代理技能

• entra-app-registration microsoft/azure-skills

  Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

  539,973 通過 npx skills add microsoft/azure-skills --skill entra-app-registration

• azure-compliance microsoft/azure-skills

  Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

  539,841 通過 npx skills add microsoft/azure-skills --skill azure-compliance

• firebase-auth-basics firebase/agent-skills

  Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

  164,073 通過 npx skills add firebase/agent-skills --skill firebase-auth-basics

• firebase-security-rules-auditor firebase/agent-skills

  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

  127,967 通過 npx skills add firebase/agent-skills --skill firebase-security-rules-auditor

• convex-setup-auth get-convex/agent-skills

  93,851 通過 npx skills add get-convex/agent-skills --skill convex-setup-auth

• gws-shared googleworkspace/cli

  gws CLI: Shared patterns for authentication, global flags, and output formatting.

  63,275 通過 npx skills add googleworkspace/cli --skill gws-shared

• clerk-setup clerk/skills

  Set up Clerk authentication in any project with the Clerk CLI and official framework quickstarts. Use when adding Clerk, initializing Clerk, scaffolding a new app with Clerk, or migrating an existing authentication system to Clerk.

  51,701 通過 npx skills add clerk/skills --skill clerk-setup

• nodejs-backend-patterns wshobson/agents

  Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.

  46,933 通過 npx skills add wshobson/agents --skill nodejs-backend-patterns

• extension-to-functions-codebase firebase/agent-skills

  Skill for converting an installed Firebase Extension (or extension source) into a standalone Cloud Functions for Firebase codebase or publishable npm package, including V1 to V2 trigger upgrades, lifecycle hooks, and declarative security

  46,270 通過 npx skills add firebase/agent-skills --skill extension-to-functions-codebase

• better-auth-security-best-practices better-auth/skills

  Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.

  40,387 通過 npx skills add better-auth/skills --skill better-auth-security-best-practices

• golang-security samber/cc-skills-golang

  Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

  38,127 通過 npx skills add samber/cc-skills-golang --skill golang-security

• golang-swagger samber/cc-skills-golang

  Golang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files.

  33,563 通過 npx skills add samber/cc-skills-golang --skill golang-swagger

• convex-auth get-convex/agent-skills

  Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring.

  29,116 通過 npx skills add get-convex/agent-skills --skill convex-auth

• convex-reviewer get-convex/agent-skills

  Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

  29,005 通過 npx skills add get-convex/agent-skills --skill convex-reviewer

• convex-optimize get-convex/agent-skills

  Audit and optimize an existing Convex app: security, scale, upgrades, observability.

  28,969 通過 npx skills add get-convex/agent-skills --skill convex-optimize

• clerk clerk/skills

  Clerk authentication router. Use when user asks about Clerk CLI operations,

  28,655 通過 npx skills add clerk/skills --skill clerk

• docker-expert sickn33/agentic-awesome-skills

  You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.

  26,979 通過 npx skills add sickn33/agentic-awesome-skills --skill docker-expert

• security-requirement-extraction wshobson/agents

  Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

  22,606 通過 npx skills add wshobson/agents --skill security-requirement-extraction

• skill-vetter useai-pro/openclaw-skills-security

  Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources.

  21,002 通過 npx skills add useai-pro/openclaw-skills-security --skill skill-vetter

• firestore-security-rules-auditor firebase/agent-skills

  20,399 通過 npx skills add firebase/agent-skills --skill firestore-security-rules-auditor

• security-review affaan-m/ecc

  Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

  17,188 通過 npx skills add affaan-m/ecc --skill security-review

• threat-mitigation-mapping wshobson/agents

  Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

  17,089 通過 npx skills add wshobson/agents --skill threat-mitigation-mapping

• firestore-rules-creation firebase/agent-skills

  Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.

  14,980 通過 npx skills add firebase/agent-skills --skill firestore-rules-creation

• solidity-security wshobson/agents

  Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

  14,844 通過 npx skills add wshobson/agents --skill solidity-security

• google-cloud-recipe-auth google/skills

  Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

  14,218 通過 npx skills add google/skills --skill google-cloud-recipe-auth

• k8s-security-policies wshobson/agents

  Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

  14,140 通過 npx skills add wshobson/agents --skill k8s-security-policies

• clerk-android clerk/skills

  Implement Clerk authentication for native Android apps using Kotlin and

  13,564 通過 npx skills add clerk/skills --skill clerk-android

• google-cloud-waf-security google/skills

  Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.

