MCP CheckClaude skills for security review
250 public Claude skills touch on security review. These 50 are the closest fit, best-known sources first. Each links to its folder; copy it into ~/.claude/skills/ to use it.
agent owasp compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against OWASP ASI 2026 standards -…
github/awesome-copilot★ 41kMITFolder:
agent-owasp-complianceskill security auditor
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and…
eigent-ai/eigent★ 16kApache-2.0Folder:
skill-security-auditorsecure code guardian
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized…
Jeffallan/claude-skills★ 12kMITFolder:
secure-code-guardiansecurity reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security.…
Jeffallan/claude-skills★ 12kMITFolder:
security-reviewersecure code review
Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users…
zebbern/claude-code-guide★ 4.7kMITFolder:
secure-code-reviewsecurity audit
Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.
davepoon/buildwithclaude★ 3.7kMITFolder:
security-auditsecurity review
Security vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.
a5c-ai/babysitter★ 1.9kMITFolder:
security-reviewsecurity review openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for…
lawve-ai/awesome-legal-skills★ 911Licence: see repoFolder:
code-security-review-openaiowasp security
Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security…
agamm/claude-code-owasp★ 419MITFolder:
owasp-securitycreate threat model
Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated severity. Use when the user asks to \"create a threat model\",…
tobihagemann/turbo★ 417MITFolder:
create-threat-modelconvex security audit
Deep security review of a Convex app: authorization model, data access paths per table, HTTP action exposure, rate limiting, file storage access, scheduled function trust, and a written findings report. Use before launch, after an incident, or when the…
waynesutton/builder-skills★ 405Apache-2.0Folder:
convex-security-auditthreat model discipline
Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing
hypnguyen1209/offensive-claude★ 403MITFolder:
threat-model-disciplinetypescript security review
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing…
giuseppe-trisciuoglio/developer-kit★ 366MITFolder:
typescript-security-reviewsecurity threat model
Threat-model product features, APIs, data flows, secrets, permissions, supply-chain changes, auth boundaries, and risky code paths before or during implementation. Use when touching authentication, authorization, payments, secrets, user data, uploads,…
majiayu000/spellbook★ 288MITFolder:
security-threat-modelai threat model
Builds an evidence-bound AI threat model from partial architecture, trust, identity, data-flow, and control information. Use when scoping an AI assessment, reviewing a design, or prioritizing realistic attack paths under uncertainty.
zero-lab-ai/skills★ 284Apache-2.0Folder:
ai-threat-modelthreat modeling
Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.
seb1n/awesome-ai-agent-skills★ 233MITFolder:
threat-modelingsecurity audit methodology
Plan authorized security reviews with threat modeling, architecture and dependency audits, and vulnerability classification. Use for scoped defensive security assessment. Do not use for offensive operations, unauthorized testing, or security control…
magnus919/agent-skills★ 156MITFolder:
security-audit-methodologyca threat model
Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.
arbiterForge/codeArbiter★ 149AGPL-3.0Folder:
ca-threat-modelagentic owasp
EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional…
Ovid/paad★ 146MITFolder:
agentic-owaspworkflow security audit
Read-only GitHub Actions workflow security audit for one repository, a repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks.…
apache/magpie★ 130Apache-2.0Folder:
workflow-security-auditintegrating dast with owasp zap in pipeline
'This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic
adriannoes/awesome-agentic-ai★ 89MITFolder:
integrating-dast-with-owasp-zap-in-pipelineelixir security review
Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.
existential-birds/beagle★ 85Apache-2.0Folder:
elixir-security-reviewowasp top 10
OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.
NickCrew/Claude-Cortex★ 62MITFolder:
owasp-top-10threat modeling techniques
Threat modeling methodologies using STRIDE, attack trees, and risk assessment for proactive security analysis. Use when designing secure systems, conducting security reviews, or identifying potential attack vectors in applications.
NickCrew/Claude-Cortex★ 62MITFolder:
threat-modeling-techniquesc security review
Use when the user requests a userspace C or C++ security review with a threat model and severity filter and wants validated findings. Not for kernel or bare-metal code: use kernel-security.
OutlineDriven/outline-driven-development★ 55Apache-2.0Folder:
c-security-reviewwordpress security review
Use when the user asks 'is my site secure', 'run a security audit', 'check for vulnerabilities', 'was my site hacked', or 'fix the vulnerable plugins'. Runs the Respira security audit, reads its indicators, coverage and known vulnerabilities honestly,…
respira-press/agent-skills-wordpress★ 49MITFolder:
wordpress-security-reviewthreat model
Use to conduct STRIDE threat modeling for a system or feature design.
haabe/mycelium★ 47MITFolder:
threat-modelthreat modeling mindmap
Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.
SubhiSec/claude-ai-cyber-security-skills★ 45Licence: see repoFolder:
03-threat-modeling-mindmapowasp checker
Check for OWASP Top 10 vulnerabilities — injection, broken auth, XSS, insecure deserialization, and misconfiguration.
inbharatai/claude-skills★ 41MITFolder:
owasp-checkersecurity auditor
Audit code for security vulnerabilities — OWASP Top 10, injection flaws, auth issues, secrets exposure, and dependency risks.
inbharatai/claude-skills★ 41MITFolder:
security-auditorroblox creator store security audit
Audit Roblox Creator Store, Toolbox, inventory, group, universe, package, model, UI, gameplay, plugin-like, and other third-party imported assets for malicious or risky scripts. Use whenever Claude imports, inserts, reviews, or trusts Creator Store assets,…
AshExplained/roblox-skills★ 40MITFolder:
roblox-creator-store-security-auditsecurity audit cli
Audit de securite TricorderKit : secret scanning, audit des dependances vs CVE, controle des permissions, analyse de patterns a risque, verification d'anonymisation avant depot public. Declencheurs : audit securite, scan secrets, verifie les fuites, check…
GeekFamilyCorp/TricorderKit★ 32MITFolder:
security-audit-cliforge security review
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review,…
atlassian/forge-skills★ 27Apache-2.0Folder:
forge-security-reviewecc security review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
mworldorg/markdown-memory★ 25MITFolder:
ecc-security-reviewfec security review
用于审查前端安全风险，如 XSS、CSRF、敏感数据暴露、不安全 DOM API、不可信用户输入、认证/token 处理、支付流程、文件上传、CSP、依赖风险或第三方脚本；中文触发词包括 安全审查、安全检查。
bovinphang/frontend-craft★ 22MITFolder:
fec-security-reviewapi security auditor
Audit API theo OWASP, Clean Architecture và Architecture Profile
khangpqvn/SDDADD★ 13No licence statedFolder:
api-security-auditorowasp top10
A deep prevention reference for the OWASP Top 10 web risks — broken access control, injection, crypto failures, insecure design, SSRF and more — with vulnerable-vs-fixed code, edge cases, and a runnable naive-vulnerability scanner.
vanara-agents/skills★ 9Apache-2.0Folder:
owasp-top10web security review
Top-level security code review for JavaScript/TypeScript web applications and Electron desktop applications. Use when the user asks to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", "is this…
photostructure/coding-skills★ 4MITFolder:
web-security-reviewowasp top 10 prevention
Prevent OWASP Top 10 vulnerabilities in web applications. Activate whenever the user writes API endpoints, form handlers, database queries, authentication logic, file uploads, HTML rendering, or any code that handles user input or external data. Also…
VersoXBT/claude-initial-setup★ 4MITFolder:
owasp-top-10-preventionsf org security audit
Standing security audit of a Salesforce org and its source - who holds ModifyAllData, ViewAllData, AuthorApex and ViewEncryptedData, the object and field matrix behind every permission set, profile sprawl, Apex class and @AuraEnabled exposure, org-wide…
grzmol/vibe-force★ 3MITFolder:
sf-org-security-auditsecurity and hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when…
addyosmani/agent-skills★ 112kMITFolder:
security-and-hardeningsecurity research
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability…
code-yeongyu/oh-my-openagent★ 70kLicence: see repoFolder:
security-research007
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
sickn33/agentic-awesome-skills★ 49kMITFolder:
007ai engineering toolkit
Overview of six AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
sickn33/agentic-awesome-skills★ 49kMITFolder:
ai-engineering-toolkitaudit integrity
Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use…
github/awesome-copilot★ 41kMITFolder:
audit-integrityoffensive api security
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass…
SnailSploit/Claude-Red★ 9.8kMITFolder:
offensive-api-securityoffensive reporting
Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation,…
SnailSploit/Claude-Red★ 9.8kMITFolder:
offensive-reportingaudit prep assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline…
trailofbits/skills★ 7.9kCC-BY-SA-4.0Folder:
audit-prep-assistantaudit context building
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any…
trailofbits/skills★ 7.9kCC-BY-SA-4.0Folder:
audit-context-buildingc review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer…
trailofbits/skills★ 7.9kCC-BY-SA-4.0Folder:
c-review
Claude skills for security review: before you install one
Which Claude skill should I use for security review?
Yes: 250 public skills from 166 GitHub repositories mention security review. The best-known ones named for it are agent owasp compliance (github/awesome-copilot, ★ 41k), skill security auditor (eigent-ai/eigent, ★ 16k) and secure code guardian (Jeffallan/claude-skills, ★ 12k). Stars belong to the whole repository, not to one skill.
How do I add agent owasp compliance to Claude?
For security review, copy the agent-owasp-compliance folder from github/awesome-copilot (the folder that holds SKILL.md) into ~/.claude/skills/ to use it in every Claude Code project, or into .claude/skills/ for one project. For the Claude apps, upload the zipped folder as a custom skill instead.
Are there security review skills in other languages?
No: fec security review is written mainly in Chinese, Japanese, Korean or Russian rather than English, though the security review task is the same. Claude can follow it either way, but read it before you install.
How recently were security review skills updated?
162 of the 250 security review skills sit in repositories that changed in the 30 days before 31 Oct 2026.
Are security review skills safe to install?
Installing a security review skill means Claude will follow its instructions and may run its scripts, so read SKILL.md and every script first: for agent owasp compliance, that is everything in the agent-owasp-compliance folder. 4 of the 50 here come from repositories with under 10 stars, so few people have looked at them. Watch for downloads, commands that send data out, invisible characters, and text telling Claude to keep something from you.
More topics: every “Claude skills for…” page.