Skills · category
Security skills and plugins
Public Claude skills and plugins for security, each with Waxell's security verdict and the findings behind it.
- 1,533 reviewed
- 1,190 no issues
- 276 to review
- 60 high risk
337 resultsSecurity
wizardmattpocockGenerate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting… No issuesSecurityData & analytics311k- writing-beatsmattpocockWriting, exploit; assemble raw material into a journey of beats, grounding each term before a beat leans on it. No issuesSecurityWriting & content311k
- writing-shapemattpocockWriting, exploit: shape raw material into an article, paragraph by paragraph. No issuesSecurityWriting & content311k
github-opsaffaan-mGitHub repository operations, automation, and management. Issue triage, PR management, CI/CD operations, release management, and security… High riskSecurityEngineering296k
ponytail-auditdietrichgebertQuality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first. No issuesSecurityEngineering184k- ponytail-reviewdietrichgebertQuality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how… No issuesSecurityEngineering184k
- ponytail-auditdietrichgebertQuality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to… No issuesSecurityEngineering184k
mcp-apps-buildershubhamsaboo**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns. **READ THIS FIRST** before any MCP server work,… No issuesSecurityDesign144k
doubt-driven-developmentaddyosmaniSubjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption… No issuesSecurityEngineering113k- security-and-hardeningaddyosmaniHardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication,… No issuesSecurityLegal & compliance113k
vercel-deploybytedanceDeploy applications and websites to Vercel. Use this skill when the user requests deployment actions such as "Deploy my app", "Deploy this… No issuesSecurityEngineering85k
api-security-testingusestrixSecurity-test a REST, GraphQL, or gRPC API with Strix, autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by… No issuesSecurityEngineering74k- application-security-testingusestrixApplication security testing (AppSec) across a whole product with Strix, decide which asset needs which test (source code, running web… No issuesSecurityEngineering74k
- ci-security-scanning-with-strixusestrixAdd security scanning to CI/CD with Strix: GitHub Actions, GitLab CI, or any pipeline, so every pull request gets a diff-scoped AI pentest… High riskSecurityEngineering74k
- find-security-vulnerabilities-in-codeusestrixFind security vulnerabilities in a codebase or repository with Strix, a white-box AI security review that reads your source, reasons about… No issuesSecurityEngineering74k
- fix-security-vulnerabilities-with-strixusestrixFix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud), triage by severity, patch the root cause… No issuesSecurityDocuments74k
- managed-pentesting-with-strixusestrixRun a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST… High riskSecurityEngineering74k
- owasp-top-10-testingusestrixTest an application against the OWASP Top 10 with Strix, autonomous AI agents that attempt real exploits for each category of the current… No issuesSecurityEngineering74k
- penetration-testing-with-strixusestrixPentest a web app, API, codebase, repository, URL, domain, or IP with Strix, autonomous AI penetration testing that exploits and proves… High riskSecurityEngineering74k
- web-app-penetration-testingusestrixPentest a web app or website end to end: black-box testing of a live URL, staging environment, or local dev server that finds and exploits… No issuesSecurityEngineering74k
007sickn33Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure… High riskSecurityAI & agents49k- hunt-laravelsickn33Hunt Laravel specific vulnerabilities High riskSecurityAI & agents49k
- hunt-nextjssickn33Hunt Next.js specific vulnerabilities High riskSecurityEngineering49k
- hunt-oauthsickn33Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target. High riskSecurityDocuments49k
- hunt-springbootsickn33Hunt Spring Boot specific vulnerabilities High riskSecurityAI & agents49k
- pentest-toolssickn33Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows with consistent output… High riskSecurityEngineering49k
- src-huntersickn33Bug-bounty/SRC vulnerability-hunting workflow: five-phase methodology (intake, recon, enumeration, hunt, report) with attack playbooks for… High riskSecurityAI & agents49k
jev-vercel-sandboxdavila7A Vercel Sandbox Claude sends work to on purpose: long test runs in the background, someone else's repository, an installer of unknown… High riskSecurityEngineering33k- Cloud Penetration Testingdavila7This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate… High riskSecurityEngineering33k
- Linux Privilege Escalationdavila7This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo… High riskSecurityEngineering33k
incident-commanderalirezarezvaniUse when declaring or running a production incident or outage, or writing its post-incident review. Classifies severity with… High riskSecurityWriting & content29k- skill-security-auditoralirezarezvaniUse before installing any skill or plugin from an untrusted source, or when asked if a skill is safe. Scans scripts, SKILL.md and… High riskSecurityAI & agents29k
porters-five-forcesphurynPerform Porter's Five Forces analysis: competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new… No issuesSecurityData & analytics28k- swot-analysisphurynPerform a detailed SWOT analysis: strengths, weaknesses, opportunities, and threats with actionable recommendations. Use when doing… No issuesSecurityData & analytics28k
merge-readyevery-appGet a branch ready for the maintainer's final review. Review it for security, simplicity, and billing abuse, fix what's real, get checks… No issuesSecurityWriting & content26k
lark-maillarksuite飞书邮箱：Use when user mentions 起草邮件、写邮件、草稿、发送/回复/转发邮件、查阅邮件、看邮件、搜索邮件、邮件文件夹、邮件标签、邮件联系人、监听新邮件、邮件收信规则等；use for mail/email intent only. Do not use… No issuesSecurityEngineering18k
gh-address-commentscomposio-communityHelp address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to… No issuesSecurityEngineering17k
code-reviewerjeffallanAnalyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1… No issuesSecurityEngineering12k- devops-engineerjeffallanCreates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates.… Review findingsSecurityEngineering12k
- dotnet-core-expertjeffallanUse when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework… No issuesSecurityEngineering12k
- fullstack-guardianjeffallanBuilds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at… No issuesSecurityEngineering12k
- java-architectjeffallanUse when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming.… No issuesSecurityEngineering12k
- laravel-specialistjeffallanBuild and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication,… No issuesSecurityEngineering12k
- secure-code-guardianjeffallanUse when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities, including custom… No issuesSecurityData & analytics12k
- security-reviewerjeffallanIdentifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation… Review findingsSecurityEngineering12k
- spring-boot-engineerjeffallanGenerates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data… No issuesSecurityEngineering12k
- test-masterjeffallanGenerates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect… No issuesSecurityEngineering12k
chatgpt-app-buildermcp-useBuild, modify, debug, migrate, review, or verify TypeScript MCP servers and MCP Apps with mcp-use. Use for tools, resources, prompts,… No issuesSecurityEngineering11k
See and control which skills your people use
Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF