catalog entry points to a collection. The scanned repository lists 3 distinct skill-file paths.

Sample members: review-local-changes · review-pr · traiage-review

openai/netlify-deploy

Catalog entry: Skills by OpenAI
Source documentation: https://github.com/openai/skills/blob/main/skills/.curated/netlify-deploy/SKILL.md

Function: Automate Netlify deployments with CLI auth, linking, and environment support

When to use it: Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Netlify Deployment Skill
  • Overview
  • Prerequisites
  • Authentication Pattern
  • Workflow
  • 1. Verify Netlify CLI Authentication
  • 2. Detect Site Link Status
  • 3. Link to Existing Site or Create New
  • 4. Verify Dependencies
  • 5. Deploy to Netlify
  • 6. Report Results
  • Handling netlify.toml
  • Example Full Workflow
  • Error Handling
  • Troubleshooting
  • Escalated Network Access

openai/security-best-practices

Catalog entry: Skills by OpenAI
Source documentation: https://github.com/openai/skills/blob/main/skills/.curated/security-best-practices/SKILL.md

Function: Review code for language-specific security vulnerabilities

When to use it: Auditing a Flask API for common Python web security issues before a production deploy Generating a severity-ranked vulnerability report for a Node.js Express app Writing new Go HTTP handlers with secure defaults already applied Catching hardcoded secrets or missing input validation while adding features to an existing TypeScript project Getting a fix for a specific CVE-class issue with an explanation tied to the relevant security guidance

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Security Best Practices
  • Overview
  • Workflow
  • Workflow Decision Tree
  • Overrides
  • Report Format
  • Fixes
  • General Security Advice
  • Avoid Using Incrementing IDs for Public IDs of Resources
  • A note on TLS

openai/security-ownership-map

Catalog entry: Skills by OpenAI
Source documentation: https://github.com/openai/skills/blob/main/skills/.curated/security-ownership-map/SKILL.md

Function: Map people-to-file ownership, compute bus factor, and identify risks

When to use it: Finding auth or crypto files with a bus factor of 1 Checking who actually owns sensitive code versus what CODEOWNERS says Locating stale security-critical files no one has touched in months Grouping files by co-change patterns to spot hidden ownership clusters Tracking which contributors have the highest concentration of sensitive touches

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Security Ownership Map
  • Overview
  • Requirements
  • Workflow
  • Quick start
  • Sensitivity rules
  • Output artifacts
  • LLM query helper
  • Basic security queries
  • Summary format (default)
  • Graph persistence
  • Notes

openai/security-threat-model

Catalog entry: Skills by OpenAI
Source documentation: https://github.com/openai/skills/blob/main/skills/.curated/security-threat-model/SKILL.md

Function: Generate repo-specific threat models identifying trust boundaries

When to use it: Threat modeling a web API before a security review Mapping trust boundaries in a multi-service backend Identifying abuse paths for file upload or parser endpoints Generating a threat model doc for a pentest scope Auditing attacker capabilities for an internet-exposed admin interface

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Threat Model Source Code Repo
  • Quick start
  • Workflow
  • 1) Scope and extract the system model
  • 2) Derive boundaries, assets, and entry points
  • 3) Calibrate assets and attacker capabilities
  • 4) Enumerate threats as abuse paths
  • 5) Prioritize with explicit likelihood and impact reasoning
  • 6) Validate service context and assumptions with the user
  • 7) Recommend mitigations and focus paths
  • 8) Run a quality check before finalizing
  • Risk prioritization guidance (illustrative, not exhaustive)
  • References

prompt-security/clawsec

Catalog entry: Specialized Domains
Source documentation: https://github.com/prompt-security/clawsec/blob/main/README.md

Function: Security skill suite with drift detection, automated audits, and skill integrity verification

When to use it: Use when a task needs the capability described in this catalog entry: Security skill suite with drift detection, automated audits, and skill integrity verification

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Install the OpenClaw suite
  • 1. Add the suite
  • 2. Review and enable the advisory hook
  • See it work
  • Detect and respond to agent-file drift
  • How ClawSec protects an agent
  • Platform entry points
  • Skill feature matrix
  • Query the signed advisory channel
  • Build, test, and contribute
  • Translations
  • License

This catalog entry points to a collection. The scanned repository lists 16 distinct skill-file paths.