  13,416 通過 npx skills add google/skills --skill google-cloud-waf-security

• deployment-pipeline-design wshobson/agents

  Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.

  13,176 通過 npx skills add wshobson/agents --skill deployment-pipeline-design

• clerk-expo clerk/skills

  Add Clerk authentication to Expo and React Native apps using @clerk/expo.

  13,027 通過 npx skills add clerk/skills --skill clerk-expo

• postgres-patterns affaan-m/ecc

  PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices. Use when designing PostgreSQL schemas, indexes, or RLS policies, or when a query is too slow.

  11,800 通過 npx skills add affaan-m/ecc --skill postgres-patterns

• java-spring-boot pluginagentmarketplace/custom-plugin-java

  Build production Spring Boot applications - REST APIs, Security, Data, Actuator

  11,748 通過 npx skills add pluginagentmarketplace/custom-plugin-java --skill java-spring-boot

• email-best-practices resend/resend-skills

  Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or deciding transactional vs marketing.

  11,379 通過 npx skills add resend/resend-skills --skill email-best-practices

• create-auth better-auth/skills

  Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

  11,275 通過 npx skills add better-auth/skills --skill create-auth

• django-security affaan-m/ecc

  Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations. Use when reviewing Django authentication, authorization, input handling, or deployment settings.

  11,091 通過 npx skills add affaan-m/ecc --skill django-security

• springboot-security affaan-m/ecc

  Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting.

  10,878 通過 npx skills add affaan-m/ecc --skill springboot-security

• sast-configuration wshobson/agents

  Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

  10,213 通過 npx skills add wshobson/agents --skill sast-configuration

• verification-loop affaan-m/ecc

  Run a six-phase verification of a Claude Code session's work — build, type check, lint, tests with coverage, security grep, and diff review — then produce a PASS/FAIL verification report. Use when verifying work after completing a feature or refactor, before creating a PR, or when quality gates must pass.

  9,948 通過 npx skills add affaan-m/ecc --skill verification-loop

• linkerd-patterns wshobson/agents

  Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

  9,708 通過 npx skills add wshobson/agents --skill linkerd-patterns

• django-verification affaan-m/ecc

  Run the full Django verification loop — environment check, mypy/ruff/black linting, migration safety, pytest with coverage targets, pip-audit and bandit security scans, settings and logging review, and diff review — producing a phased pass/fail report before release or PR. Use when preparing a Django pull request, validating migrations or coverage, or running pre-deploy readiness checks.

  9,567 通過 npx skills add affaan-m/ecc --skill django-verification

• laravel-tdd affaan-m/ecc

  Laravel testing strategies with PHPUnit, Pest, model factories, HTTP tests, Sanctum authentication testing, mocking, and coverage. Use when writing Laravel tests with PHPUnit or Pest, or driving a Laravel feature test-first.

  9,553 通過 npx skills add affaan-m/ecc --skill laravel-tdd

• springboot-verification affaan-m/ecc

  Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency and secret scans, and diff review — producing a pass/fail readiness report. Use when preparing a Spring Boot pull request, validating coverage thresholds, or running pre-deploy verification.

  9,482 通過 npx skills add affaan-m/ecc --skill springboot-verification

• flutter-dart-code-review affaan-m/ecc

  Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture. Use when reviewing Flutter or Dart code, whatever state management library the project uses.

  9,057 通過 npx skills add affaan-m/ecc --skill flutter-dart-code-review

• neon-auth neondatabase/agent-skills

  Add authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, passkeys, MFA, trusted domains, invalid domain, and @neondatabase/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neondatabase/neon-js.

  8,795 通過 npx skills add neondatabase/agent-skills --skill neon-auth

• api-security-best-practices sickn33/agentic-awesome-skills

  Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

  8,742 通過 npx skills add sickn33/agentic-awesome-skills --skill api-security-best-practices

• typespec-create-api-plugin github/awesome-copilot

  Generate a TypeSpec API plugin with REST operations, authentication, and Adaptive Cards for Microsoft 365 Copilot

  8,699 通過 npx skills add github/awesome-copilot --skill typespec-create-api-plugin

• perl-security affaan-m/ecc

  Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.

  8,662 通過 npx skills add affaan-m/ecc --skill perl-security

• laravel-verification affaan-m/ecc

  Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness. Use when verifying a Laravel project before merge or deploy — lint, static analysis, tests, coverage, security.

  8,340 通過 npx skills add affaan-m/ecc --skill laravel-verification

• hipaa-compliance affaan-m/ecc

  HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

  7,643 通過 npx skills add affaan-m/ecc --skill hipaa-compliance

• differential-review trailofbits/skills

  Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.

  7,318 通過 npx skills add trailofbits/skills --skill differential-review

• integration-privy solana-mobile/solana-mobile-skills

  Add Privy authentication to a Solana Expo Android app on top of Mobile Wallet Adapter, using Sign-In-With-Solana. Use when installing @privy-io/expo, mounting PrivyProvider, logging a user in with useLoginWithSiws, linking a wallet to an existing Privy account, reading the Privy access token from a backend, or debugging a Privy plus MWA setup.

  6,836 通過 npx skills add solana-mobile/solana-mobile-skills --skill integration-privy

• query-token-audit binance/binance-skills-hub

  Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.

  6,593 通過 npx skills add binance/binance-skills-hub --skill query-token-audit

• find-bugs getsentry/skills

  Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

  6,505 通過 npx skills add getsentry/skills --skill find-bugs

• nextjs-supabase-auth sickn33/agentic-awesome-skills

  Expert integration of Supabase Auth with Next.js App Router

  6,499 通過 npx skills add sickn33/agentic-awesome-skills --skill nextjs-supabase-auth

• fastapi-patterns affaan-m/ecc

  FastAPI best practices covering project structure, Pydantic v2 schemas, dependency injection, async handlers, authentication, authorization, transactional service layers, and testing with httpx and pytest. Use when building or reviewing FastAPI apps — Pydantic schemas, dependencies, async handlers, auth, or tests.

  6,235 通過 npx skills add affaan-m/ecc --skill fastapi-patterns

• securing-s3-buckets aws/agent-toolkit-for-aws

  Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

  6,136 通過 npx skills add aws/agent-toolkit-for-aws --skill securing-s3-buckets

• quarkus-security affaan-m/ecc

  Quarkus security implementation patterns: JWT and OIDC authentication, @RolesAllowed RBAC and SecurityIdentity checks, Bean Validation and custom validators, parameterized Panache queries, BCrypt password hashing, CORS and security headers, rate limiting, audit logging, Vault or environment-variable secrets, and dependency CVE scanning. Use when adding authentication or authorization, validating input, managing secrets, or hardening a Quarkus application.

  5,657 通過 npx skills add affaan-m/ecc --skill quarkus-security

• launching-ec2-instance-with-best-practices aws/agent-toolkit-for-aws

  Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization.

  5,639 通過 npx skills add aws/agent-toolkit-for-aws --skill launching-ec2-instance-with-best-practices

• quarkus-verification affaan-m/ecc

  Verification loop for Quarkus projects: build, static analysis (Checkstyle, PMD, SpotBugs), tests with JaCoCo coverage, OWASP dependency and container security scans, GraalVM native compilation, health checks, and config validation. Use when verifying a Quarkus service before a PR, after major refactoring or dependency upgrades, or pre-deploy.

  5,616 通過 npx skills add affaan-m/ecc --skill quarkus-verification

• decision-records skymavis/skills

  Draft, promote, archive, and supersede ADR-style decision records (types are open: architecture, product, security, policy, legal, …) and keep INDEX.md and cross-links generated, via the bundled scripts/decisions.py tool. Use when creating or promoting decision drafts, superseding or archiving a decision, fixing a promotion breach, flattening the old per-type accepted/ layout, or running build, check, promote, rename-draft-id, migrate-layout, or install.

  5,570 通過 npx skills add skymavis/skills --skill decision-records

• okx-cex-auth okx/agent-skills

  Use this skill when the user wants to 'login/log in/sign in', 'authenticate', 'authorize', 'connect OKX account', 'set up credentials', 'first time setup', 'configure okx', '登录', '授权', '认证', '连接账户', '首次配置'. Also when any OKX CLI command fails with an auth error: 'Run okx auth login first', 'Session expired', 'not authenticated', 'requires_auth', '401 Unauthorized', 'token expired/not found', 'StorageNotFoundError', '会话过期', '未认证', '需要登录'. Also when the user asks about login status or the login was interrupted. Also when the user wants to install/update/check/remove the okx-auth binary — 'install/update/remove auth', 'download okx-auth', '安装/更新/卸载认证', 'auth binary status', 'Failed to spawn okx-auth'. Also use before using okx-cex-trade/portfolio/earn/bot for the first time. Do NOT use for market data queries (use okx-cex-market).

