NeVibeCode · collection · 30

Security skills and rules

Ordered by install count from the source, then by repository stars on GitHub. Only cards with a checked description are included.

1

git-guardrails-claude-code

This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes.

skill · Matt Pocock · MIT

499,069installs
2

firebase-security-rules-auditor

Audits Firebase rules for data leaks, privilege escalation, and validation gaps. Use it when reviewing Firestore or Cloud Storage access.

skill · Google LLC · Apache-2.0

138,200installs
3

solana-dev

Skill for building Solana dApps, writing Anchor smart contracts, managing wallets and transactions. Covers setup, testing, and devnet deployment end-to-end.

skill · Solana Foundation · MIT

98,300installs
4

stripe-best-practices

This skill guides Stripe API choices, payment flows, and integration security. Use it when building, testing, or reviewing Stripe code.

skill · stripe · MIT

97,800installs
5

cloudflare-one

Walks your agent through designing, configuring and troubleshooting Cloudflare One Zero Trust and SASE deployments. Useful when you need Access, Gateway or tunnel work done without digging through docs yourself.

skill · cloudflare · Apache-2.0

92,200installs
6

turnstile-spin

Sets up Cloudflare Turnstile bot verification across existing frontend and backend code, including widget embedding and server-side siteverify.

skill · cloudflare · Apache-2.0

92,200installs
7

cloudflare-one-migrations

Plans a migration from VPN, SWG or SASE to Cloudflare One: maps policies to Cloudflare resources, flags parity gaps and stages the rollout.

skill · cloudflare · Apache-2.0

88,700installs
8

security-and-hardening

Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release.

skill · addyosmani · MIT

69,400installs
9

gws-shared official

This skill gives agents shared rules for gws CLI authentication, flags, and output formats. Use it when working with gws commands.

skill · googleworkspace · Apache-2.0

66,000installs
10

ponytail-review

ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits.

skill · DietrichGebert · MIT

56,300installs
11

doubt-driven-development

This skill sends non-trivial decisions to a fresh-context reviewer looking for flaws. Use it before changes that are hard to undo or costly to debug later.

skill · addyosmani · MIT

56,100installs
12

security-audit

Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks.

skill · cloudflare · MIT

52,200installs
13

ponytail-audit

It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes.

skill · DietrichGebert · MIT

44,800installs
14

golang-security

Identifies Go vulnerabilities, models threats with STRIDE and DREAD, and fixes injections, secret leaks, and cryptography flaws.

skill · samber · MIT

42,100installs
15

golang-dependency-management

This skill manages Go dependencies, version conflicts, module audits, and vulnerability checks. Use it when changing go.mod or reviewing a package before adoption.

skill · samber · MIT

39,700installs
16

improve

Surveys any codebase in read-only mode and writes self-contained implementation plans for other models to execute. Helps audit bugs, tech debt, and security without touching code.

skill · shadcn · MIT

37,500installs
17

code-reviewer official

This subagent checks code changes for bugs, security issues, and project-rule violations. Use it when a review should focus on findings that matter.

subagent · Anthropic · Apache-2.0

31,050installs
18

code-reviewer

Reviews code changes for bugs, security flaws and maintenance issues. Use it before merging complex work or auditing a project.

subagent · VoltAgent Community · MIT

31,050installs
19

code-review-excellence

This skill guides pull request reviews, catches logic and security issues, and helps teams give specific feedback. Use it for review standards or developer mentoring.

skill · Seth Hobson · MIT

30,193installs
20

persona-it-admin official

A persona skill for IT admins: watches for suspicious logins, sets Drive sharing policies, and works through requests with gws.

skill · googleworkspace · Apache-2.0

30,000installs
21

gws-modelarmor official

Filters user prompts and model responses for safety using Google Model Armor templates. Useful for automated content sanitization via the gws CLI.

skill · googleworkspace · Apache-2.0

29,900installs
22

gws-modelarmor-create-template official

Creates Google Model Armor templates in GCP to filter user-generated content. Useful when configuring jailbreak defenses via the gws CLI.

skill · googleworkspace · Apache-2.0

29,800installs
23

gws-modelarmor-sanitize-prompt official

This skill sends a user prompt through a Google Model Armor template. Use it when an incoming prompt needs to pass through a configured Model Armor filter.

skill · googleworkspace · Apache-2.0

29,600installs
24

gws-modelarmor-sanitize-response official

This skill sends a model response to Google Model Armor for filtering with a template. Use it to check output before showing it to a user.

skill · googleworkspace · Apache-2.0

29,500installs
25

docker-expert

A skill that turns your AI agent into a Docker reviewer for Dockerfiles, multi-stage builds and container security. Useful when images and Compose files need a second look.

skill · sickn33 · MIT

27,200installs
26

security-requirement-extraction

Turns a threat model and business context into testable security requirements: user stories, acceptance criteria, test cases.

skill · Seth Hobson · MIT

24,845installs
27

java-springboot official

Gives GitHub Copilot Spring Boot development practices, from project layout to tests and security. Use it when writing or reviewing Java application code.

skill · github · MIT

21,272installs
28

stride-analysis-patterns

This skill uses STRIDE to identify threats in system architecture and security decisions. Use it to structure a threat modeling session or prepare security documentation.

skill · Seth Hobson · MIT

20,506installs
29

threat-mitigation-mapping

Maps identified threats to security controls and supports remediation planning. Use it when reviewing control coverage or setting security priorities.

skill · Seth Hobson · MIT

19,456installs
30

auth-implementation-patterns

A skill for designing authentication and authorization: JWT, OAuth2, sessions, roles. Useful when you build a login flow or fix an access bug.

skill · Seth Hobson · MIT

19,388installs

Security skills and rules ranked by GitHub stars and source install counts, each description verified. Trust in the skill itself matters more here than anywhere: according to Atlan, Snyk found issues in 36.82% of 3,984 skills from the ClawHub and skills.sh registries. Read the scripts before installing, see whether the skill reaches the network, and check allowed-tools. A scanner that uploads your code to an outside service is something to clear with your team first.

Security skills and rules

gws-shared official

code-reviewer official

persona-it-admin official

gws-modelarmor official

gws-modelarmor-create-template official

gws-modelarmor-sanitize-prompt official

gws-modelarmor-sanitize-response official

java-springboot official

Other collections