Trusted skills for AI agents from official vendors and established maintainers. Every skill is attributed to its author, scanned, and comes with install steps for your AI tool.
25 skills
Addy Osmani· Community
A comprehensive framework for building secure, hardened web applications through threat modeling and defensive coding practices.
AnthropicOfficial
Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the user asks to scan, audit or check code with Claude Security, to scan their changes with Claude Security, or to fix or patch Claude Security findings.
Seth Hobson· Community
A comprehensive guide and template library for implementing mutual TLS (mTLS) to secure service-to-service communication in zero-trust environments.
Seth Hobson· Community
A guide to implementing secure secrets management in CI/CD pipelines using industry-standard tools and best practices.
Seth Hobson· Community
A comprehensive guide for implementing production-grade security policies in Kubernetes clusters.
GitHubOfficial
A specialized DevSecOps agent for automated security remediation using JFrog intelligence.
Google WorkspaceOfficial
Create and configure new Google Model Armor templates for content safety.
Google WorkspaceOfficial
Sanitize user prompts using Google Model Armor templates via the gws CLI.
Google WorkspaceOfficial
Integrates Google Model Armor to sanitize AI model responses using predefined safety templates.
Android (Google)Official
A comprehensive guide for auditing, securing, and remediating Android permissions and IPC component vulnerabilities.
Android (Google)Official
Guidelines and patterns for securing Android components and handling Intents to prevent unauthorized access and privilege escalation.
OpenAIOfficial
Secure Twilio applications against common attacks. Covers credential management (API keys vs auth tokens), request validation (webhook signature verification), PCI DSS compliance, HIPAA account requirements, SMS pumping prevention, geo-permissions, and account isolation patterns. Use this skill when developers are building or deploying Twilio apps.
OpenAIOfficial
Configure Twilio accounts for HIPAA compliance. Covers BAA requirements, HIPAA Project designation (self-service and support), eligible services list, per-product requirements (Voice, SMS, ConversationRelay, Conversation Intelligence, Flex, Verify), message redaction, and what is NOT eligible. Use this skill when developers are building healthcare workflows on Twilio.
OpenAIOfficial
Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.
OpenAIOfficial
Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.
NVIDIAOfficial
Generates BYO custom safety policies for NVIDIA Nemotron content-safety guardrails — Nemotron-Content-Safety-Reasoning-4B (text) and multimodal Nemotron-3-Content-Safety. Produces a Markdown policy, JSON taxonomy, and drop-in inference prompts. Maps rough words or an existing policy to V2 categories, adding custom categories or topic-following rules.
Google DeepMindOfficial
Standardized protocol for securely verifying and managing API keys and credentials within an agent environment.
AWSOfficial
A routing skill for configuring AWS WAF to protect web applications and APIs from layer 7 threats.
MicrosoftOfficial
Java SDK for managing cryptographic keys and performing operations within Azure Key Vault and Managed HSM.
MicrosoftOfficial
Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.
MicrosoftOfficial
OWASP Docker Top 6 knowledge base for identifying, assessing, and remediating Docker container security risks.
MicrosoftOfficial
A security guideline for AI agents to treat external, untrusted content strictly as data rather than executable instructions.
JetBrainsOfficial
Google Model Armor: Filter user-generated content for safety.
Better AuthOfficial
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.