  5,545 通過 npx skills add okx/agent-skills --skill okx-cex-auth

• creating-production-vpc-multi-az aws/agent-toolkit-for-aws

  Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic CIDR planning and DNS resolution.

  5,500 通過 npx skills add aws/agent-toolkit-for-aws --skill creating-production-vpc-multi-az

• setting-up-cloudtrail-multi-region aws/agent-toolkit-for-aws

  Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.

  5,375 通過 npx skills add aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region

• security-review github/awesome-copilot

  AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

  5,304 通過 npx skills add github/awesome-copilot --skill security-review

• solana-vulnerability-scanner trailofbits/skills

  Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

  5,278 通過 npx skills add trailofbits/skills --skill solana-vulnerability-scanner

• audit-prep-assistant trailofbits/skills

  Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.

  5,273 通過 npx skills add trailofbits/skills --skill audit-prep-assistant

• entry-point-analyzer trailofbits/skills

  Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

  5,215 通過 npx skills add trailofbits/skills --skill entry-point-analyzer

• algorand-vulnerability-scanner trailofbits/skills

  Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

  4,851 通過 npx skills add trailofbits/skills --skill algorand-vulnerability-scanner

• qianwen-ops-auth qianwen-ai/qianwen-ai

  Configure authentication (API keys, endpoints). TRIGGER when: setting up QIANWEN_API_KEY, troubleshooting 401/auth errors, when another skill reports missing credentials, or user explicitly invokes this skill by name (e.g. use qianwen-ops-auth). DO NOT TRIGGER when: non-auth Qwen tasks, general API usage questions.

  4,848 通過 npx skills add qianwen-ai/qianwen-ai --skill qianwen-ops-auth

• data-manager-api-setup google/skills

  Guides developers through client library installation and authentication setup steps for the Data Manager API. Use this skill when a user is getting started with the Data Manager API and needs to setup their local environment, install the client library, or setup access to the API. Don't use for implementing audience or event ingestion logic (use the data-manager-api-audience-ingestion or data-manager-api-event-ingestion skills instead).

  4,754 通過 npx skills add google/skills --skill data-manager-api-setup

• secret-scanning github/awesome-copilot

  Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.

  4,484 通過 npx skills add github/awesome-copilot --skill secret-scanning

• security monitoring claude-office-skills/skills

  Automate security monitoring, threat detection, incident response, and compliance workflows

  4,137 通過 npx skills add claude-office-skills/skills --skill security-monitoring

• gke-platform-security google/skills

  Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security).

  4,035 通過 npx skills add google/skills --skill gke-platform-security

• gke-workload-security google/skills

  Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

  4,010 通過 npx skills add google/skills --skill gke-workload-security

• rds-sqlserver aws/agent-toolkit-for-aws

  Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme shows NTLM instead of KERBEROS on ECS Fargate, SSM tunnel to RDS SQL Server from laptop, port 1433 security group, TrustServerCertificate=True for localhost tunnels, SPN MSSQLSvc, AWS Managed Microsoft AD, CNAME not RDS endpoint for Kerberos, tds_version='7.4', encryption='require', port-as-string for pymssql, Secrets Manager credential caching in Lambda, error 18456 login failed. Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (JDBC mssql-jdbc), Node.js (tedious), IAM auth via RDS Proxy, and VPC/ECS/EKS/Lambda deployment.

  3,948 通過 npx skills add aws/agent-toolkit-for-aws --skill rds-sqlserver

• gke-productionize google/skills

  Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).

  3,818 通過 npx skills add google/skills --skill gke-productionize

• trailmark trailofbits/skills

  Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.

  3,597 通過 npx skills add trailofbits/skills --skill trailmark

• api-sec yaklang/hack-skills

  Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

  3,590 通過 npx skills add yaklang/hack-skills --skill api-sec

• aws-auth aws/agent-toolkit-for-aws

  Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

  3,535 通過 npx skills add aws/agent-toolkit-for-aws --skill aws-auth

• graph-evolution trailofbits/skills

  Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.

