Skill agen

• entra-app-registration microsoft/azure-skills

  Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

  542.247 Lolos npx skills add microsoft/azure-skills --skill entra-app-registration

• azure-compliance microsoft/azure-skills

  Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

  542.130 Lolos npx skills add microsoft/azure-skills --skill azure-compliance

• firebase-auth-basics firebase/agent-skills

  Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

  164.632 Lolos npx skills add firebase/agent-skills --skill firebase-auth-basics

• firebase-security-rules-auditor firebase/agent-skills

  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

  128.520 Lolos npx skills add firebase/agent-skills --skill firebase-security-rules-auditor

• convex-setup-auth get-convex/agent-skills

  93.851 Lolos npx skills add get-convex/agent-skills --skill convex-setup-auth

• gws-shared googleworkspace/cli

  gws CLI: Shared patterns for authentication, global flags, and output formatting.

  63.372 Lolos npx skills add googleworkspace/cli --skill gws-shared

• clerk-setup clerk/skills

  Set up Clerk authentication in any project with the Clerk CLI and official framework quickstarts. Use when adding Clerk, initializing Clerk, scaffolding a new app with Clerk, or migrating an existing authentication system to Clerk.

  52.016 Lolos npx skills add clerk/skills --skill clerk-setup

• nodejs-backend-patterns wshobson/agents

  Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.

  47.045 Lolos npx skills add wshobson/agents --skill nodejs-backend-patterns

• extension-to-functions-codebase firebase/agent-skills

  Skill for converting an installed Firebase Extension (or extension source) into a standalone Cloud Functions for Firebase codebase or publishable npm package, including V1 to V2 trigger upgrades, lifecycle hooks, and declarative security

  46.800 Lolos npx skills add firebase/agent-skills --skill extension-to-functions-codebase

• better-auth-security-best-practices better-auth/skills

  Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.

  40.769 Lolos npx skills add better-auth/skills --skill better-auth-security-best-practices

• golang-security samber/cc-skills-golang

  Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

  38.323 Lolos npx skills add samber/cc-skills-golang --skill golang-security

• golang-swagger samber/cc-skills-golang

  Golang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files.

  33.729 Lolos npx skills add samber/cc-skills-golang --skill golang-swagger

• convex-auth get-convex/agent-skills

  Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring.

  29.492 Lolos npx skills add get-convex/agent-skills --skill convex-auth

• convex-reviewer get-convex/agent-skills

  Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

  29.378 Lolos npx skills add get-convex/agent-skills --skill convex-reviewer

• convex-optimize get-convex/agent-skills

  Audit and optimize an existing Convex app: security, scale, upgrades, observability.

  29.343 Lolos npx skills add get-convex/agent-skills --skill convex-optimize

• clerk clerk/skills

  Clerk authentication router. Use when user asks about Clerk CLI operations,

  28.753 Lolos npx skills add clerk/skills --skill clerk

• docker-expert sickn33/agentic-awesome-skills

  You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.

  26.989 Lolos npx skills add sickn33/agentic-awesome-skills --skill docker-expert

• security-requirement-extraction wshobson/agents

  Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

  22.718 Lolos npx skills add wshobson/agents --skill security-requirement-extraction

• skill-vetter useai-pro/openclaw-skills-security

  Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources.

  21.005 Lolos npx skills add useai-pro/openclaw-skills-security --skill skill-vetter

• firestore-security-rules-auditor firebase/agent-skills

  20.399 Lolos npx skills add firebase/agent-skills --skill firestore-security-rules-auditor

• threat-mitigation-mapping wshobson/agents

  Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

  17.226 Lolos npx skills add wshobson/agents --skill threat-mitigation-mapping

• security-review affaan-m/ecc

  Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

  17.215 Lolos npx skills add affaan-m/ecc --skill security-review

• firestore-rules-creation firebase/agent-skills

  Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.

  15.512 Lolos npx skills add firebase/agent-skills --skill firestore-rules-creation

• solidity-security wshobson/agents

  Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

  14.875 Lolos npx skills add wshobson/agents --skill solidity-security

• google-cloud-recipe-auth google/skills

  Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

  14.327 Lolos npx skills add google/skills --skill google-cloud-recipe-auth

• k8s-security-policies wshobson/agents

  Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

  14.176 Lolos npx skills add wshobson/agents --skill k8s-security-policies

• clerk-android clerk/skills

  Implement Clerk authentication for native Android apps using Kotlin and

  13.618 Lolos npx skills add clerk/skills --skill clerk-android

• google-cloud-waf-security google/skills

  Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.

  13.525 Lolos npx skills add google/skills --skill google-cloud-waf-security

• deployment-pipeline-design wshobson/agents

  Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.

  13.212 Lolos npx skills add wshobson/agents --skill deployment-pipeline-design

• clerk-expo clerk/skills

  Add Clerk authentication to Expo and React Native apps using @clerk/expo.

  13.094 Lolos npx skills add clerk/skills --skill clerk-expo

• postgres-patterns affaan-m/ecc

  PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices. Use when designing PostgreSQL schemas, indexes, or RLS policies, or when a query is too slow.

  11.821 Lolos npx skills add affaan-m/ecc --skill postgres-patterns

• java-spring-boot pluginagentmarketplace/custom-plugin-java

  Build production Spring Boot applications - REST APIs, Security, Data, Actuator

  11.750 Lolos npx skills add pluginagentmarketplace/custom-plugin-java --skill java-spring-boot

• email-best-practices resend/resend-skills

  Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or deciding transactional vs marketing.

  11.472 Lolos npx skills add resend/resend-skills --skill email-best-practices

• create-auth better-auth/skills

  Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

  11.391 Lolos npx skills add better-auth/skills --skill create-auth

• django-security affaan-m/ecc

  Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations. Use when reviewing Django authentication, authorization, input handling, or deployment settings.

  11.109 Lolos npx skills add affaan-m/ecc --skill django-security

• springboot-security affaan-m/ecc

  Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting.

  10.896 Lolos npx skills add affaan-m/ecc --skill springboot-security

• sast-configuration wshobson/agents

  Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

  10.252 Lolos npx skills add wshobson/agents --skill sast-configuration

• verification-loop affaan-m/ecc

  Run a six-phase verification of a Claude Code session's work — build, type check, lint, tests with coverage, security grep, and diff review — then produce a PASS/FAIL verification report. Use when verifying work after completing a feature or refactor, before creating a PR, or when quality gates must pass.

  9.967 Lolos npx skills add affaan-m/ecc --skill verification-loop

• linkerd-patterns wshobson/agents

  Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

  9.741 Lolos npx skills add wshobson/agents --skill linkerd-patterns

• django-verification affaan-m/ecc

  Run the full Django verification loop — environment check, mypy/ruff/black linting, migration safety, pytest with coverage targets, pip-audit and bandit security scans, settings and logging review, and diff review — producing a phased pass/fail report before release or PR. Use when preparing a Django pull request, validating migrations or coverage, or running pre-deploy readiness checks.

  9.581 Lolos npx skills add affaan-m/ecc --skill django-verification

• laravel-tdd affaan-m/ecc

  Laravel testing strategies with PHPUnit, Pest, model factories, HTTP tests, Sanctum authentication testing, mocking, and coverage. Use when writing Laravel tests with PHPUnit or Pest, or driving a Laravel feature test-first.

  9.576 Lolos npx skills add affaan-m/ecc --skill laravel-tdd

• springboot-verification affaan-m/ecc

  Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency and secret scans, and diff review — producing a pass/fail readiness report. Use when preparing a Spring Boot pull request, validating coverage thresholds, or running pre-deploy verification.

  9.496 Lolos npx skills add affaan-m/ecc --skill springboot-verification

• neon-auth neondatabase/agent-skills

  Add authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, passkeys, MFA, trusted domains, invalid domain, and @neondatabase/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neondatabase/neon-js.

  9.373 Lolos npx skills add neondatabase/agent-skills --skill neon-auth

• flutter-dart-code-review affaan-m/ecc

  Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture. Use when reviewing Flutter or Dart code, whatever state management library the project uses.

  9.073 Lolos npx skills add affaan-m/ecc --skill flutter-dart-code-review

• api-security-best-practices sickn33/agentic-awesome-skills

  Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

  8.746 Lolos npx skills add sickn33/agentic-awesome-skills --skill api-security-best-practices

• typespec-create-api-plugin github/awesome-copilot

  Generate a TypeSpec API plugin with REST operations, authentication, and Adaptive Cards for Microsoft 365 Copilot

  8.700 Lolos npx skills add github/awesome-copilot --skill typespec-create-api-plugin

• perl-security affaan-m/ecc

  Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.

  8.694 Lolos npx skills add affaan-m/ecc --skill perl-security

• laravel-verification affaan-m/ecc

  Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness. Use when verifying a Laravel project before merge or deploy — lint, static analysis, tests, coverage, security.

  8.358 Lolos npx skills add affaan-m/ecc --skill laravel-verification

• hipaa-compliance affaan-m/ecc

  HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

  7.658 Lolos npx skills add affaan-m/ecc --skill hipaa-compliance

• differential-review trailofbits/skills

  Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.

  7.375 Lolos npx skills add trailofbits/skills --skill differential-review

• integration-privy solana-mobile/solana-mobile-skills

  Add Privy authentication to a Solana Expo Android app on top of Mobile Wallet Adapter, using Sign-In-With-Solana. Use when installing @privy-io/expo, mounting PrivyProvider, logging a user in with useLoginWithSiws, linking a wallet to an existing Privy account, reading the Privy access token from a backend, or debugging a Privy plus MWA setup.

  6.905 Lolos npx skills add solana-mobile/solana-mobile-skills --skill integration-privy

• query-token-audit binance/binance-skills-hub

  Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.

  6.613 Lolos npx skills add binance/binance-skills-hub --skill query-token-audit

• find-bugs getsentry/skills

  Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

  6.521 Lolos npx skills add getsentry/skills --skill find-bugs

• nextjs-supabase-auth sickn33/agentic-awesome-skills

  Expert integration of Supabase Auth with Next.js App Router

  6.502 Lolos npx skills add sickn33/agentic-awesome-skills --skill nextjs-supabase-auth

• fastapi-patterns affaan-m/ecc

  FastAPI best practices covering project structure, Pydantic v2 schemas, dependency injection, async handlers, authentication, authorization, transactional service layers, and testing with httpx and pytest. Use when building or reviewing FastAPI apps — Pydantic schemas, dependencies, async handlers, auth, or tests.

  6.253 Lolos npx skills add affaan-m/ecc --skill fastapi-patterns

• securing-s3-buckets aws/agent-toolkit-for-aws

  Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

  6.181 Lolos npx skills add aws/agent-toolkit-for-aws --skill securing-s3-buckets

• launching-ec2-instance-with-best-practices aws/agent-toolkit-for-aws

  Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization.

  5.678 Lolos npx skills add aws/agent-toolkit-for-aws --skill launching-ec2-instance-with-best-practices

• quarkus-security affaan-m/ecc

  Quarkus security implementation patterns: JWT and OIDC authentication, @RolesAllowed RBAC and SecurityIdentity checks, Bean Validation and custom validators, parameterized Panache queries, BCrypt password hashing, CORS and security headers, rate limiting, audit logging, Vault or environment-variable secrets, and dependency CVE scanning. Use when adding authentication or authorization, validating input, managing secrets, or hardening a Quarkus application.

  5.672 Lolos npx skills add affaan-m/ecc --skill quarkus-security

• decision-records skymavis/skills

  Draft, promote, archive, and supersede ADR-style decision records (types are open: architecture, product, security, policy, legal, …) and keep INDEX.md and cross-links generated, via the bundled scripts/decisions.py tool. Use when creating or promoting decision drafts, superseding or archiving a decision, fixing a promotion breach, flattening the old per-type accepted/ layout, or running build, check, promote, rename-draft-id, migrate-layout, or install.

  5.654 Lolos npx skills add skymavis/skills --skill decision-records

• quarkus-verification affaan-m/ecc

  Verification loop for Quarkus projects: build, static analysis (Checkstyle, PMD, SpotBugs), tests with JaCoCo coverage, OWASP dependency and container security scans, GraalVM native compilation, health checks, and config validation. Use when verifying a Quarkus service before a PR, after major refactoring or dependency upgrades, or pre-deploy.

  5.630 Lolos npx skills add affaan-m/ecc --skill quarkus-verification

• okx-cex-auth okx/agent-skills

  Use this skill when the user wants to 'login/log in/sign in', 'authenticate', 'authorize', 'connect OKX account', 'set up credentials', 'first time setup', 'configure okx', '登录', '授权', '认证', '连接账户', '首次配置'. Also when any OKX CLI command fails with an auth error: 'Run okx auth login first', 'Session expired', 'not authenticated', 'requires_auth', '401 Unauthorized', 'token expired/not found', 'StorageNotFoundError', '会话过期', '未认证', '需要登录'. Also when the user asks about login status or the login was interrupted. Also when the user wants to install/update/check/remove the okx-auth binary — 'install/update/remove auth', 'download okx-auth', '安装/更新/卸载认证', 'auth binary status', 'Failed to spawn okx-auth'. Also use before using okx-cex-trade/portfolio/earn/bot for the first time. Do NOT use for market data queries (use okx-cex-market).

  5.558 Lolos npx skills add okx/agent-skills --skill okx-cex-auth

• creating-production-vpc-multi-az aws/agent-toolkit-for-aws

  Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic CIDR planning and DNS resolution.

  5.539 Lolos npx skills add aws/agent-toolkit-for-aws --skill creating-production-vpc-multi-az

• setting-up-cloudtrail-multi-region aws/agent-toolkit-for-aws

  Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.

  5.415 Lolos npx skills add aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region

• security-review github/awesome-copilot

  AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

  5.330 Lolos npx skills add github/awesome-copilot --skill security-review

• solana-vulnerability-scanner trailofbits/skills

  Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

  5.296 Lolos npx skills add trailofbits/skills --skill solana-vulnerability-scanner

• audit-prep-assistant trailofbits/skills

  Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.

  5.295 Lolos npx skills add trailofbits/skills --skill audit-prep-assistant

• entry-point-analyzer trailofbits/skills

  Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

  5.240 Lolos npx skills add trailofbits/skills --skill entry-point-analyzer

• algorand-vulnerability-scanner trailofbits/skills

  Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

  4.869 Lolos npx skills add trailofbits/skills --skill algorand-vulnerability-scanner

• data-manager-api-setup google/skills

  Guides developers through client library installation and authentication setup steps for the Data Manager API. Use this skill when a user is getting started with the Data Manager API and needs to setup their local environment, install the client library, or setup access to the API. Don't use for implementing audience or event ingestion logic (use the data-manager-api-audience-ingestion or data-manager-api-event-ingestion skills instead).

  4.868 Lolos npx skills add google/skills --skill data-manager-api-setup

• qianwen-ops-auth qianwen-ai/qianwen-ai

  Configure authentication (API keys, endpoints). TRIGGER when: setting up QIANWEN_API_KEY, troubleshooting 401/auth errors, when another skill reports missing credentials, or user explicitly invokes this skill by name (e.g. use qianwen-ops-auth). DO NOT TRIGGER when: non-auth Qwen tasks, general API usage questions.

  4.867 Lolos npx skills add qianwen-ai/qianwen-ai --skill qianwen-ops-auth

• secret-scanning github/awesome-copilot

  Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.

  4.486 Lolos npx skills add github/awesome-copilot --skill secret-scanning

• security monitoring claude-office-skills/skills

  Automate security monitoring, threat detection, incident response, and compliance workflows

  4.145 Lolos npx skills add claude-office-skills/skills --skill security-monitoring

• gke-platform-security google/skills

  Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security).

  4.130 Lolos npx skills add google/skills --skill gke-platform-security

• gke-workload-security google/skills

  Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture, isolating namespaces, applying pod security standards, or configuring network policies and secret volume mounts. Don't use for Workload Identity (use gke-workload-identity), cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

  4.104 Lolos npx skills add google/skills --skill gke-workload-security

• rds-sqlserver aws/agent-toolkit-for-aws

  Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme shows NTLM instead of KERBEROS on ECS Fargate, SSM tunnel to RDS SQL Server from laptop, port 1433 security group, TrustServerCertificate=True for localhost tunnels, SPN MSSQLSvc, AWS Managed Microsoft AD, CNAME not RDS endpoint for Kerberos, tds_version='7.4', encryption='require', port-as-string for pymssql, Secrets Manager credential caching in Lambda, error 18456 login failed. Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (JDBC mssql-jdbc), Node.js (tedious), IAM auth via RDS Proxy, and VPC/ECS/EKS/Lambda deployment.

  3.987 Lolos npx skills add aws/agent-toolkit-for-aws --skill rds-sqlserver

• gke-productionize google/skills

  Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).

  3.911 Lolos npx skills add google/skills --skill gke-productionize

• trailmark trailofbits/skills

  Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.

  3.617 Lolos npx skills add trailofbits/skills --skill trailmark

• api-sec yaklang/hack-skills

  Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

  3.607 Lolos npx skills add yaklang/hack-skills --skill api-sec

• aws-auth aws/agent-toolkit-for-aws

  Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

  3.595 Lolos npx skills add aws/agent-toolkit-for-aws --skill aws-auth

• graph-evolution trailofbits/skills

  Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.

  3.553 Lolos npx skills add trailofbits/skills --skill graph-evolution

• platform-encryption-configure forcedotcom/sf-skills

  Configure Salesforce Shield Platform Encryption — generate deployable encryption settings and encrypted-field metadata, and answer key-model and lifecycle questions. TRIGGER when: user wants to turn on deterministic encryption, encrypt a field, set up Cache-Only Keys, External Key Management, or replay detection, or mentions Shield Platform Encryption, encryption at rest, deterministic vs probabilistic encryption, encryptionScheme, PlatformEncryptionSettings, EncryptionKeySettings, BYOK, BYOKMS, tenant secrets, key rotation, or .settings-meta.xml / .field-meta.xml for encryption — even when they don't say 'Shield'. SKIP when: user needs a generic custom field with no encryption (use platform-custom-field-generate), needs the raw Metadata API type reference (use platform-metadata-api-context-get), or asks about Classic Encryption (encrypted text fields), which is a different feature. Use this skill for any Platform Encryption configuration, field-encryption, or key-model question.

  3.498 Lolos npx skills add forcedotcom/sf-skills --skill platform-encryption-configure

• api-auth-and-jwt-abuse yaklang/hack-skills

  API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

  3.464 Lolos npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse

• aws-security aws/agent-toolkit-for-aws

  Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

  3.330 Lolos npx skills add aws/agent-toolkit-for-aws --skill aws-security

• c-review trailofbits/skills

  Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

  3.329 Lolos npx skills add trailofbits/skills --skill c-review

• mailtrap-email-integration affaan-m/ecc

  Guides agents through integrating transactional email sending via Mailtrap's Email API, including sandbox testing, domain verification, and API authentication. Use when implementing email-sending features, debugging delivery issues, or setting up safe dev/staging email testing.

  3.188 Lolos npx skills add affaan-m/ecc --skill mailtrap-email-integration

• 10x-cli-setup przeprogramowani/10x-cli

  Set up or troubleshoot @przeprogramowani/10x-cli for a 10xDevs learner: reuse or install a compatible CLI, check authentication and course access, choose the project and AI tool, and hand off to 10x-cli-guide. Use for installation, updates, npm permissions and onboarding. Excludes CLI source development and everyday download/use/sync guidance once setup is ready.

  3.054 Lolos npx skills add przeprogramowani/10x-cli --skill 10x-cli-setup

• security markdown-viewer/skills

  Create visuals in Markdown documents: charts, diagrams, cards, architecture and page layouts. Charts and analytical views (bar, line, pie, heatmap, correlation, regression); reliability and operations (latency, incident, throughput, cycle time, OKR, standup, on-call); product and finance (funnel, retention, revenue, budget); process and workflow (approval, BPMN); software design and behaviour (class, state machine, sequence, C4); dependencies and impact (dependency graph, ER, causality); system architecture as an HTML page (layer stack, wings, zones, topology, service catalogue, request paths); infrastructure (cloud, Kubernetes, ETL, network, security, IAM, compliance); governance and people (ArchiMate, org chart, hiring); knowledge and planning (mind map, roadmap, Gantt, migration); documents (comparison, SWOT, memo, policy, catalogue, case study). Use when a document needs a diagram, chart or card. Not for slide decks or math notation. Not recommended: mermaid / canvas / drawio / dot.

  2.919 Lolos npx skills add markdown-viewer/skills --skill security

• cloud-network-security elastic/agent-skills

  2.769 Lolos npx skills add elastic/agent-skills --skill cloud-network-security

• swift-security dpearson2699/swift-ios-skills

  Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

  2.751 Lolos npx skills add dpearson2699/swift-ios-skills --skill swift-security

• convex-security-check waynesutton/builder-skills

  Ten minute security pass over a Convex backend: public functions that should be internal, missing auth checks, unvalidated args, IDs from the client trusted without ownership checks, secrets in code. Use before merging a pull request, after adding new public functions, or when the user says 'quick security check'.

  2.718 Lolos npx skills add waynesutton/builder-skills --skill convex-security-check

• platform-architecture-analyze forcedotcom/sf-skills

  Use when the developer asks to "review the architecture", "run a Well-Architected check", "audit this project", "is this project well-architected?", or wants to assess security/governor-limit/risk as a holistic code-and-metadata health report. Grades observable criteria (sharing/FLS, bulkification, SOQL selectivity, packageability) with file:line evidence; emits a governance checklist for what it can't see. Read-only, never edits. DO NOT TRIGGER for single-tool Apex scans (dx-code-analyzer-run).

  2.696 Lolos npx skills add forcedotcom/sf-skills --skill platform-architecture-analyze

• netlify-identity netlify/context-and-tools

  Add user authentication to a Netlify site with @netlify/identity — signup/login/logout, Google/GitHub/GitLab/Bitbucket OAuth, server-side getUser() checks, role-based access control, and Identity event functions. Use it when a task involves adding a login or signup form, gating content to members or roles, "auth middleware" or verifying users in Netlify Functions or Edge Functions, handling OAuth or email-confirmation callbacks, assigning roles at signup, or customizing Identity emails. For locking a whole site to your company or employees-only access, use netlify-access-control instead.

  2.664 Lolos npx skills add netlify/context-and-tools --skill netlify-identity

• login-flow nexu-io/open-design

  Mobile login and authentication flow screens

  2.641 Lolos npx skills add nexu-io/open-design --skill login-flow

• porters-five-forces phuryn/pm-skills

  Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants. Use when analyzing industry dynamics, assessing competitive forces, or evaluating market attractiveness.

  2.621 Lolos npx skills add phuryn/pm-skills --skill porters-five-forces

• code-review-pro onewave-ai/claude-skills

  Performs a deep code review of files, modules, a diff, or a branch - finding security vulnerabilities (mapped to OWASP Top 10:2025), correctness bugs, performance problems, and maintainability issues - and returns severity-ranked findings with evidence and concrete fixes. Use when the user asks to review, audit, or sanity-check code, asks "is this safe", "what's wrong with this", "find bugs", or wants a security or performance pass before shipping. For posting line comments on a GitHub pull request, use git-pr-reviewer.

  2.537 Lolos npx skills add onewave-ai/claude-skills --skill code-review-pro

• thermo-nuclear-review cursor/plugins

  Comprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.

  2.490 Lolos npx skills add cursor/plugins --skill thermo-nuclear-review

• access-protected-vercel-deployment vercel/vercel-plugin

  Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection. Use when curl, agent-browser, Playwright, or another automated request reaches a Vercel login or protection page; when a protected preview or production URL returns 401 or 403; when TRUSTED_SOURCES_ENVIRONMENT_MISMATCH appears; or when choosing between `vercel curl` and the `x-vercel-trusted-oidc-idp-token` header.

  2.478 Lolos npx skills add vercel/vercel-plugin --skill access-protected-vercel-deployment

• snyk-agent-scan-compliance samber/cc-skills

  Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.

  2.460 Lolos npx skills add samber/cc-skills --skill snyk-agent-scan-compliance

• experience-ui-bundle-mfa-configure forcedotcom/sf-skills

  Configure Multi-Factor Authentication (MFA) for Salesforce Experience Site users. TRIGGER when: user wants to enable MFA on a community, enforce two-factor authentication for portal users, add MFA to a React Experience Site / Web App, configure ForceTwoFactor permission, create MFA permission sets for external users, or troubleshoot MFA not appearing on login. Also triggers on: MFA community, two-factor portal, ForceTwoFactor permission set, MFA Experience Cloud, MFA React site, identity verification community, MFA experience site, ForceTwoFactor permissionset-meta.xml, MFA permissionset-meta.xml. DO NOT TRIGGER when: configuring org-wide MFA for internal users (that's Setup > Identity Verification), building custom login UI components (use experience-ui-bundle-frontend-generate), or generating generic permission sets without MFA context (use platform-permission-set-generate).

  2.439 Lolos npx skills add forcedotcom/sf-skills --skill experience-ui-bundle-mfa-configure

• code-review-analysis aj-geddes/useful-ai-prompts

  Perform comprehensive code reviews with best practices, security checks, and constructive feedback. Use when reviewing pull requests, analyzing code quality, checking for security vulnerabilities, or providing code improvement suggestions.

  2.408 Lolos npx skills add aj-geddes/useful-ai-prompts --skill code-review-analysis

Deskripsi ditulis oleh pembuatnya sendiri, dalam bahasa Inggris. Baca kode skill di repositorinya sebelum menginstalnya.