Skill-uri pentru agenți pe care le poți verifica înainte să le instalezi
Skill-uri SKILL.md publice din depozite GitHub cu peste 50 de stele și de la producători, scanate și evaluate. Instalează oricare dintre ele cu o singură comandă în Claude Code, Cursor, Codex, GitHub Copilot sau Gemini CLI.
7.881 de skill-uri din 207 depozite · actualizat acum 24 de minute
286 de skill-uri
- mermaid-to-proveriftrailofbits/skillsTranslates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol security properties (secrecy, authentication, forward secrecy), checking for replay attacks, or producing a .pv file from a sequence diagram.SecuritateFără avertismente★ 7,7 K↓ —
- graph-evolutiontrailofbits/skillsCompares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.SecuritateFără avertismente★ 7,7 K↓ —
- semgreptrailofbits/skillsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.SecuritateFără avertismente★ 7,7 K↓ —
- codeqltrailofbits/skillsScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.SecuritateFără avertismente★ 7,7 K↓ —
- ctf-pwnljagiello/ctf-skillsProvides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.SecuritateFără avertismente★ 3,5 K↓ —
- ctf-webljagiello/ctf-skillsProvides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.SecuritateFără avertismente★ 3,5 K↓ —
- atr-benign-controlcisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecuritateFără avertismente★ 2,6 K↓ —
- mcpwn-cve-2026-33032cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecuritateFără avertismente★ 2,6 K↓ —
- flowise-cve-2025-59528cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecuritateFără avertismente★ 2,6 K↓ —
- mcp-atlassian-cve-2026-27825cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecuritateFără avertismente★ 2,6 K↓ —
- offensive-anti-forensicsSnailSploit/Claude-RedAnti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the dSecuritateVerifică întâi★ 7,7 K↓ —
- offensive-api-securitySnailSploit/Claude-RedComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.SecuritateVerifică întâi★ 7,7 K↓ —
- hunt-xxeelementalsouls/Claude-BugHunterHunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.SecuritateVerifică întâi★ 5,2 K↓ —
- simple-formattercisco-ai-defense/skill-scannerFormats text according to specified style guidelines. A clean example skill with no security issues.SecuritateFără avertismente★ 2,6 K↓ —
- hunt-domelementalsouls/Claude-BugHunterHunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.SecuritateVerifică întâi★ 5,2 K↓ —
- artifact-validatorjeremylongshore/tons-of-skills-marketplaceDiscover and validate Agent Skills, host plugins and subagents, MCP servers and configurations, hooks, and marketplace catalogs against the correct authority. Use when performing pre-merge review, external submission checks, portability audits, security checks, or validation of mixed agent-system repositories. Trigger with "validate this skill", "audit this plugin", "check this agent", "review this MCP config", or "is this marketplace ready".SecuritateFără avertismente★ 2,9 K↓ —
- hunt-xsselementalsouls/Claude-BugHunterHunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.SecuritateVerifică întâi★ 5,2 K↓ —
- releaseparcadei/Continuous-Claude-v3Release preparation workflow - security audit → E2E tests → review → changelog → docsSecuritateFără avertismente★ 3,9 K↓ —
- hunt-websocketelementalsouls/Claude-BugHunterHunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.SecuritateVerifică întâi★ 5,2 K↓ —
- production-upgradejeremylongshore/tons-of-skills-marketplaceUpgrade an existing skill, plugin, agent, MCP integration, or agent-system package to a security-first production standard using pain research, architecture decisions, migration planning, deterministic implementation, adversarial tests, independent review, and revision-bound evidence. Use when modernizing a legacy capability or asking for Databricks-level diligence. Trigger with "production upgrade", "modernize this skill", "bring this pack to production quality", or "audit and rebuild this plugin".SecuritateFără avertismente★ 2,9 K↓ —
- validator-expertjeremylongshore/tons-of-skills-marketplaceValidate production readiness of Vertex AI Agent Engine deployments across security, monitoring, performance, compliance, and best practices. Generates weighted scores (0-100%) with actionable remediation plans. Use when asked to validate a deployment, run a production readiness check, audit security posture, or verify compliance for Vertex AI agents. Trigger with "validate deployment", "production readiness", "security audit", "compliance check", "is this agent ready for prod", "check my ADK agent", "review before deploy", or "production readiness check". Make sure to use this skill whenever validating ADK agents for Agent Engine.SecuritateFără avertismente★ 2,9 K↓ —
- fuzzing-apisjeremylongshore/tons-of-skills-marketplaceConfigure perform API fuzzing to discover edge cases, crashes, and security vulnerabilities. Use when performing specialized testing. Trigger with phrases like "fuzz the API", "run fuzzing tests", or "discover edge cases".SecuritateFără avertismente★ 2,9 K↓ —
- securityparcadei/Continuous-Claude-v3Security audit workflow - vulnerability scan → verificationSecuritateFără avertismente★ 3,9 K↓ —
- amazon-competitor-analyzerbrowser-act/skillsScrapes Amazon product data from ASINs using browseract.com automation API and performs surgical competitive analysis. Compares specifications, pricing, review quality, and visual strategies to identify competitor moats and vulnerabilities.SecuritateFără avertismente★ 6,2 K↓ —
atr-benign-control
cisco-ai-defense/skill-scanner
SecuritateActualizat ieri
De la autor
Security Scanner for Agent Skills
Antetul nu a putut fi citit (no frontmatter); afișăm numele folderului.
Instalare
npx skills add cisco-ai-defense/skill-scanner --skill atr-benign-control -a claude-code
Se instalează în .claude/skills/atr-benign-control/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Fără descărcare: licența acestui skill (Personalizată sau neclară) nu ne permite să-i redistribuim fișierele. Comenzile de instalare le iau direct de pe GitHub.
La ce are acces
Doar instrucțiuniNu am văzut acces la rețeaLicență: Personalizată sau neclară
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 84
Securitate100
Proveniență81
Întreținere100
Licență45
Adopție55
Fișiere (1)
- SKILL.md