Best Claude skills for security
Security skills range from Cloudflare's multi-phase security audit to hundreds of structured cybersecurity playbooks mapped to MITRE ATT&CK and NIST. Use them to audit your own code, harden infrastructure or practice CTF challenges. Always stay within systems you are authorized to test.
140 security skills · ranked live · November 2026
The top 10. Ranked by the Alyn Score.
- 1#1
affaan-m
Accessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
301k1.7MScore 89 - 2#2
Agent Security Hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
301k1.7MScore 89 - 3#3
Addy Osmani
Security And Hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
115k1.8MScore 87 - 4#4
wshobson
Agents
wshobson
Hybrid Cloud Networking
Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures…
42k2.6MScore 85 - 5#5
morluto
Rea Analysis Optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
450k29kScore 85 - 6#6
Rea Ci Tests Audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
450k29kScore 85 - 7#7
Reverse Engineer Anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
450k29kScore 85 - 8#8
wshobson
Agents
Screen Reader Testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
42k2.6MScore 85 - 9#9
GitHub
Awesome Copilot
GitHub
Agent Owasp Compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
41k2.4MScore 83 - 10#10
Google
Skills
Google
Agent Platform Alert Configuration
Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or…
24k1.1MScore 83
What makes a great security skill.
Findings with evidence and severity, not speculative warnings.
Clear scope rules: only systems you own or are authorized to test.
Machine-readable output you can track over time.
All 140 security skills.
BagelHole
DevOps Security Agent Skills
BagelHoledatadog
Implement Datadog monitoring and APM for infrastructure and applications. Configure agents, create dashboards, set up alerts, and implement distributed tracing. Use when implementing…
growthenginenowoslawski
Coldoutboundskills
growthenginenowoslawskideliverability-incident-response
Triage playbook for when cold email deliverability breaks. Decision-tree guidance for "I landed in spam", "bounce rate spiked", "domain blacklisted", "inbox blocked in warmup", "reply rate…
BagelHole
DevOps Security Agent Skills
BagelHoledocker-compose
Define and run multi-container Docker applications using Docker Compose. Create compose files, manage service dependencies, configure networks and volumes, and orchestrate local development…
BagelHole
DevOps Security Agent Skills
BagelHoledocker-management
Build, optimize, and troubleshoot Docker containers and images. Create efficient Dockerfiles, manage container lifecycle, configure networking and volumes, and debug container issues. Use…
Affitor
Affiliate Skills
Affitorcompliance-checker
Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check…
questflowaieinhorn-forensic-short
Use when evaluating David Einhorn-style forensic shorts and longs: accounting red flags, governance problems, capital allocation failures, and evidence-based short theses.
questflowaimuddy-waters-forensic
Use when evaluating Muddy Waters-style forensic short research: fraud, channel checks, related-party structures, cash verification, governance failure, and evidence-based short theses.
zubair-trabzadalegal-compliance
You are the compliance auditor for /legal compliance <url. You scan a website for compliance gaps across multiple regulatory frameworks and produce a scored compliance audit report with…
zubair-trabzadalegal-privacy
You are the privacy policy generator for /legal privacy <url. You scan a website to detect what data it collects, then generate a comprehensive GDPR and CCPA compliant privacy policy…
shawnpang
Startup Founder Skills
shawnpangprivacy-policy
When the user needs to draft, review, or update a privacy policy for their product, or needs to understand data privacy obligations across jurisdictions.
shawnpang
Startup Founder Skills
shawnpangsecurity-review
When the user needs a security assessment — threat modeling, vulnerability review, auth flow audit, dependency scanning, or says "is this secure", "review for vulnerabilities", "threat…
zubair-trabzadaterms-of-service-generator
Generates complete, GDPR/CCPA-compliant Terms of Service for a website or SaaS product, with plain English summaries for each section
morlutorea-changelog-update
Prepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.
wshobson
Agents
wshobsonsolidity-security
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or…
wshobson
Agents
wshobsonwcag-audit-patterns
Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or…
morlutorea-tool-design
Audit, investigate, design, or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.
mukul975
Anthropic Cybersecurity Skills
mukul975acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-apt-group-with-mitre-navigator
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-browser-forensics-with-hindsight
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-certificate-transparency-for-phishing
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-command-and-control-communication
Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cyber-kill-chain
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-dns-logs-for-exfiltration
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-docker-container-forensics
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-indicators-of-compromise
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-linux-audit-logs-for-intrusion
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-linux-elf-malware
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-linux-system-artifacts
Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user…
Security skills, explained.
Also searched as: security audit skill, cybersecurity agent skills, pentest skill, ctf skills.
What are the best Claude skills for security?
Right now the top-ranked security skills on Alyn are Accessibility (affaan-m), Agent Security Hardening (affaan-m), Security And Hardening (Addy Osmani). Rankings combine GitHub stars, installs, freshness and depth, and update live.
What is the Cloudflare security audit skill?
A coding-agent skill from Cloudflare that runs multi-phase security audits and produces independently verified, machine-readable findings.
Can skills themselves be a security risk?
Yes. Skills can include scripts. Read SKILL.md and any bundled scripts before installing, and prefer well-known authors. Alyn shows file counts and links every file.
How do I install a security skill?
Run npx skills add owner/repo in your project, or copy the folder with SKILL.md into ~/.claude/skills. Every skill on this page has a ready-to-copy command.
More in Build
Security skills for your agent