Best Claude skills for security
Security skills range from Cloudflare's multi-phase security audit to hundreds of structured cybersecurity playbooks mapped to MITRE ATT&CK and NIST. Use them to audit your own code, harden infrastructure or practice CTF challenges. Always stay within systems you are authorized to test.
272 security skills · ranked live · November 2026
The top 10. Ranked by the Alyn Score.
- 1#1
affaan-m
Accessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
Pack301k1.7MScore 89 - 2#2
Agent Security Hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
Pack301k1.7MScore 89 - 3#3
Addy Osmani
Security And Hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
Pack115k1.8MScore 87 - 4#4
morluto
Rea Analysis Optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
Pack450k29kScore 85 - 5#5
Rea Ci Tests Audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
Pack450k29kScore 85 - 6#6
Reverse Engineer Anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
Pack450k29kScore 85 - 7#7
wshobson
Agents
wshobson
Screen Reader Testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
Pack42k2.6MScore 85 - 8#8
GitHub
Awesome Copilot
GitHub
Agent Owasp Compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
Pack41k2.4MScore 83 - 9#9
GitHub
Awesome Copilot
AI Prompt Engineering Safety Review
Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement…
Pack41k2.4MScore 83 - 10#10
davila7
Owasp Security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and…
Pack33k285kScore 82
What makes a great security skill.
Findings with evidence and severity, not speculative warnings.
Clear scope rules: only systems you own or are authorized to test.
Machine-readable output you can track over time.
All 272 security skills.
affaan-maccessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
affaan-magent-security-hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
Addy Osmanisecurity-and-hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
morlutorea-analysis-optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
morlutorea-ci-tests-audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
morlutoreverse-engineer-anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
wshobson
Agents
wshobsonscreen-reader-testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
GitHub
Awesome Copilot
GitHubagent-owasp-compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
GitHub
Awesome Copilot
GitHubai-prompt-engineering-safety-review
Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement…
davila7owasp-security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and…
wshobson
Agents
wshobsonsolidity-security
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or…
wshobson
Agents
wshobsonwcag-audit-patterns
Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or…
OpenAI
Skills
OpenAIsecurity-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization…
trailofbits
Skills
trailofbitsburpsuite-project-parser
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping…
trailofbits
Skills
trailofbitscvss-scoring
Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector, or…
trailofbits
Skills
trailofbitsdevcontainer-setup
Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated…
OpenAI
Skills
OpenAIsecurity-best-practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security…
sickn33
Agentic Awesome Skills
sickn33accessibility-compliance-accessibility-audit
Audit pages and user journeys against a declared WCAG scope. Use when identifying keyboard, screen-reader, focus or contrast barriers and planning verified remediation.
Microsoftazure-enterprise-infra-planner
Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and…
Microsoftazure-kubernetes
Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server…
Microsoftentra-app-registration
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication…
phurynporters-five-forces
Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants. Use when analyzing industry dynamics, assessing…
phurynprivacy-policy
Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and clauses needing legal review. Use when creating a privacy policy, updating data…
zhaoxuya520reverse-skill-router
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when…
OpenAI
Skills
OpenAIsecurity-threat-model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only…
mukul975
Anthropic Cybersecurity Skills
mukul975abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz…
mukul975
Anthropic Cybersecurity Skills
mukul975abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via…
mukul975
Anthropic Cybersecurity Skills
mukul975achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the…
Anthropic
Claude Plugins Official
Anthropicclaude-security
Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned…
Jeffallan
Claude Skills
Jeffallancode-reviewer
Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns…
Cloudflare
Security Audit Skill
Cloudflaresecurity-audit
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security…
phurynstrategy-red-team
Red-team a PRD, roadmap, or strategy by attacking its load-bearing assumptions before reality does. Steelmans then attacks each claim, ranks failure modes by impact × likelihood ×…
tech-leads-clubaws-advisor
Expert AWS Cloud Advisor for architecture design, security review, and implementation guidance. Leverages AWS MCP tools for accurate, documentation-backed answers. Use when user asks about…
zhaoxuya520competition-ad-certificate-abuse
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates, enrollment rights, EKUs, SAN controls, PKINIT, certificate mapping, and…
zhaoxuya520competition-agent-cloud
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when…
ljagiello
Ctf Skills
ljagielloctf-pwn
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into…
Security skills, explained.
Also searched as: security audit skill, cybersecurity agent skills, pentest skill, ctf skills.
What are the best Claude skills for security?
Right now the top-ranked security skills on Alyn are Accessibility (affaan-m), Agent Security Hardening (affaan-m), Security And Hardening (Addy Osmani). Rankings combine GitHub stars, installs, freshness and depth, and update live.
What is the Cloudflare security audit skill?
A coding-agent skill from Cloudflare that runs multi-phase security audits and produces independently verified, machine-readable findings.
Can skills themselves be a security risk?
Yes. Skills can include scripts. Read SKILL.md and any bundled scripts before installing, and prefer well-known authors. Alyn shows file counts and links every file.
How do I install a security skill?
Run npx skills add owner/repo in your project, or copy the folder with SKILL.md into ~/.claude/skills. Every skill on this page has a ready-to-copy command.
More in Build
Security skills for your agent