Skills tagged security: 108 agent skills for Claude Code
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex.
agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.
aws-lambda-microvms — Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.
aws-secrets-manager — Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
chaos-engineer — Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks.
cloud-architect — Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure.
cloudflare — Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security.
cloudflare-one — Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments.
cloudflare-one-migrations — Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.
cloudflare-troubleshooting — Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering.
cloudfront — Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions.
code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
creating-api-gateway-stage — Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices.
differential-review — Performs security-focused differential review of code changes.
dimensional-analysis — Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling.
django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages. py.
dotnet-core-expert — NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices.
entry-point-analyzer — Analyzes smart contract codebases to identify state-changing entry points for security auditing.
firebase-apk-scanner — Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
github-sensitive-data-cleanup — Scan and remove sensitive data (secrets, API keys, private domains/IPs, PII) from GitHub repository history.
graph-evolution — Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes.
guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.
java-architect — x, microservices, or reactive programming.
launching-ec2-instance-with-best-practices — Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles.
marketplace-health-check — Run a full 6-dimension health check of this Claude Code skills marketplace repo — code/script safety, documentation/SSOT consistency, security/PII leaks.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
nestjs-expert — Creates and configures NestJS modules, controllers, services, DTOs, guards, and interceptors for enterprise-grade TypeScript backend applications. ts files.
open-sourcing — This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public".
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
php-pro — 3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9, async patterns with Swoole, and PSR standards.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
qa-expert — This skill should be used when establishing comprehensive QA testing processes for any software project.
rds-db2 — Provisions, connects, migrates, and operates Amazon RDS for Db2.
repomix-safe-mixer — Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing.
resilience-hub-multi-account — Configures AWS Resilience Hub v2 for multi-account resilience management across an AWS Organization.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
ruzzy — Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language.
scanning-with-aws-security-agent — Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked.
secure-code-guardian — Use when implementing authentication/authorization, securing user input.
secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow.
securing-s3-buckets — Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations.
security-audit — Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons.
security-reviewer — Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance.
setting-up-ec2-instance-profiles — Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials.
setup — Set up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing.
setup-security-agent — Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.
sharp-edges — Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes.
shieldadvanced — Configures AWS Shield Advanced for enhanced Distributed Denial of Service (DDoS) protection: subscribing accounts and adding resource protections.
sitetositevpn — Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
supply-chain-risk-auditor — Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree.
threat-modeling-with-aws-security-agent — Run an AWS Security Agent threat model review on spec/design documents. md for security posture changes, or STRIDE analysis.
token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist.
ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts.
trailmark — Builds and queries multi-language source and binary code graphs for security analysis. toml`, and SQL schema graphs.
trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
trailmark-structural — 5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes.
trailmark-variant-neighborhood — Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions.