Best Claude skills for security
Security skills range from Cloudflare's multi-phase security audit to hundreds of structured cybersecurity playbooks mapped to MITRE ATT&CK and NIST. Use them to audit your own code, harden infrastructure or practice CTF challenges. Always stay within systems you are authorized to test.
140 security skills · ranked live · November 2026
The top 10. Ranked by the Alyn Score.
- 1#1
affaan-m
Accessibility
Design, implement, and audit accessible UI to WCAG 2.2 Level AA across Web, iOS, and Android — semantic ARIA roles and labels, accessibility traits and hints, focus management, contrast…
301k1.7MScore 89 - 2#2
Agent Security Hardening
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building…
301k1.7MScore 89 - 3#3
Addy Osmani
Security And Hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when…
115k1.8MScore 87 - 4#4
wshobson
Agents
wshobson
Hybrid Cloud Networking
Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures…
42k2.6MScore 85 - 5#5
morluto
Rea Analysis Optimization
Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence. Use for analysis bottlenecks and cache or query…
450k29kScore 85 - 6#6
Rea Ci Tests Audit
Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency changes, rather than ordinary…
450k29kScore 85 - 7#7
Reverse Engineer Anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live…
450k29kScore 85 - 8#8
wshobson
Agents
Screen Reader Testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive…
42k2.6MScore 85 - 9#9
GitHub
Awesome Copilot
GitHub
Agent Owasp Compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production…
41k2.4MScore 83 - 10#10
Google
Skills
Google
Agent Platform Alert Configuration
Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or…
24k1.1MScore 83
What makes a great security skill.
Findings with evidence and severity, not speculative warnings.
Clear scope rules: only systems you own or are authorized to test.
Machine-readable output you can track over time.
All 140 security skills.
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-macro-malware-in-office-documents
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malware-behavior-with-cuckoo-sandbox
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malware-family-relationships-with-malpedia
Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-linux-kernel-rootkits
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-active-directory-acl-abuse
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-ethereum-smart-contract-vulnerabilities
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-malware-sandbox-evasion-techniques
Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-api-gateway-access-logs
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-azure-activity-logs-for-threats
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-cloud-storage-access-patterns
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access…
mukul975
Anthropic Cybersecurity Skills
mukul975analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection…
ljagiello
Ctf Skills
ljagielloctf-ai-ml
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership…
ljagiello
Ctf Skills
ljagielloctf-crypto
Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices…
ljagiello
Ctf Skills
ljagielloctf-forensics
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions…
ljagiello
Ctf Skills
ljagielloctf-malware
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET…
ljagiello
Ctf Skills
ljagielloctf-misc
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode…
ljagiello
Ctf Skills
ljagielloctf-osint
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse…
ljagiello
Ctf Skills
ljagielloctf-reverse
Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or…
ljagiello
Ctf Skills
ljagiellosolve-challenge
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge…
ljagiello
Ctf Skills
ljagielloctf-writeup
Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and…
lawve-ai
Awesome Legal Skills
lawve-aicis-controls
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data…
lawve-ai
Awesome Legal Skills
lawve-aicmmc
Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks…
lawve-ai
Awesome Legal Skills
lawve-aisecurity-review-openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security…
lawve-ai
Awesome Legal Skills
lawve-aibacen-compliance-sentinel-rafael-mastronardi
Orientação completa sobre conformidade com regulamentações do Banco Central do Brasil: Resolução CMN nº 4.893/2021 (Política de Segurança Cibernética), Resolução BCB nº 85/2021 (GRSIC)…
BagelHole
DevOps Security Agent Skills
BagelHolegithub-actions
Build, test, and deploy applications using GitHub Actions workflows. Create CI/CD pipelines, configure runners, manage secrets, and automate software delivery. Use when working with GitHub…
BagelHole
DevOps Security Agent Skills
BagelHolejenkins
Create and manage Jenkins CI/CD pipelines, configure agents, manage plugins, and automate builds. Use when working with Jenkins servers, creating Jenkinsfiles, or setting up build…
BagelHole
DevOps Security Agent Skills
BagelHolegitlab-ci
Configure GitLab CI/CD pipelines and runners for automated building, testing, and deployment. Create .gitlab-ci.yml configurations, manage runners, and implement DevOps workflows. Use when…
BagelHole
DevOps Security Agent Skills
BagelHoleaccess-review
Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.
BagelHole
DevOps Security Agent Skills
BagelHoleagent-evals
Build automated evaluation suites for AI agents using golden datasets, rubrics, and regression gates. Use when shipping agent features, validating prompt changes, or gating deployments on…
BagelHole
DevOps Security Agent Skills
BagelHoleagent-observability
Instrument AI agents with tracing, token metrics, latency, and cost visibility. Use for reliability and debugging.
Security skills, explained.
Also searched as: security audit skill, cybersecurity agent skills, pentest skill, ctf skills.
What are the best Claude skills for security?
Right now the top-ranked security skills on Alyn are Accessibility (affaan-m), Agent Security Hardening (affaan-m), Security And Hardening (Addy Osmani). Rankings combine GitHub stars, installs, freshness and depth, and update live.
What is the Cloudflare security audit skill?
A coding-agent skill from Cloudflare that runs multi-phase security audits and produces independently verified, machine-readable findings.
Can skills themselves be a security risk?
Yes. Skills can include scripts. Read SKILL.md and any bundled scripts before installing, and prefer well-known authors. Alyn shows file counts and links every file.
How do I install a security skill?
Run npx skills add owner/repo in your project, or copy the folder with SKILL.md into ~/.claude/skills. Every skill on this page has a ready-to-copy command.
More in Build
Security skills for your agent