  3,534 通過 npx skills add trailofbits/skills --skill graph-evolution

• platform-encryption-configure forcedotcom/sf-skills

  Configure Salesforce Shield Platform Encryption — generate deployable encryption settings and encrypted-field metadata, and answer key-model and lifecycle questions. TRIGGER when: user wants to turn on deterministic encryption, encrypt a field, set up Cache-Only Keys, External Key Management, or replay detection, or mentions Shield Platform Encryption, encryption at rest, deterministic vs probabilistic encryption, encryptionScheme, PlatformEncryptionSettings, EncryptionKeySettings, BYOK, BYOKMS, tenant secrets, key rotation, or .settings-meta.xml / .field-meta.xml for encryption — even when they don't say 'Shield'. SKIP when: user needs a generic custom field with no encryption (use platform-custom-field-generate), needs the raw Metadata API type reference (use platform-metadata-api-context-get), or asks about Classic Encryption (encrypted text fields), which is a different feature. Use this skill for any Platform Encryption configuration, field-encryption, or key-model question.

  3,494 通過 npx skills add forcedotcom/sf-skills --skill platform-encryption-configure

• api-auth-and-jwt-abuse yaklang/hack-skills

  API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

  3,448 通過 npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse

• c-review trailofbits/skills

  Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

  3,310 通過 npx skills add trailofbits/skills --skill c-review

• aws-security aws/agent-toolkit-for-aws

  Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

  3,267 通過 npx skills add aws/agent-toolkit-for-aws --skill aws-security

• mailtrap-email-integration affaan-m/ecc

  Guides agents through integrating transactional email sending via Mailtrap's Email API, including sandbox testing, domain verification, and API authentication. Use when implementing email-sending features, debugging delivery issues, or setting up safe dev/staging email testing.

  3,174 通過 npx skills add affaan-m/ecc --skill mailtrap-email-integration

• 10x-cli-setup przeprogramowani/10x-cli

  Set up or troubleshoot @przeprogramowani/10x-cli for a 10xDevs learner: reuse or install a compatible CLI, check authentication and course access, choose the project and AI tool, and hand off to 10x-cli-guide. Use for installation, updates, npm permissions and onboarding. Excludes CLI source development and everyday download/use/sync guidance once setup is ready.

  3,040 通過 npx skills add przeprogramowani/10x-cli --skill 10x-cli-setup

• security markdown-viewer/skills

  Create visuals in Markdown documents: charts, diagrams, cards, architecture and page layouts. Charts and analytical views (bar, line, pie, heatmap, correlation, regression); reliability and operations (latency, incident, throughput, cycle time, OKR, standup, on-call); product and finance (funnel, retention, revenue, budget); process and workflow (approval, BPMN); software design and behaviour (class, state machine, sequence, C4); dependencies and impact (dependency graph, ER, causality); system architecture as an HTML page (layer stack, wings, zones, topology, service catalogue, request paths); infrastructure (cloud, Kubernetes, ETL, network, security, IAM, compliance); governance and people (ArchiMate, org chart, hiring); knowledge and planning (mind map, roadmap, Gantt, migration); documents (comparison, SWOT, memo, policy, catalogue, case study). Use when a document needs a diagram, chart or card. Not for slide decks or math notation. Not recommended: mermaid / canvas / drawio / dot.

  2,919 通過 npx skills add markdown-viewer/skills --skill security

• cloud-network-security elastic/agent-skills

  2,769 通過 npx skills add elastic/agent-skills --skill cloud-network-security

• swift-security dpearson2699/swift-ios-skills

  Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

  2,737 通過 npx skills add dpearson2699/swift-ios-skills --skill swift-security

• convex-security-check waynesutton/builder-skills

  Ten minute security pass over a Convex backend: public functions that should be internal, missing auth checks, unvalidated args, IDs from the client trusted without ownership checks, secrets in code. Use before merging a pull request, after adding new public functions, or when the user says 'quick security check'.

  2,718 通過 npx skills add waynesutton/builder-skills --skill convex-security-check

• platform-architecture-analyze forcedotcom/sf-skills

  Use when the developer asks to "review the architecture", "run a Well-Architected check", "audit this project", "is this project well-architected?", or wants to assess security/governor-limit/risk as a holistic code-and-metadata health report. Grades observable criteria (sharing/FLS, bulkification, SOQL selectivity, packageability) with file:line evidence; emits a governance checklist for what it can't see. Read-only, never edits. DO NOT TRIGGER for single-tool Apex scans (dx-code-analyzer-run).

  2,686 通過 npx skills add forcedotcom/sf-skills --skill platform-architecture-analyze

• netlify-identity netlify/context-and-tools

  Add user authentication to a Netlify site with @netlify/identity — signup/login/logout, Google/GitHub/GitLab/Bitbucket OAuth, server-side getUser() checks, role-based access control, and Identity event functions. Use it when a task involves adding a login or signup form, gating content to members or roles, "auth middleware" or verifying users in Netlify Functions or Edge Functions, handling OAuth or email-confirmation callbacks, assigning roles at signup, or customizing Identity emails. For locking a whole site to your company or employees-only access, use netlify-access-control instead.

  2,641 通過 npx skills add netlify/context-and-tools --skill netlify-identity

• login-flow nexu-io/open-design

  Mobile login and authentication flow screens

  2,635 通過 npx skills add nexu-io/open-design --skill login-flow

• porters-five-forces phuryn/pm-skills

  Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants. Use when analyzing industry dynamics, assessing competitive forces, or evaluating market attractiveness.

  2,613 通過 npx skills add phuryn/pm-skills --skill porters-five-forces

• code-review-pro onewave-ai/claude-skills

  Performs a deep code review of files, modules, a diff, or a branch - finding security vulnerabilities (mapped to OWASP Top 10:2025), correctness bugs, performance problems, and maintainability issues - and returns severity-ranked findings with evidence and concrete fixes. Use when the user asks to review, audit, or sanity-check code, asks "is this safe", "what's wrong with this", "find bugs", or wants a security or performance pass before shipping. For posting line comments on a GitHub pull request, use git-pr-reviewer.

  2,535 通過 npx skills add onewave-ai/claude-skills --skill code-review-pro

• thermo-nuclear-review cursor/plugins

  Comprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.

  2,480 通過 npx skills add cursor/plugins --skill thermo-nuclear-review

• access-protected-vercel-deployment vercel/vercel-plugin

  Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection. Use when curl, agent-browser, Playwright, or another automated request reaches a Vercel login or protection page; when a protected preview or production URL returns 401 or 403; when TRUSTED_SOURCES_ENVIRONMENT_MISMATCH appears; or when choosing between `vercel curl` and the `x-vercel-trusted-oidc-idp-token` header.

  2,473 通過 npx skills add vercel/vercel-plugin --skill access-protected-vercel-deployment

• experience-ui-bundle-mfa-configure forcedotcom/sf-skills

  Configure Multi-Factor Authentication (MFA) for Salesforce Experience Site users. TRIGGER when: user wants to enable MFA on a community, enforce two-factor authentication for portal users, add MFA to a React Experience Site / Web App, configure ForceTwoFactor permission, create MFA permission sets for external users, or troubleshoot MFA not appearing on login. Also triggers on: MFA community, two-factor portal, ForceTwoFactor permission set, MFA Experience Cloud, MFA React site, identity verification community, MFA experience site, ForceTwoFactor permissionset-meta.xml, MFA permissionset-meta.xml. DO NOT TRIGGER when: configuring org-wide MFA for internal users (that's Setup > Identity Verification), building custom login UI components (use experience-ui-bundle-frontend-generate), or generating generic permission sets without MFA context (use platform-permission-set-generate).

  2,435 通過 npx skills add forcedotcom/sf-skills --skill experience-ui-bundle-mfa-configure

• code-review-analysis aj-geddes/useful-ai-prompts

  Perform comprehensive code reviews with best practices, security checks, and constructive feedback. Use when reviewing pull requests, analyzing code quality, checking for security vulnerabilities, or providing code improvement suggestions.

  2,408 通過 npx skills add aj-geddes/useful-ai-prompts --skill code-review-analysis

• snyk-agent-scan-compliance samber/cc-skills

  Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.

  2,386 通過 npx skills add samber/cc-skills --skill snyk-agent-scan-compliance

說明文字由作者本人以英文撰寫。安裝前請先到儲存庫閱讀技能的程式碼。