Skills · category
Security skills and plugins
Public Claude skills and plugins for security, each with Waxell's security verdict and the findings behind it.
- 1,533 reviewed
- 1,190 no issues
- 276 to review
- 60 high risk
337 resultsSecurity
mcp-apps-buildermcp-useBuild, modify, debug, migrate, review, or verify TypeScript MCP servers and MCP Apps with mcp-use. Use for tools, resources, prompts,… No issuesSecurityEngineering11k- mcp-buildermcp-useBuild, modify, debug, migrate, review, or verify TypeScript MCP servers and MCP Apps with mcp-use. Use for tools, resources, prompts,… No issuesSecurityEngineering11k
- openapi-to-mcpmcp-useBuild and deploy an MCP server from an OpenAPI / Swagger spec using the mcp-use TypeScript SDK. Use this skill whenever the user wants to… Review findingsSecurityEngineering11k
android-intent-securityandroidBest practices for Android Intent security. Use this skill when auditing component configurations in AndroidManifest.xml activities,… No issuesSecurityEngineering10k- android-permissions-securityandroidAudits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing… No issuesSecurity10k
improveshadcnSurvey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute.… No issuesSecurityEngineering9.3k
browser-cdpzenstory-aiUse this skill when you need to control a Chrome browser via CDP (Chrome DevTools Protocol) to reuse existing login sessions. Covers:… Review findingsSecurityResearch8.3k
agentic-actions-auditortrailofbitsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex,… High riskSecurityEngineering8k- agentic-actions-auditortrailofbitsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI… High riskSecurityEngineering8k
- testing-handbook-skillstrailofbitsSkills from the Trail of Bits Application Security Testing Handbook (appsec.guide) High riskSecurityEngineering8k
verification-loopgalaxy-dawnThis skill should be used when the user asks to "verify code", "run verification", "check quality", "validate changes", or before creating… No issuesSecurityEngineering6k
eas-hostingexpoDeploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs,… Review findingsSecurityEngineering4k
golang-dependency-managementsamberDependency management for Golang projects: go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict… Review findingsSecurityEngineering3.8k- golang-goplssamberGolang semantic code intelligence via `gopls`, the official Go language server, go-to-definition, find references, call/implementation… Review findingsSecurityEngineering3.8k
- golang-how-tosamberGolang skills orchestrator: always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most… Review findingsSecurityEngineering3.8k
- golang-pkg-go-devsamberGolang package and module lookup via `godig`, a pkg.go.dev API client (CLI + MCP server). Use for any Go/Golang library's documentation,… Review findingsSecurityEngineering3.8k
- golang-safetysamberDefensive Golang coding against accidental bugs: nil panics, typed-nil interfaces, `append` backing-array aliasing, silent int64-to-int32… No issuesSecurityEngineering3.8k
- golang-securitysamberSecurity best practices and vulnerability prevention for Golang, injection (SQL, command, XSS), cryptography, path traversal, SSRF and… Review findingsSecurityEngineering3.8k
ctf-ai-mlljagielloProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing… Review findingsSecurityData & analytics3.6k- ctf-cryptoljagielloProvides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical… Review findingsSecurity3.6k
- ctf-forensicsljagielloProvides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs,… Review findingsSecurityData & analytics3.6k
- ctf-malwareljagielloProvides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages,… Review findingsSecurityData & analytics3.6k
- ctf-miscljagielloProvides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles,… Review findingsSecurityImages, video & audio3.6k
- ctf-pwnljagielloProvides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to… Review findingsSecurityDocuments3.6k
- ctf-reverseljagielloProvides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or… Review findingsSecurityData & analytics3.6k
- ctf-webljagielloProvides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client,… Review findingsSecurityResearch3.6k
aws-agents-for-devsecopsawsInvestigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with… High riskSecurityEngineering3.4k
dart-setup-ffi-assetsflutterGuides agents in compiling and packaging C/C++ source code into dynamic or static libraries (Code Assets) using Dart's Native Assets hook… No issuesSecurityEngineering3.1k
best-practicesaddyosmaniApply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices",… No issuesSecurityResearch3k
ai-ml-securityyaklangAI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model… High riskSecurityAI & agents2.6k- linux-privilege-escalationyaklangLinux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries,… High riskSecurity2.6k
- linux-security-bypassyaklangLinux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux,… High riskSecurity2.6k
- llm-prompt-injectionyaklangLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse,… High riskSecurityData & analytics2.6k
wp-rest-apiwordpressUse when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller… No issuesSecurityEngineering2.3k
code-review-skillawesome-skillsProvides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails,… No issuesSecurityEngineering2.2k
fastify-best-practicesmcollinaGuides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript. Use when building, configuring, or… Review findingsSecurityEngineering2k- oauthmcollinaImplements OAuth 2.0/2.1 authorization flows in Fastify applications, configures authorization code with PKCE, client credentials, device… Review findingsSecurityEngineering2k
- octocatmcollinaUse this skill whenever the prompt contains any `github.com` URL, even if the user only pastes a link and gives no GitHub-specific… No issuesSecurityEngineering2k
building-a-promotion-caserefoundaiHelp users systematically document their impact, identify skill gaps, and collaborate with their managers to secure a promotion by proving… No issuesSecurityDocuments1.5k- competitive-strategyrefoundaiHelp users identify sources of durable competitive power, evaluate market threats, and design products that are uniquely differentiated… No issuesSecurityDesign1.5k
- managing-uprefoundaiHelp users master the art of proactive communication and alignment with their managers and founders to unlock autonomy, secure resources,… No issuesSecurityDesign1.5k
authenticationdpearson2699Implement iOS authentication flows with AuthenticationServices and LocalAuthentication. Use when building Sign in with Apple,… No issuesSecurity1.3k- cryptokitdpearson2699Use Apple CryptoKit for Swift cryptographic primitives. Use when hashing with SHA-2 or SHA-3, generating HMACs, encrypting with AES-GCM or… No issuesSecurityEngineering1.3k
- cryptotokenkitdpearson2699Access security tokens and smart cards using CryptoTokenKit. Use when building TKTokenDriver or TKSmartCardTokenDriver extensions,… No issuesSecurity1.3k
- swift-securitydpearson2699Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face… No issuesSecurityData & analytics1.3k
agentforce-adlcforcedotcomAgentforce Agent Development Life Cycle: author, discover, scaffold, deploy, test, secure, and optimize .agent files High riskSecurityEngineering1.1k
asc-cli-usagerorkaiGuidance for using asc cli in this repo (flags, output formats, pagination, auth, and discovery). Use when asked to run or design asc… No issuesSecurityEngineering1.1k- asc-signing-setuprorkaiSet up bundle IDs, capabilities, signing certificates, provisioning profiles, and encrypted signing sync with the asc cli. Use when… No issuesSecurityEngineering1.1k
See and control which skills your people use
Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF