Agent skills

• entra-app-registration microsoft/azure-skills

  Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

  539,973 Passed npx skills add microsoft/azure-skills --skill entra-app-registration -a cursor

• azure-compliance microsoft/azure-skills

  Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

  539,841 Passed npx skills add microsoft/azure-skills --skill azure-compliance -a cursor

• firebase-auth-basics firebase/agent-skills

  Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

  164,073 Passed npx skills add firebase/agent-skills --skill firebase-auth-basics -a cursor

• firebase-security-rules-auditor firebase/agent-skills

  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

  127,967 Passed npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a cursor

• firebase-firestore firebase/agent-skills

  Sets up, manages, queries, and configures Cloud Firestore databases (Standard/Enterprise edition), including data modeling, security rules, indexes, and SDK integrations (Web, Python, iOS, Android, Flutter). Use when creating/listing Firestore databases, defining data models/indexes, writing SDK queries, or integrating Firestore SDKs. For authoring or modifying Firestore Security Rules (firestore.rules), delegate to the firestore-rules-author subagent if subagent delegation is available, or use firestore-rules-creation otherwise. Don't use for Firebase Hosting, Data Connect, Auth, Storage/GCS, Crashlytics, Functions, or BigQuery.

  124,678 Warnings npx skills add firebase/agent-skills --skill firebase-firestore -a cursor

• better-auth-best-practices better-auth/skills

  Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.

  117,466 Warnings npx skills add better-auth/skills --skill better-auth-best-practices -a cursor

• vercel-cli-with-tokens vercel-labs/agent-skills

  Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

  116,013 Warnings npx skills add vercel-labs/agent-skills --skill vercel-cli-with-tokens -a cursor

• cloudflare cloudflare/skills

  Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation.

  111,081 Failed npx skills add cloudflare/skills --skill cloudflare -a cursor

• convex-setup-auth get-convex/agent-skills

  93,851 Passed npx skills add get-convex/agent-skills --skill convex-setup-auth -a cursor

• playwright-best-practices currents-dev/playwright-best-practices-skill

  Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.

  89,981 Failed npx skills add currents-dev/playwright-best-practices-skill --skill playwright-best-practices -a cursor

• gws-shared googleworkspace/cli

  gws CLI: Shared patterns for authentication, global flags, and output formatting.

  63,275 Passed npx skills add googleworkspace/cli --skill gws-shared -a cursor

• investigate-without-getting-made useosint/skills

  Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from real identity, build and age a sockpuppet research persona, and choose between VPN, residential proxy and Tor. Use when setting up a research account, avoiding tipping off a subject, worrying about LinkedIn profile-view leakage, needing a burner phone or email, or hardening a research VM or browser profile. Applies to covert due diligence, insider-threat investigation, source protection in journalism, and law-enforcement online work. Reference at useosint.com/skills/investigate-without-getting-made.

  58,130 Warnings npx skills add useosint/skills --skill investigate-without-getting-made -a cursor

• security-and-hardening addyosmani/agent-skills

  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

  51,780 Warnings npx skills add addyosmani/agent-skills --skill security-and-hardening -a cursor

• clerk-setup clerk/skills

  Set up Clerk authentication in any project with the Clerk CLI and official framework quickstarts. Use when adding Clerk, initializing Clerk, scaffolding a new app with Clerk, or migrating an existing authentication system to Clerk.

  51,701 Passed npx skills add clerk/skills --skill clerk-setup -a cursor

• clerk-custom-ui clerk/skills

  Custom authentication flows and component appearance - hooks (useSignIn,

  50,415 Warnings npx skills add clerk/skills --skill clerk-custom-ui -a cursor

• nodejs-backend-patterns wshobson/agents

  Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.

  46,933 Passed npx skills add wshobson/agents --skill nodejs-backend-patterns -a cursor

• extension-to-functions-codebase firebase/agent-skills

  Skill for converting an installed Firebase Extension (or extension source) into a standalone Cloud Functions for Firebase codebase or publishable npm package, including V1 to V2 trigger upgrades, lifecycle hooks, and declarative security

  46,270 Passed npx skills add firebase/agent-skills --skill extension-to-functions-codebase -a cursor

• better-auth-security-best-practices better-auth/skills

  Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.

  40,387 Passed npx skills add better-auth/skills --skill better-auth-security-best-practices -a cursor

• email-and-password-best-practices better-auth/skills

  Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

  39,452 Warnings npx skills add better-auth/skills --skill email-and-password-best-practices -a cursor

• golang-security samber/cc-skills-golang

  Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

  38,127 Passed npx skills add samber/cc-skills-golang --skill golang-security -a cursor

• golang-continuous-integration samber/cc-skills-golang

  GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).

  35,667 Warnings npx skills add samber/cc-skills-golang --skill golang-continuous-integration -a cursor

• golang-swagger samber/cc-skills-golang

  Golang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files.

  33,563 Passed npx skills add samber/cc-skills-golang --skill golang-swagger -a cursor

• two-factor-authentication-best-practices better-auth/skills

  Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

  32,174 Warnings npx skills add better-auth/skills --skill two-factor-authentication-best-practices -a cursor

• clerk-cli clerk/skills

  Operate the Clerk CLI (`clerk` binary) for authentication, user/org/session management, impersonation, local webhook testing, deploy verification, instance config, env keys, feature toggles, and any Clerk Backend, Platform, or Frontend API call. Use when the user mentions Clerk management tasks, "list clerk users", "impersonate a user", "test webhooks locally", "enable orgs", "enable billing", "clerk env pull", "clerk doctor", "clerk deploy", "clerk api", or any ad-hoc Clerk API request. Prefer the CLI over raw HTTP: it handles auth, key resolution, app/instance targeting, and formatting automatically.

  30,497 Warnings npx skills add clerk/skills --skill clerk-cli -a cursor

• create-auth-skill better-auth/skills

  29,263 Warnings npx skills add better-auth/skills --skill create-auth-skill -a cursor

• convex-auth get-convex/agent-skills

  Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring.

  29,116 Passed npx skills add get-convex/agent-skills --skill convex-auth -a cursor

• convex-reviewer get-convex/agent-skills

  Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

  29,005 Passed npx skills add get-convex/agent-skills --skill convex-reviewer -a cursor

• convex-optimize get-convex/agent-skills

  Audit and optimize an existing Convex app: security, scale, upgrades, observability.

  28,969 Passed npx skills add get-convex/agent-skills --skill convex-optimize -a cursor

• persona-it-admin googleworkspace/cli

  Administer IT — monitor security and configure Workspace.

  28,951 Warnings npx skills add googleworkspace/cli --skill persona-it-admin -a cursor

• clerk clerk/skills

  Clerk authentication router. Use when user asks about Clerk CLI operations,

  28,655 Passed npx skills add clerk/skills --skill clerk -a cursor

• docker-expert sickn33/agentic-awesome-skills

  You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.

  26,979 Passed npx skills add sickn33/agentic-awesome-skills --skill docker-expert -a cursor

• best-practices addyosmani/web-quality-skills

  Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

  26,365 Warnings npx skills add addyosmani/web-quality-skills --skill best-practices -a cursor

• validate-changes-match-specs warpdotdev/common-skills

  Validate that a branch or pull request implementation matches introduced product, technical, security, and related specs. Use when reviewing or finishing a spec-driven change and resolving mismatches between checked-in specs and implementation.

  23,956 Warnings npx skills add warpdotdev/common-skills --skill validate-changes-match-specs -a cursor

• security-audit cloudflare/security-audit-skill

  Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

  23,040 Warnings npx skills add cloudflare/security-audit-skill --skill security-audit -a cursor

• security-requirement-extraction wshobson/agents

  Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

  22,606 Passed npx skills add wshobson/agents --skill security-requirement-extraction -a cursor

• laravel-specialist jeffallan/claude-skills

  Build and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication, configuring Horizon queues, designing RESTful APIs with API resources, and building reactive interfaces with Livewire. Use when creating Laravel models, setting up queue workers, implementing Sanctum auth flows, building Livewire components, optimising Eloquent queries, or writing Pest/PHPUnit tests for Laravel features.

  22,438 Failed npx skills add jeffallan/claude-skills --skill laravel-specialist -a cursor

• skill-vetter useai-pro/openclaw-skills-security

  Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources.

  21,002 Passed npx skills add useai-pro/openclaw-skills-security --skill skill-vetter -a cursor

• firestore-security-rules-auditor firebase/agent-skills

  20,399 Passed npx skills add firebase/agent-skills --skill firestore-security-rules-auditor -a cursor

• security-review getsentry/skills

  Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

  18,924 Failed npx skills add getsentry/skills --skill security-review -a cursor

• auth-implementation-patterns wshobson/agents

  Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

  17,369 Warnings npx skills add wshobson/agents --skill auth-implementation-patterns -a cursor

• security-review affaan-m/ecc

  Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

  17,188 Passed npx skills add affaan-m/ecc --skill security-review -a cursor

• threat-mitigation-mapping wshobson/agents

  Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

  17,089 Passed npx skills add wshobson/agents --skill threat-mitigation-mapping -a cursor

• gmgn-token gmgnai/gmgn-skills

  Research any crypto or meme token by address — real-time price, market cap, liquidity, holder list, trader list, top Smart Money and KOL positions, security audit (honeypot, rug pull risk, dev wallet, renounced status), social links (Twitter/X, website) via GMGN API on Solana, BSC, Base, or Ethereum. Use when user asks about a token's price, safety, holders, traders, smart money exposure, or wants due diligence before buying.

  16,018 Warnings npx skills add gmgnai/gmgn-skills --skill gmgn-token -a cursor

• attack-tree-construction wshobson/agents

  Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

  15,317 Warnings npx skills add wshobson/agents --skill attack-tree-construction -a cursor

• firestore-rules-creation firebase/agent-skills

  Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.

  14,980 Passed npx skills add firebase/agent-skills --skill firestore-rules-creation -a cursor

• solidity-security wshobson/agents

  Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

  14,844 Passed npx skills add wshobson/agents --skill solidity-security -a cursor

• google-cloud-recipe-auth google/skills

  Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

  14,218 Passed npx skills add google/skills --skill google-cloud-recipe-auth -a cursor

• k8s-security-policies wshobson/agents

  Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

  14,140 Passed npx skills add wshobson/agents --skill k8s-security-policies -a cursor

• clerk-swift clerk/skills

  Implement Clerk authentication for native Swift and iOS apps using ClerkKit

  13,739 Warnings npx skills add clerk/skills --skill clerk-swift -a cursor

• clerk-android clerk/skills

  Implement Clerk authentication for native Android apps using Kotlin and

  13,564 Passed npx skills add clerk/skills --skill clerk-android -a cursor

• google-cloud-waf-security google/skills

  Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.

  13,416 Passed npx skills add google/skills --skill google-cloud-waf-security -a cursor

• sql-code-review github/awesome-copilot

  Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across all SQL databases (MySQL, PostgreSQL, SQL Server, Oracle). Focuses on SQL injection prevention, access control, code standards, and anti-pattern detection. Complements SQL optimization prompt for complete development coverage.

  13,388 Warnings npx skills add github/awesome-copilot --skill sql-code-review -a cursor

• code-review coderabbitai/skills

  Run CodeRabbit CLI reviews, retrieve saved local or GitHub PR fix prompts, and interpret CodeRabbit authentication and review output. Use for CodeRabbit review commands, committed/uncommitted or directory scopes, and CodeRabbit runbooks. Default code-review skill: also trigger for explicit code/PR/quality/security review requests or when a review is needed.

  13,381 Warnings npx skills add coderabbitai/skills --skill code-review -a cursor

• deployment-pipeline-design wshobson/agents

  Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.

  13,176 Passed npx skills add wshobson/agents --skill deployment-pipeline-design -a cursor

• clerk-expo clerk/skills

  Add Clerk authentication to Expo and React Native apps using @clerk/expo.

  13,027 Passed npx skills add clerk/skills --skill clerk-expo -a cursor

• docker-patterns affaan-m/ecc

  Docker and Docker Compose patterns for local development, hardened CLI installer harnesses, container security, networking, volumes, and multi-service orchestration. Use when creating or reviewing Dockerfiles and Compose services, testing installers across Linux distributions, or planning accurate native macOS and Windows validation.

  12,625 Failed npx skills add affaan-m/ecc --skill docker-patterns -a cursor

• secrets-management wshobson/agents

  Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

  12,504 Warnings npx skills add wshobson/agents --skill secrets-management -a cursor

• penetration-testing-with-strix usestrix/strix

  Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.

  11,976 Failed npx skills add usestrix/strix --skill penetration-testing-with-strix -a cursor

• postgres-patterns affaan-m/ecc

  PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices. Use when designing PostgreSQL schemas, indexes, or RLS policies, or when a query is too slow.

  11,800 Passed npx skills add affaan-m/ecc --skill postgres-patterns -a cursor

• java-spring-boot pluginagentmarketplace/custom-plugin-java

  Build production Spring Boot applications - REST APIs, Security, Data, Actuator

  11,748 Passed npx skills add pluginagentmarketplace/custom-plugin-java --skill java-spring-boot -a cursor

• fix-security-vulnerabilities-with-strix usestrix/strix

  Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.

  11,411 Warnings npx skills add usestrix/strix --skill fix-security-vulnerabilities-with-strix -a cursor

• email-best-practices resend/resend-skills

  Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or deciding transactional vs marketing.

  11,379 Passed npx skills add resend/resend-skills --skill email-best-practices -a cursor

• create-auth better-auth/skills

  Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

  11,275 Passed npx skills add better-auth/skills --skill create-auth -a cursor

• managed-pentesting-with-strix usestrix/strix

  Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing.

  11,175 Warnings npx skills add usestrix/strix --skill managed-pentesting-with-strix -a cursor

• ci-security-scanning-with-strix usestrix/strix

  Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.

  11,130 Warnings npx skills add usestrix/strix --skill ci-security-scanning-with-strix -a cursor

• django-security affaan-m/ecc

  Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations. Use when reviewing Django authentication, authorization, input handling, or deployment settings.

  11,091 Passed npx skills add affaan-m/ecc --skill django-security -a cursor

• springboot-security affaan-m/ecc

  Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting.

  10,878 Passed npx skills add affaan-m/ecc --skill springboot-security -a cursor

• laravel-security affaan-m/ecc

  Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.

  10,683 Failed npx skills add affaan-m/ecc --skill laravel-security -a cursor

• k8s-manifest-generator wshobson/agents

  Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests, creating K8s resources, or implementing production-grade Kubernetes configurations.

  10,604 Warnings npx skills add wshobson/agents --skill k8s-manifest-generator -a cursor

• sast-configuration wshobson/agents

  Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

  10,213 Passed npx skills add wshobson/agents --skill sast-configuration -a cursor

• security-scan affaan-m/ecc

  Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.

  10,182 Failed npx skills add affaan-m/ecc --skill security-scan -a cursor

• verification-loop affaan-m/ecc

  Run a six-phase verification of a Claude Code session's work — build, type check, lint, tests with coverage, security grep, and diff review — then produce a PASS/FAIL verification report. Use when verifying work after completing a feature or refactor, before creating a PR, or when quality gates must pass.

  9,948 Passed npx skills add affaan-m/ecc --skill verification-loop -a cursor

• security-best-practices openai/skills

  Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

  9,912 Failed npx skills add openai/skills --skill security-best-practices -a cursor

• linkerd-patterns wshobson/agents

  Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

  9,708 Passed npx skills add wshobson/agents --skill linkerd-patterns -a cursor

• code-review anthropics/knowledge-work-plugins

  Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.

  9,631 Warnings npx skills add anthropics/knowledge-work-plugins --skill code-review -a cursor

• django-verification affaan-m/ecc

  Run the full Django verification loop — environment check, mypy/ruff/black linting, migration safety, pytest with coverage targets, pip-audit and bandit security scans, settings and logging review, and diff review — producing a phased pass/fail report before release or PR. Use when preparing a Django pull request, validating migrations or coverage, or running pre-deploy readiness checks.

  9,567 Passed npx skills add affaan-m/ecc --skill django-verification -a cursor

• laravel-tdd affaan-m/ecc

  Laravel testing strategies with PHPUnit, Pest, model factories, HTTP tests, Sanctum authentication testing, mocking, and coverage. Use when writing Laravel tests with PHPUnit or Pest, or driving a Laravel feature test-first.

  9,553 Passed npx skills add affaan-m/ecc --skill laravel-tdd -a cursor

• springboot-verification affaan-m/ecc

  Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency and secret scans, and diff review — producing a pass/fail readiness report. Use when preparing a Spring Boot pull request, validating coverage thresholds, or running pre-deploy verification.

  9,482 Passed npx skills add affaan-m/ecc --skill springboot-verification -a cursor

• wordpress-pro jeffallan/claude-skills

  Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.

  9,165 Failed npx skills add jeffallan/claude-skills --skill wordpress-pro -a cursor

• flutter-dart-code-review affaan-m/ecc

  Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture. Use when reviewing Flutter or Dart code, whatever state management library the project uses.

  9,057 Passed npx skills add affaan-m/ecc --skill flutter-dart-code-review -a cursor

• neon-auth neondatabase/agent-skills

  Add authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, passkeys, MFA, trusted domains, invalid domain, and @neondatabase/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neondatabase/neon-js.

  8,795 Passed npx skills add neondatabase/agent-skills --skill neon-auth -a cursor

• api-security-best-practices sickn33/agentic-awesome-skills

  Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

  8,742 Passed npx skills add sickn33/agentic-awesome-skills --skill api-security-best-practices -a cursor

• kotlin-ktor-patterns affaan-m/ecc

  Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing. Use when building a Ktor server — routing, plugins, auth, DI, serialization, or tests.

  8,740 Warnings npx skills add affaan-m/ecc --skill kotlin-ktor-patterns -a cursor

• emblem-ai emblemcompany/agent-skills

  One-shot user management for apps, multi-chain wallet authentication, an AI-powered assistant, and AI app introspection. Use when the user wants to let website users sign in with wallets, email/password, or social login and give each user a wallet-enabled account, then embed EmblemAI chat surfaces, connect plugins, or add Reflexive observability. Provides React components, TypeScript SDKs, session-based authentication, and pointers to the React and agent-wallet skills for specialized workflows.

  8,730 Warnings npx skills add emblemcompany/agent-skills --skill emblem-ai -a cursor

• typespec-create-api-plugin github/awesome-copilot

  Generate a TypeSpec API plugin with REST operations, authentication, and Adaptive Cards for Microsoft 365 Copilot

  8,699 Passed npx skills add github/awesome-copilot --skill typespec-create-api-plugin -a cursor

• semgrep trailofbits/skills

  Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

  8,683 Warnings npx skills add trailofbits/skills --skill semgrep -a cursor

• perl-security affaan-m/ecc

  Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.

  8,662 Passed npx skills add affaan-m/ecc --skill perl-security -a cursor

• web-app-penetration-testing usestrix/strix

  Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.

  8,463 Warnings npx skills add usestrix/strix --skill web-app-penetration-testing -a cursor

• find-security-vulnerabilities-in-code usestrix/strix

  Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.

  8,423 Warnings npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -a cursor

• owasp-top-10-testing usestrix/strix

  Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.

  8,420 Warnings npx skills add usestrix/strix --skill owasp-top-10-testing -a cursor

• api-security-testing usestrix/strix

  Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.

  8,405 Warnings npx skills add usestrix/strix --skill api-security-testing -a cursor

• laravel-verification affaan-m/ecc

  Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness. Use when verifying a Laravel project before merge or deploy — lint, static analysis, tests, coverage, security.

  8,340 Passed npx skills add affaan-m/ecc --skill laravel-verification -a cursor

• application-security-testing usestrix/strix

  Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.

  8,295 Warnings npx skills add usestrix/strix --skill application-security-testing -a cursor

• reddit-search-api lignertys/reddit-research-skills

  Pure API reference for reddapi.dev - authentication, all endpoints (vector search, semantic search, trends, subreddit lookup), request parameters, response schemas, and error codes, with no research-workflow framing. Use when the user wants raw endpoint documentation, is debugging a reddapi.dev integration, needs exact request/response field names, or asks for 'reddapi API reference', 'reddapi.dev endpoints', or 'reddapi error codes'. For guided research workflows and query playbooks, see reddit-research. For B2B lead scoring, see reddit-leads.

  8,155 Warnings npx skills add lignertys/reddit-research-skills --skill reddit-search-api -a cursor

• spring-boot-engineer jeffallan/claude-skills

  Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data JPA repositories, and configures reactive WebFlux endpoints. Use when building Spring Boot 3.x applications, microservices, or reactive Java applications; invoke for Spring Data JPA, Spring Security 6, WebFlux, Spring Cloud integration, Java REST API design, or Microservices Java architecture.

  8,090 Failed npx skills add jeffallan/claude-skills --skill spring-boot-engineer -a cursor

• security-bounty-hunter affaan-m/ecc

  Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings. Use when hunting reportable, remotely reachable vulnerabilities in a repository.

  7,866 Warnings npx skills add affaan-m/ecc --skill security-bounty-hunter -a cursor

• email-best-practices resend/email-best-practices

  Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or deciding transactional vs marketing.

  7,827 Warnings npx skills add resend/email-best-practices --skill email-best-practices -a cursor

• codeql trailofbits/skills

  Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

  7,726 Failed npx skills add trailofbits/skills --skill codeql -a cursor

• llm-trading-agent-security affaan-m/ecc

  Security patterns for autonomous trading agents with wallet or transaction authority. Covers prompt injection, spend limits, pre-send simulation, circuit breakers, MEV protection, and key handling. Use when an autonomous agent holds wallet or transaction authority and its limits, simulation, or key handling need review.

  7,710 Warnings npx skills add affaan-m/ecc --skill llm-trading-agent-security -a cursor

• hipaa-compliance affaan-m/ecc

  HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

  7,643 Passed npx skills add affaan-m/ecc --skill hipaa-compliance -a cursor

Descriptions are the authors' own, in English. Read a skill's code in its repository before you install it.