Sample members: claw-release · clawsec-clawhub-checker · clawsec-feed · clawsec-nanoclaw · clawsec-scanner · clawsec-suite · clawtributor · hermes-attestation-guardian
More members are available in the source repository.

redhat/cve-skillpack

Catalog entry: Skills by RedHat
Source documentation: https://catalog.redhat.com/en/ai/skills/detail/agentic-skill-pack-for-red-hat-customers#agent-and-skills

Function: Understand CVEs, check product lifecycle status, gather diagnostics, and file support cases at the right severity — essential Red Hat skills for everyday operations.

When to use it: Use when a task needs the capability described in this catalog entry: Understand CVEs, check product lifecycle status, gather diagnostics, and file support cases at the right severity — essential Red Hat skills for everyday operations.

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Platforms
  • Products & services
  • Try, buy, sell
  • Help
  • About Red Hat Ecosystem Catalog
  • Red Hat legal and privacy links
  • Red Hat legal and privacy links

This catalog entry points to a collection. The scanned repository lists 0 distinct skill-file paths.

No individual SKILL.md was retrieved; this entry is based on the catalog description and available repository README.

Rootly-AI-Labs/rootly-incident-responder

Catalog entry: Development and Testing
Source documentation: https://github.com/rootlyhq/rootly-mcp-server/blob/main/examples/skills/rootly-incident-responder.md

Function: AI-powered incident response with ML similarity matching, solution suggestions, and on-call coordination. Requires [Rootly MCP Server](https://github\.com/rootlyhq/rootly\-mcp\-server\)

When to use it: Use when a task needs the capability described in this catalog entry: AI-powered incident response with ML similarity matching, solution suggestions, and on-call coordination. Requires [Rootly MCP Server](https://github\.com/rootlyhq/rootly\-mcp\-server\)

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Rootly Incident Responder
  • Core Principles
  • Your Workflow
  • 1. Gather Comprehensive Incident Context
  • 2. Find Historical Context
  • 3. Get Intelligent Solution Recommendations
  • 4. Identify On-Call Team & Stakeholders
  • 5. Correlate with Code Changes
  • 6. Analyze Root Cause
  • 7. Create Action Items & Remediation Plan
  • 8. Document Resolution
  • Best Practices
  • Prioritization
  • Communication
  • Uncertainty Handling
  • Leveraging Rootly’s Intelligence

saleh-alhaddad/itqan-engineering

Catalog entry: Development and Testing
Source documentation: https://github.com/saleh-alhaddad/itqan-engineering/blob/main/SKILL.md

Function: Full software-engineering lifecycle in 12 skills: a resumable orchestrator plus spec, plan, TDD build, verify, five-axis review, security, and release — with approval gates before code and evidence before “done”

When to use it: Use when a task needs the capability described in this catalog entry: Full software-engineering lifecycle in 12 skills: a resumable orchestrator plus spec, plan, TDD build, verify, five-axis review, security, and release — with approval gates before code and evidence before “done”

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • itqan — engineering skills suite router
  • How to work
  • Non-negotiables (from CONVENTIONS)

This catalog entry points to a collection. The scanned repository lists 0 distinct skill-file paths.

SHADOWPR0/security-bluebook-builder

Catalog entry: Specialized Domains
Source documentation: https://github.com/SHADOWPR0/security-bluebook-builder/blob/main/SKILL.md

Function: Build security Blue Books for sensitive apps

When to use it: Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Security Bluebook Builder
  • Overview
  • Workflow
  • 1) Gather inputs (ask only if missing)
  • 2) Draft the Blue Book
  • 3) Enforce guardrails
  • 4) Quality checks
  • Resources

squirrelscan/squirrelscan

Catalog entry: Development and Testing
Source documentation: https://github.com/squirrelscan/skills/blob/main/skills/squirrelscan/SKILL.md

Function: Audits websites for SEO, performance, security, accessibility and returns fixes

When to use it: Use when the user wants to check, audit, or improve a website’s SEO, ranking, speed, or health, and for anything squirrelscan itself, installing or updating the CLI, login and API keys, running audits, publishing and sharing reports, cloud credits, MCP server setup, configuration, or troubleshooting. Also covers the entity map: the site-wide graph of the entities a site declares in its JSON-LD, and fixing structured data identity problems such as an organization declared separately on every page.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • squirrelscan CLI
  • Links
  • Install
  • Command overview
  • Quickstart
  • Exit codes and audits that did not run
  • Audit levels
  • Probing intensity
  • Authentication and accounts
  • Reports
  • Publishing
  • Regression diffs
  • Skipped checks
  • Copy fix prompts
  • Not checked
  • What a published report holds

Tencent/aig-agent-redteam

Catalog entry: Specialized Domains
Source documentation: https://github.com/Tencent/AI-Infra-Guard/blob/main/skills/aig-agent-redteam/SKILL.md

Function: One-command Agent red-team security assessment skill

When to use it: Use when a task needs the capability described in this catalog entry: One-command Agent red-team security assessment skill

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • AIG Agent 蓝军安全演习
  • 操作原则
  • 最小脚本策略
  • 复用 AI-Infra-Guard 数据源
  • 演习流程
  • 报告资源
  • Step 0：范围与安全边界
  • Step 1：能力与信任边界建模
  • Step 2：生成风险假设
  • Step 3：规划无害测试
  • Step 4：执行并自适应变异
  • Step 5：静态代码与供应链审计
  • Step 6：基础设施审查
  • Step 7：证据、评级与报告
  • 模块指引
  • 报告模板

trailofbits/ask-questions-if-underspecified

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/README.md

Function: Prompt for clarification on ambiguous requirements

When to use it: Asking about target file scope before a refactor that could touch dozens of files Getting confirmation on compatibility requirements before upgrading a dependency Clarifying acceptance criteria before writing tests for an underspecified feature Resolving ambiguous rollback requirements before running a data migration Confirming which components are in-scope before a performance optimization pass

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Trail of Bits Skills Marketplace
  • Installation
  • Claude Code Marketplace
  • Browse and Install Plugins
  • Codex
  • ChatGPT Workspace Marketplace
  • Local Development
  • Available Plugins
  • Smart Contract Security
  • Code Auditing
  • Malware Analysis
  • Verification
  • Reverse Engineering
  • Mobile Security
  • Development
  • Team Management

trailofbits/audit-context-building

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/audit-context-building/skills/audit-context-building/SKILL.md

Function: Deep architectural context via ultra-granular code analysis

When to use it: Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Audit Context Building
  • When to Use
  • When NOT to Use
  • Do not analyze in this context
  • What comes back, and how to read it
  • The format

trailofbits/building-secure-contracts

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/building-secure-contracts/README.md

Function: Smart contract security toolkit with vulnerability scanners for 6 blockchains

When to use it: Scanning a Solana/Anchor program for missing ownership checks and signer authorization issues Checking ERC20 token implementations for non-standard behaviors like fee-on-transfer or rebasing Preparing a smart contract codebase for a third-party security audit with a structured checklist Evaluating a Substrate pallet for BadOrigin handling and unsigned transaction validation Scoring a contract’s code maturity across 9 categories before a major deployment

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Building Secure Contracts
  • Overview
  • Installation
  • Vulnerability Scanners
  • Algorand Vulnerability Scanner
  • Cairo Vulnerability Scanner
  • Cosmos Vulnerability Scanner
  • Solana Vulnerability Scanner
  • Substrate Vulnerability Scanner
  • TON Vulnerability Scanner
  • Development Guidelines Assistants
  • Audit Prep Assistant
  • Code Maturity Assessor
  • Guidelines Advisor
  • Secure Workflow Guide
  • Token Integration Analyzer

This catalog entry points to a collection. The scanned repository lists 11 distinct skill-file paths.

Sample members: algorand-vulnerability-scanner · audit-prep-assistant · cairo-vulnerability-scanner · code-maturity-assessor · cosmos-vulnerability-scanner · guidelines-advisor · secure-workflow-guide · solana-vulnerability-scanner
More members are available in the source repository.

trailofbits/burpsuite-project-parser

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md

Function: Search and extract data from Burp Suite project files

When to use it: Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Burp Project Parser
  • When to Use
  • Prerequisites
  • Quick Reference
  • Resolving Exit 3: the control query
  • Sub-Component Filters (USE THESE)
  • Available Filters
  • Default Approach
  • Regex Search Operations
  • Search Response Headers
  • Search Response Bodies
  • Other Operations
  • Extract Audit Items
  • Dump Proxy History (AVOID)
  • Dump Site Map (AVOID)
  • Output Limits (REQUIRED)

trailofbits/claude-in-chrome-troubleshooting

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/README.md

Function: Diagnose and fix Claude in Chrome MCP extension connectivity issues

When to use it: Fixing ‘Browser extension is not connected’ errors when mcp__claude-in-chrome__* tools fail Switching the active native messaging host between Claude Code CLI and Claude.app Cowork Resetting the chrome-native-host wrapper to dynamically pick the latest Claude Code version after an update Diagnosing which native host binary is running and whether it created the socket in the expected location Resolving socket conflicts caused by running multiple Claude Code sessions or Chrome profiles

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Trail of Bits Skills Marketplace
  • Installation
  • Claude Code Marketplace
  • Browse and Install Plugins
  • Codex
  • ChatGPT Workspace Marketplace
  • Local Development
  • Available Plugins
  • Smart Contract Security
  • Code Auditing
  • Malware Analysis
  • Verification
  • Reverse Engineering
  • Mobile Security
  • Development
  • Team Management

trailofbits/constant-time-analysis

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md

Function: Detect compiler-induced timing side-channels in crypto code

When to use it: Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Constant-Time Analysis
  • When to Use
  • When NOT to Use
  • Language Routing
  • Running the Analyzer
  • Per-language coverage limits
  • Prerequisites
  • Interpreting Results
  • Triaging Findings
  • Limitations
  • Real-World Impact
  • References

trailofbits/differential-review

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/differential-review/skills/differential-review/SKILL.md

Function: Security-focused diff review with git history analysis

When to use it: Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Differential Security Review
  • Core Principles
  • Rationalizations (Do Not Skip)
  • Quick Reference
  • Codebase Size Strategy
  • Risk Level Triggers
  • Workflow Overview
  • Decision Tree
  • Agents
  • Quality Checklist
  • Integration
  • Example Usage
  • Quick Triage (Small PR)
  • Standard Review (Medium Codebase)
  • Deep Audit (Large, Critical Change)
  • When NOT to Use This Skill

trailofbits/dwarf-expert

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/dwarf-expert/skills/dwarf-expert/SKILL.md

Function: DWARF debugging format expertise

When to use it: Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • DWARF Expert
  • Authoritative Sources
  • Parsing and Searching with dwarfdump
  • Searching DIEs
  • Verifying DWARF Integrity
  • readelf
  • Writing Code That Parses DWARF

trailofbits/entry-point-analyzer

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/entry-point-analyzer/skills/entry-point-analyzer/SKILL.md

Function: Identify state-changing entry points in smart contracts

When to use it: Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Entry Point Analyzer
  • Execution in Codex
  • When to Use
  • When NOT to Use
  • Scope: State-Changing Functions Only
  • Workflow
  • Slither Integration (Solidity)
  • 1. Check if Slither is Available
  • 2. If Slither is Detected, Run Entry Points Printer
  • 3. Use Slither Output as Foundation
  • 4. When Slither is NOT Available
  • Language Detection
  • Access Classification
  • 1. Public (Unrestricted)
  • 2. Role-Restricted
  • 3. Contract-Only (Internal Integration Points)

trailofbits/firebase-apk-scanner

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md

Function: Scan Android APKs for Firebase misconfigurations and security vulnerabilities

