Skills · category
Security skills and plugins
Public Claude skills and plugins for security, each with Waxell's security verdict and the findings behind it.
- 1,533 reviewed
- 1,190 no issues
- 276 to review
- 60 high risk
337 resultsSecurity
code-reviewgetsentryPerform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing… No issuesSecurityEngineering1.1k- django-access-reviewgetsentryDjango access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code… No issuesSecurityEngineering1.1k
- find-bugsgetsentryFind bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs,… No issuesSecurityEngineering1.1k
- gha-security-reviewgetsentryGitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows",… High riskSecurityEngineering1.1k
- secret-serializationgetsentryFinds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs,… No issuesSecurityEngineering1.1k
- security-modelgetsentryDefine, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries,… No issuesSecurityEngineering1.1k
- security-reviewgetsentrySecurity code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit… High riskSecurityDocuments1.1k
- skill-scannergetsentryScan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for… No issuesSecurityAI & agents1.1k
github-releasejezwebPrepare and publish GitHub releases. Sanitizes code for public release (secrets scan, personal artifacts, LICENSE/README validation),… No issuesSecurityEngineering1.1k- gws-setupjezwebSet up the Google Workspace CLI (gws) from scratch. Guides through GCP project creation, OAuth credentials, authentication, and installing… Review findingsSecurityEngineering1.1k
- shopify-setupjezwebSet up Shopify CLI auth and Admin API access for a store. Install CLI, authenticate, create custom app, store access token, verify. Use… Review findingsSecurityEngineering1.1k
- wordpress-setupjezwebConnect to a WordPress site via WP-CLI over SSH or the REST API. Check CLI, test SSH, set up auth, verify access, save config. Use… No issuesSecurityEngineering1.1k
dboracleOracle Database guidance for SQL, PL/SQL, SQLcl, ORDS, Oracle Vector SDK, administration, app development, performance, security,… Review findingsSecurityEngineering910- ocioracleOracle Cloud Infrastructure guidance for designing, operating, and troubleshooting OCI services, including OCI Kubernetes Engine (OKE),… Review findingsSecurityEngineering910
- oci-functions-deployoracleBuild, configure, scaffold, and deploy OCI Functions from a local machine using a dependency-first, Fn-context-guided flow with argv-safe… Review findingsSecurityEngineering910
- build-oci-security-zones-main-tforacleGenerate or update Terraform configuration only for OCI Security Zones with the upstream… No issuesSecurityEngineering910
- build-oci-exadata-database-main-tforacleGenerate or update Terraform configuration only for OCI Exadata Database Service on Dedicated Infrastructure with the upstream… No issuesSecurityEngineering910
- oci-networking-landing-zonesoracleGenerate or update safe OCI network Terraform configuration using only `oci-landing-zones/terraform-oci-modules-networking`. Use for VCNs,… No issuesSecurityEngineering910
- oke-gva-deployeroracleUse this skill when the user asks to enable, deploy, or configure Generic VNIC Attachment (GVA) for OCI Kubernetes Engine (OKE), create… No issuesSecurityEngineering910
- oke-multihome-deployeroracleDeploy and troubleshoot multihome networking on OCI Kubernetes Engine using existing GVA secondary VNIC node pools, Multus thick plugin,… No issuesSecurityEngineering910
- oke-troubleshooteroracleUse this skill when the user wants to diagnose or root-cause issues with an OCI Kubernetes Engine cluster or workload. Trigger phrases… No issuesSecurityEngineering910
building-inferencesh-appsinference-shBuild and deploy applications on inference.sh. Use when getting started, understanding the platform, creating apps, configuring resources,… High riskSecurityEngineering800
iterate-lessons-logproduct-on-purposeCreates a structured lessons learned entry for organizational memory. Use after an incident, a completed project, or a significant… No issuesSecurityDocuments784
auditing-skillsdbt-labsUse when checking skills for security or quality issues, reviewing audit results from skills.sh or Tessl, or remediating findings across… High riskSecurityAI & agents752- configuring-dbt-mcp-serverdbt-labsGenerates MCP server configuration JSON, resolves authentication setup, and validates server connectivity for dbt. Use when setting up,… No issuesSecurityEngineering752
clawdbot-securitysundial-orgSecurity audit and hardening for Clawdbot/Moltbot installations. Detects exposed gateways, fixes permissions, enables authentication, and… High riskSecurity673- ggshield-scannersundial-orgDetect 500+ types of hardcoded secrets (API keys, credentials, tokens) before they leak into git. Wraps GitGuardian's ggshield CLI. High riskSecurityEngineering673
- moltbot-securitysundial-orgSecurity hardening guide for Moltbot/Clawdbot. Lock down your gateway, fix file permissions, set up auth, configure firewalls. Based on… High riskSecurityResearch673
- securitysundial-orgAdvanced security validation for Clawdbot - pattern detection, command sanitization, and threat monitoring High riskSecurity673
- securitysundial-orgAdvanced security validation for Clawdbot - pattern detection, command sanitization, and threat monitoring High riskSecurity673
- skill-scannersundial-orgScan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool… High riskSecurityData & analytics673
- skillguardsundial-orgSecurity scanner for AgentSkill packages. Scan skills for credential theft, code injection, prompt manipulation, data exfiltration, and… High riskSecurityData & analytics673
validate-changes-match-specswarpdotdevValidate that a branch or pull request implementation matches introduced product, technical, security, and related specs. Use when… No issuesSecurityEngineering646
shopify-use-shopify-clishopifyChoose when the user needs **Shopify CLI** to run or fix something now: validate app or extension config on disk (`shopify.app.toml`,… No issuesSecurityEngineering627
solana-devsolana-foundationUse when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet… High riskSecurityEngineering583
n8n-credentials-and-security-officialn8n-ioUse when handling any auth, API keys, tokens, OAuth, bearer tokens, basic auth, or secret values in n8n workflows. Triggers on "API key",… No issuesSecurityEngineering572
infra-clickhouseclickhouseSets up and manages ClickHouse using the clickhousectl CLI, installs and runs a local ClickHouse server for development, and creates… High riskSecurityEngineering564
ghostghostsecurityEnterprise grade AI-native application security scanning, validation, and remediation High riskSecurityAI & agents437- ghost-proxyghostsecurityStarts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers.… High riskSecurityData & analytics437
- ghost-scan-depsghostsecurityGhost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and… High riskSecurityData & analytics437
- ghost-scan-secretsghostsecurityGhost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects… High riskSecurityEngineering437
playwright-best-practicescurrents-devUse when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing… Review findingsSecurityEngineering415
semgrepsemgrepRun Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security… Review findingsSecurityEngineering338
opentelemetrygrafanaInstrument any app with OpenTelemetry and ship metrics / logs / traces to Grafana Cloud or self-hosted Mimir / Loki / Tempo / Pyroscope.… Review findingsSecurityEngineering302
copilot-sdkintellectronicaThis skill helps with GitHub Copilot SDK work across Node.js/TypeScript, Python, Go, .NET, and Java. It covers setup, authentication,… Review findingsSecurityEngineering299- copilot-sdkintellectronicaThis skill helps with GitHub Copilot SDK work across Node.js/TypeScript, Python, Go, .NET, and Java. It covers setup, authentication,… Review findingsSecurityEngineering299
local-llm-routerhoodiniRoute AI coding queries to local LLMs in air-gapped networks. Integrates Serena MCP for semantic code understanding. Use when working… High riskSecurityEngineering291
dependency-managementcuriositechManaging third-party dependencies: version pinning, security auditing, license compliance, update workflows, lockfile management, supply… High riskSecurityLegal & compliance261
See and control which skills your people use
Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF