💻 Development & Engineering
4,210 skills
affaan-m/springboot-verification
development
VerifiedTrustedCommunity
Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.
230,706SKILL.mdUpdated Mar 27, 2026
affaan-m/security-review
development
VerifiedTrustedCommunity
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
223,554SKILL.mdUpdated Mar 27, 2026
addyosmani/security-and-hardening
development
VerifiedTrustedCommunity
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
77,380SKILL.mdUpdated Mar 27, 2026
garrytan/cso
testing
VerifiedTrustedCommunity
Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".
71,662SKILL.mdUpdated Apr 4, 2026
paperclipai/deal-with-security-advisory
tools
VerifiedTrustedCommunity
Handle a GitHub Security Advisory response for Paperclip, including confidential fix development in a temporary private fork, human coordination on advisory-thread comments, CVE request, synchronized advisory publication, and immediate security release steps.
53,860SKILL.mdUpdated Apr 15, 2026
wshobson/stride-analysis-patterns
testing
VerifiedTrustedCommunity
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
35,806SKILL.mdUpdated Apr 25, 2026
wshobson/deployment-pipeline-design
development
VerifiedTrustedCommunity
Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.
35,806SKILL.mdUpdated Apr 25, 2026
sickn33/api-security-best-practices
development
VerifiedTrustedCommunity
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
33,084SKILL.mdUpdated Apr 13, 2026
sickn33/007
development
VerifiedTrustedCommunity
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
33,084SKILL.mdUpdated Apr 13, 2026
github/security-review
tools
VerifiedTrustedOfficial
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
27,569SKILL.mdUpdated Mar 30, 2026
github/doublecheck
development
VerifiedTrustedOfficial
Three-layer verification pipeline for AI output. Extracts verifiable claims, finds supporting or contradicting sources via web search, runs adversarial review for hallucination patterns, and produces a structured verification report with source links for human review.
25,862SKILL.mdUpdated Mar 18, 2026
davila7/github-actions-templates
development
VerifiedTrustedCommunity
Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.
24,615SKILL.mdUpdated Apr 15, 2026
davila7/WordPress Penetration Testing
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
24,615SKILL.mdUpdated Apr 15, 2026
mukul975/detecting-attacks-on-historian-servers
testing
VerifiedTrustedCommunity
Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.
21,871SKILL.mdUpdated Jun 27, 2026
mukul975/detecting-api-enumeration-attacks
development
VerifiedTrustedCommunity
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
21,871SKILL.mdUpdated Jun 27, 2026
alirezarezvani/fda-consultant-specialist
development
VerifiedTrustedCommunity
FDA regulatory consultant for medical device companies. Provides 510(k)/PMA/De Novo pathway guidance, QMSR (21 CFR 820, which incorporates ISO 13485:2016 by reference since 2026-02-02; formerly QSR) compliance, HIPAA assessments, and device cybersecurity. Use when user mentions FDA submission, 510(k), PMA, De Novo, QMSR, QSR, ISO 13485 for FDA, premarket, predicate device, substantial equivalence, HIPAA medical device, or FDA cybersecurity.
19,611SKILL.mdUpdated May 18, 2026
alirezarezvani/skill-security-auditor
tools
VerifiedTrustedCommunity
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".
17,936SKILL.mdUpdated May 15, 2026
rightnow-ai/security-audit
development
VerifiedTrustedCommunity
Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology
16,813SKILL.mdUpdated Apr 20, 2026
rightnow-ai/ci-cd
tools
VerifiedTrustedCommunity
CI/CD pipeline expert for GitHub Actions, GitLab CI, Jenkins, and deployment automation
16,813SKILL.mdUpdated Apr 20, 2026
benbjohnson/litestream
tools
VerifiedTrustedCommunity
Expert knowledge for contributing to Litestream, a standalone disaster recovery tool for SQLite. Provides architectural understanding, code patterns, critical rules, and debugging procedures for WAL monitoring, LTX replication format, storage backend implementation, multi-level compaction, and SQLite page management. Use when working with Litestream source code, writing storage backends, debugging replication issues, implementing compaction logic, or handling SQLite WAL operations.
13,453SKILL.mdUpdated Apr 16, 2026