When to use it: Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Firebase APK Security Scanner
  • When to Use
  • When NOT to Use
  • Rationalizations to Reject
  • Reference Documentation
  • How to Use This Skill
  • Workflow
  • Step 1: Validate Input
  • Step 2: Run the Scanner
  • Step 3: Present Results
  • Scan Summary
  • Extracted Configuration
  • Vulnerabilities Found
  • Remediation
  • Manual Testing (If Scanner Fails)
  • Severity Classification

trailofbits/insecure-defaults

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/insecure-defaults/README.md

Function: Detect insecure default configurations like hardcoded secrets, default credentials, and weak crypto

When to use it: Auditing JWT secret handling to catch fallback values like `|| ‘default’` in production auth code Scanning Dockerfiles and IaC templates for missing environment variables that trigger insecure runtime behavior Reviewing environment variable handling to separate fail-open from fail-secure patterns before a deployment Checking crypto usage for MD5, SHA1, or ECB in password hashing and token signing contexts Tracing CORS wildcard and permission 0777 defaults to confirm whether they reach production endpoints

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Insecure Defaults Detection
  • Install
  • Use
  • What it finds
  • How it runs
  • Patterns
  • When not to use it
  • Tests

trailofbits/modern-python

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/modern-python/skills/modern-python/SKILL.md

Function: Modern Python tooling with uv, ruff, ty, and pytest best practices

When to use it: Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Modern Python
  • When to Use This Skill
  • When NOT to Use This Skill
  • Anti-Patterns to Avoid
  • Decision Tree
  • Tool Overview
  • Security Tools
  • Quick Start: Minimal Project
  • Full Project Setup
  • 1. Create Project Structure
  • 2. Configure pyproject.toml
  • 3. Install Dependencies
  • 4. Add Makefile
  • Migration Guide
  • From requirements.txt + pip
  • From setup.py / setup.cfg

trailofbits/property-based-testing

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/property-based-testing/skills/property-based-testing/SKILL.md

Function: Property-based testing for multiple languages and smart contracts

When to use it: use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Property-Based Testing
  • Property catalog
  • The two ways a property test asserts nothing
  • Where to look next
  • Introducing PBT to a project that lacks it

trailofbits/semgrep-rule-creator

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/semgrep-rule-creator/skills/semgrep-rule-creator/SKILL.md

Function: Create and refine Semgrep rules for vulnerability detection

When to use it: Use when writing Semgrep rules or building custom static analysis detections.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Semgrep Rule Creator
  • When to Use
  • When NOT to Use
  • Rationalizations to Reject
  • Anti-Patterns
  • Strictness Level
  • Overview
  • Quick Start
  • Quick Reference
  • Workflow
  • Documentation

trailofbits/semgrep-rule-variant-creator

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/semgrep-rule-variant-creator/skills/semgrep-rule-variant-creator/SKILL.md

Function: Port existing Semgrep rules to new target languages with test-driven validation

When to use it: Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Semgrep Rule Variant Creator
  • Run it as a workflow
  • The four phases
  • Output
  • Scope and reporting
  • Rationalizations to Reject
  • Quick Reference
  • Documentation

trailofbits/sharp-edges

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/sharp-edges/skills/sharp-edges/SKILL.md

Function: Identify error-prone APIs and dangerous configurations

When to use it: Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows ‘secure by default’ and ‘pit of success’ principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Sharp Edges Analysis
  • When to Use
  • When NOT to Use
  • Agent
  • Core Principle
  • Rationalizations to Reject
  • Sharp Edge Categories
  • 1. Algorithm/Mode Selection Footguns
  • 2. Dangerous Defaults
  • 3. Primitive vs. Semantic APIs
  • 4. Configuration Cliffs
  • 5. Silent Failures
  • 6. Stringly-Typed Security
  • Analysis Workflow
  • Phase 1: Surface Identification
  • Phase 2: Edge Case Probing

trailofbits/spec-to-code-compliance

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/spec-to-code-compliance/skills/spec-to-code-compliance/SKILL.md

Function: Specification-to-code compliance checker for blockchain audits

When to use it: Use when comparing an implementation against a whitepaper, protocol spec, or design document.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Spec-to-Code Compliance
  • When to Use
  • When NOT to Use
  • Do not check requirements in this context
  • What comes back, and how to read it
  • Judgment the workflow does not make for you
  • The target does not have to be a contract
  • Reference

trailofbits/static-analysis

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/README.md

Function: Static analysis toolkit with CodeQL, Semgrep, and SARIF

When to use it: Running CodeQL taint analysis to trace user input into SQL queries Writing Semgrep rules to catch a specific CWE pattern across a codebase Parsing SARIF output from multiple scanners into a deduplicated findings list Scanning a pull request with Semgrep against OWASP and Trail of Bits rulesets Generating CodeQL data extension models for project-specific API sinks

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Static Analysis
  • Skills Included
  • When to Use
  • What It Does
  • CodeQL
  • Semgrep
  • SARIF Parsing
  • Running a Semgrep scan
  • Workflows Included
  • Scripts Included
  • Tests
  • Installation
  • Related Skills

This catalog entry points to a collection. The scanned repository lists 3 distinct skill-file paths.

Sample members: codeql · sarif-parsing · semgrep

trailofbits/testing-handbook-skills

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/testing-handbook-skills/README.md

Function: Testing Handbook skills: fuzzers, static analysis, sanitizers

When to use it: Generating a libFuzzer skill directly from the handbook’s fuzzing chapter Scaffolding a Semgrep skill with handbook-accurate rule-writing guidance Producing a harness-writing skill that cross-references sanitizer and coverage skills Running validate-skills.py in CI to catch broken cross-references between generated skills Building a full set of 16 coordinated security testing skills from one command

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Testing Handbook Skills
  • Overview
  • Installation
  • Usage
  • Generate All Skills
  • Generate Specific Skill
  • Structure
  • Scripts
  • Skill Types
  • Generated Skills
  • Skills Cross-Reference
  • Configuration
  • Author
  • License

This catalog entry points to a collection. The scanned repository lists 15 distinct skill-file paths.

Sample members: address-sanitizer · aflpp · atheris · cargo-fuzz · constant-time-testing · coverage-analysis · fuzzing-dictionary · fuzzing-obstacles
More members are available in the source repository.

trailofbits/variant-analysis

Catalog entry: Security Skills by Trail of Bits Team
Source documentation: https://github.com/trailofbits/skills/blob/main/plugins/variant-analysis/skills/variant-analysis/SKILL.md

Function: Find similar vulnerabilities via pattern-based analysis

When to use it: Searching the entire codebase for null equality bypasses after finding one in an auth handler Building a Semgrep rule from a known XSS pattern and iterating until it covers related sinks Triaging 30 ripgrep matches from a single root cause into high/medium/low confidence findings Expanding a CodeQL query from a Python injection bug to cover Java and Go variants in the same repo Running a five-step variant hunt after a CVE patch to find missed instances in forked code paths

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Variant Analysis
  • When to Use
  • When NOT to Use
  • The Five Steps
  • Running it as a Workflow
  • What Makes Hunts Fail
  • Resources

veniceai/venice-api-overview

Catalog entry: Skills by Venice.ai
Source documentation: https://github.com/veniceai/skills/blob/main/skills/venice-api-overview/SKILL.md

Function: API basics, auth modes, pricing, and versioning

When to use it: Use when a task needs the capability described in this catalog entry: API basics, auth modes, pricing, and versioning

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Venice API Overview
  • Use when
  • Base URL
  • Authentication
  • Endpoint map
  • Inference
  • Catalog
  • Account, billing, wallet
  • Utility
  • Retired (return `410 Gone`)
  • Response headers to watch
  • Pricing model at a glance
  • Standard error shape
  • OpenAI compatibility - what works and what doesn’t
  • Versioning
  • Fast start checklist

veniceai/venice-auth

Catalog entry: Skills by Venice.ai
Source documentation: https://github.com/veniceai/skills/blob/main/skills/venice-auth/SKILL.md

Function: API keys and wallet-based Venice authentication

When to use it: Use when a task needs the capability described in this catalog entry: API keys and wallet-based Venice authentication

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Venice Authentication
  • Use when
  • Which endpoints accept what
  • Option A - Bearer API key
  • Option B - x402 wallet (SIWX)
  • Header
  • SIWE message fields (EIP-4361, EVM)
  • Solana message fields
  • Manual signing (TypeScript, EVM)
  • SDK shortcut (EVM / Base)
  • First-time top-up (wallet → credits)
  • Choosing between the two
  • Common auth errors
  • Security hygiene
  • Payment safety

vercel-labs/vercel-cli-with-tokens

Catalog entry: Skills by Vercel Engineering Team
Source documentation: https://github.com/vercel-labs/agent-skills/blob/main/skills/vercel-cli-with-tokens/SKILL.md

Function: Deploy and manage Vercel projects with token authentication

When to use it: Use when working with Vercel CLI using access tokens rather than interactive login — e.g. “deploy to vercel”, “set up vercel”, “add environment variables to vercel”.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Vercel CLI with Tokens
  • Step 1: Locate the Vercel Token
  • A) `VERCEL_TOKEN` is already set in the environment
  • B) Token is in a `.env` file under `VERCEL_TOKEN`
  • C) Token is in a `.env` file under a different name
  • D) No token found — ask the user
  • Step 2: Locate the Project and Team
  • CLI Setup
  • Deploying a Project
  • Quick Deploy (have project ID — no linking needed)
  • Full Deploy Flow (no project ID — need to link)
  • Deploying from a Remote Repository (code not cloned locally)
  • About `.vercel/` Directory
  • Managing Environment Variables
  • Inspecting Deployments
  • Managing Domains

VoDaiLocz/kilo-kit-mcp

Catalog entry: Development and Testing
Source documentation: https://github.com/VoDaiLocz/kilo-kit-mcp/blob/main/README.md

Function: Comprehensive library of 177 curated skills paired with an MCP runtime enforcing protocol-level C4 workflow gates, hard-gated command execution with security guardrails, and 5 cognitive reasoning engines (Tree of Thoughts DAG, Adversarial Grilling, 5-Whys Root Cause Tracer, Context Compactor, Self-Evolution) for Claude Code, Cursor, Antigravity, and Codex

When to use it: Use when a task needs the capability described in this catalog entry: Comprehensive library of 177 curated skills paired with an MCP runtime enforcing protocol-level C4 workflow gates, hard-gated command execution with security guardrails, and 5 cognitive reasoning engines (Tree of Thoughts DAG, Adversarial Grilling, 5-Whys Root Cause Tracer, Context Compactor, Self-Evolution) for Claude Code, Cursor, Antigravity, and Codex

The catalog does not state a separate trigger condition. This usage note is inferred from the published function description.

Source skill menu:

  • Kilo-Kit
  • 💡 Why Kilo-Kit?
  • The Crisis of Unbounded AI Agency
  • The Solution: Governed Autonomy
  • ⚡ Quick Start (in 30 seconds)
  • 1. Zero-Install Instant Setup
  • 2. Verify System Health
  • 🏛️ Architecture & C4 Protocol
  • The C4 5-Gate Lifecycle
  • 💻 IDE Integration Guide
  • ⚡ Core Capabilities
  • 1. 🚦 4-Tier Adaptive Task Gating
  • 2. 🔍 SQLite FTS5 with BM25 Lexical Ranking
  • 3. ✍️ Self-Authoring Skills & Autonomous Evolution
  • 4. 🛡️ Kilo-Sentinel Loop & Thrashing Tripwire
  • 🧰 MCP Tools Suite (24 Tools)

This catalog entry points to a collection. The scanned repository lists 168 distinct skill-file paths.

Sample members: agent-memory · claukit · mcp-agent-patterns · multi-agent-orchestration · workflow-state-machines · ai-multimodal · geo-fundamentals · media-processing
More members are available in the source repository.

WordPress/wp-abilities-api

Catalog entry: Skills by WordPress Development Team
Source documentation: https://github.com/WordPress/agent-skills/blob/trunk/skills/wp-abilities-api/SKILL.md

Function: Capability-based permissions and REST API authentication

When to use it: Use when working with the WordPress Abilities API (wp_register_ability, wp_register_ability_category, /wp-json/wp-abilities/v1/*, @wordpress/abilities) including defining abilities, categories, meta, REST exposure, and permissions checks for clients.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • WP Abilities API
  • When to use
  • Inputs required
  • Procedure
  • 1) Confirm availability and version constraints
  • 2) Find existing Abilities usage
  • 3) Register categories (optional)
  • 4) Register abilities (PHP)
  • 5) Confirm REST exposure
  • 6) Consume from JS (if needed)
  • Verification
  • Failure modes / debugging
  • Escalation

WordPress/wp-plugin-development

Catalog entry: Skills by WordPress Development Team
Source documentation: https://github.com/WordPress/agent-skills/blob/trunk/skills/wp-plugin-development/SKILL.md

Function: Plugin architecture, hooks, settings API, security

When to use it: Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • WP Plugin Development
  • When to use
  • Inputs required
  • Procedure
  • 0) Triage and locate plugin entrypoints
  • 1) Follow a predictable architecture
  • 2) Hooks and lifecycle (activation/deactivation/uninstall)
  • 3) Settings and admin UI (Settings API)
  • 4) Security baseline (always)
  • 5) Data storage, cron, migrations (if needed)
  • Verification
  • Failure modes / debugging
  • Escalation

WordPress/wp-rest-api

Catalog entry: Skills by WordPress Development Team
Source documentation: https://github.com/WordPress/agent-skills/blob/trunk/skills/wp-rest-api/SKILL.md

Function: REST API routes/endpoints, schema, auth, and response shaping

When to use it: Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • WP REST API
  • When to use
  • Inputs required
  • Procedure
  • 0) Triage and locate REST usage
  • 1) Choose the right approach
  • 2) Register routes safely (namespaces, methods, permissions)
  • 3) Validate/sanitize request args
  • 4) Responses, fields, and links
  • 5) Authentication and authorization
  • 6) Client-facing behavior (discovery, pagination, embeds)
  • Verification
  • Failure modes / debugging
  • Escalation

wrsmith108/varlock-claude-skill

Catalog entry: Development and Testing
Source documentation: https://github.com/wrsmith108/varlock-claude-skill/blob/main/skills/varlock/SKILL.md

Function: Secure environment variable management ensuring secrets are never exposed in Claude sessions, terminals, logs, or git commits

When to use it: Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude’s context. Trigger phrases include “environment variables”, “secrets”, “.env”, “API key”, “credentials”, “sensitive”, “Varlock”.

Usage guidance is taken from the skill’s own trigger description or usage section.

Source skill menu:

  • Varlock Security Skill
  • Core Principle: Secrets Never Exposed
  • CRITICAL: Security Rules for Claude
  • Rule 1: Never Echo Secrets
  • Rule 2: Never Read .env Directly
  • Rule 3: Use Varlock for Validation
  • Rule 4: Never Include Secrets in Commands
  • Quick Start
  • Installation
  • Initialize Project
  • Schema File: .env.schema
  • Basic Structure
  • Security Annotations
  • Type Annotations
  • Safe Commands for Claude
  • Validating Environment

Back to the category index

本分类中文版

Follow

Archives

Tags

AGI1
Agent Skills13
Alfred1
Automation3
Documentation4
Hexo2
Python_library1
Skills,Agent skills1
Software3
VoltAgent13
bibliography1
chart1
computational simulation1
condensed-matter physics1
data analysis1
data-science2
deep-learning1
encryptAsDiary2
fortran1
functional programming2
github1
machine-learning2
matplotlib1
multiprocessing1
neural-networks1
physics2
physics experiment3
plasma physics1
plugins1
poetry1
python16
python_configuration1
python_editors1
python_intermediate2
python_tools1
rust1
semiconductors1
superintelligence1
uv1
zotero1

follow.it

Recents

Latest Comments

×