Best Claude skills for security
Security skills range from Cloudflare's multi-phase security audit to hundreds of structured cybersecurity playbooks mapped to MITRE ATT&CK and NIST. Use them to audit your own code, harden infrastructure or practice CTF challenges. Always stay within systems you are authorized to test.
272 security skills · ranked live · November 2026
The top 10. Ranked by the Alyn Score.
- 1#1
affaan-m
Accessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
Pack301k1.7MScore 89 - 2#2
Agent Security Hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
Pack301k1.7MScore 89 - 3#3
Addy Osmani
Security And Hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
Pack115k1.8MScore 87 - 4#4
morluto
Rea Analysis Optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
Pack450k29kScore 85 - 5#5
Rea Ci Tests Audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
Pack450k29kScore 85 - 6#6
Reverse Engineer Anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
Pack450k29kScore 85 - 7#7
wshobson
Agents
wshobson
Screen Reader Testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
Pack42k2.6MScore 85 - 8#8
GitHub
Awesome Copilot
GitHub
Agent Owasp Compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
Pack41k2.4MScore 83 - 9#9
GitHub
Awesome Copilot
AI Prompt Engineering Safety Review
Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement…
Pack41k2.4MScore 83 - 10#10
davila7
Owasp Security
Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and…
Pack33k285kScore 82
What makes a great security skill.
Findings with evidence and severity, not speculative warnings.
Clear scope rules: only systems you own or are authorized to test.
Machine-readable output you can track over time.
All 272 security skills.
trailofbits
Skills
trailofbitsc-review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications…
trailofbits
Skills
trailofbitspr-improver
Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews…
trailofbits
Skills
trailofbitsskill-improver
Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a…
trailofbits
Skills
trailofbitsaudit-context-building
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or…
trailofbits
Skills
trailofbitscode-improver
Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-ethereum-smart-contract-vulnerabilities
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual…
zhaoxuya520competition-android-hooking
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection…
zhaoxuya520competition-browser-persistence
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches…
zhaoxuya520competition-bundle-sourcemap-recovery
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend…
zhaoxuya520competition-cloud-metadata-path
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption…
zhaoxuya520competition-container-runtime
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift…
zhaoxuya520competition-dpapi-credential-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and…
zhaoxuya520competition-file-parser-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and…
zhaoxuya520competition-firmware-layout
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs…
zhaoxuya520competition-forensic-timeline
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use…
zhaoxuya520competition-graphql-rpc-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and…
zhaoxuya520competition-identity-windows
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material…
zhaoxuya520competition-ios-runtime
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning…
zhaoxuya520competition-k8s-control-plane
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster…
zhaoxuya520competition-lsass-ticket-material
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP…
zhaoxuya520competition-mailbox-abuse
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access…
zhaoxuya520competition-oauth-oidc-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping…
zhaoxuya520competition-pcap-protocol
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-api-gateway-access-logs
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-azure-activity-logs-for-threats
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cloud-storage-access-patterns
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection…
zhaoxuya520competition-crypto-mobile
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to…
zhaoxuya520competition-custom-protocol-replay
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums…
zhaoxuya520competition-jwt-claim-confusion
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer…
zhaoxuya520competition-kerberos-delegation
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and…
zhaoxuya520competition-kernel-container-escape
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and…
zhaoxuya520competition-linux-credential-pivot
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust…
Security skills, explained.
Also searched as: security audit skill, cybersecurity agent skills, pentest skill, ctf skills.
What are the best Claude skills for security?
Right now the top-ranked security skills on Alyn are Accessibility (affaan-m), Agent Security Hardening (affaan-m), Security And Hardening (Addy Osmani). Rankings combine GitHub stars, installs, freshness and depth, and update live.
What is the Cloudflare security audit skill?
A coding-agent skill from Cloudflare that runs multi-phase security audits and produces independently verified, machine-readable findings.
Can skills themselves be a security risk?
Yes. Skills can include scripts. Read SKILL.md and any bundled scripts before installing, and prefer well-known authors. Alyn shows file counts and links every file.
How do I install a security skill?
Run npx skills add owner/repo in your project, or copy the folder with SKILL.md into ~/.claude/skills. Every skill on this page has a ready-to-copy command.
More in Build
Security skills for your agent