# Skills for Security Skills for Security: what each one does, an install command and example prompts. 1434 cards · page 12 of 36 - HTML: https://affpapa.org/en/nevibecode/skills/topic/security?page=12 - Instructions for agents: https://affpapa.org/en/nevibecode/agents.md - [analyzing-network-traffic-with-wireshark](https://affpapa.org/en/nevibecode/skills/analyzing-network-traffic-with-wireshark.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 533 installs — A skill that walks your agent through packet capture and analysis with Wireshark and tshark: C2 traffic, leaks, protocol faults. - [code-review](https://affpapa.org/en/nevibecode/skills/getsentry-code-review.md) — skill · getsentry · Claude Code, Codex, Cursor +3 · 5500 installs — A skill that reviews pull requests and code changes against Sentry engineering practices: security, performance, tests, design. - [analyzing-dns-logs-for-exfiltration](https://affpapa.org/en/nevibecode/skills/analyzing-dns-logs-for-exfiltration.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 527 installs — Reads DNS query logs and hunts for tunneling, DGA domains and covert C2 channels. - [analyzing-command-and-control-communication](https://affpapa.org/en/nevibecode/skills/analyzing-command-and-control-communication.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 528 installs — This skill examines malware C2 traffic to map protocols, beacon patterns, encoding, commands, and infrastructure. - [testing-for-broken-access-control](https://affpapa.org/en/nevibecode/skills/testing-for-broken-access-control.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 522 installs — Guides testing of web apps and APIs for broken access control flaws under OWASP A01:2021. - [analyzing-linux-audit-logs-for-intrusion](https://affpapa.org/en/nevibecode/skills/analyzing-linux-audit-logs-for-intrusion.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 522 installs — Guides Linux intrusion investigations with auditd, ausearch, and aureport, configuring kernel audit rules and rebuilding attacker timelines. - [wp-abilities-verify](https://affpapa.org/en/nevibecode/skills/wp-abilities-verify.md) — skill · WordPress · Claude Code, Codex, Cursor +3 · 2600 installs — Verifies WordPress plugin Abilities API registrations, flags hidden database writes in readonly callbacks, and validates schemas. - [prompt-guard](https://affpapa.org/en/nevibecode/skills/prompt-guard.md) — skill · Orchestra Research · Claude Code, Codex, Cursor +3 · 974 installs — Integrates Meta's 86M parameter Prompt Guard model to detect jailbreaks and prompt injections in user prompts and RAG contexts before reaching the LLM. - [exploiting-sql-injection-vulnerabilities](https://affpapa.org/en/nevibecode/skills/exploiting-sql-injection-vulnerabilities.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 504 installs — Guides SQL injection testing across web applications during authorized security assessments. - [llamaguard](https://affpapa.org/en/nevibecode/skills/llamaguard.md) — skill · Orchestra Research · Claude Code, Codex, Cursor +3 · 945 installs — A skill that wires Meta's 7-8B LlamaGuard model into your agent to filter user prompts and model responses across 6 safety categories. - [nemo-guardrails](https://affpapa.org/en/nevibecode/skills/nemo-guardrails.md) — skill · Orchestra Research · Claude Code, Codex, Cursor +3 · 944 installs — This skill helps configure runtime safety for LLM apps, from jailbreak checks to PII filtering. - [analyzing-bootkit-and-rootkit-samples](https://affpapa.org/en/nevibecode/skills/analyzing-bootkit-and-rootkit-samples.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 486 installs — Analyzes bootkits and rootkits in MBR, VBR, and UEFI firmware. - [rds-oracle](https://affpapa.org/en/nevibecode/skills/rds-oracle.md) — skill · aws · Claude Code, Codex, Cursor +3 · 4600 installs — Troubleshoots Amazon RDS for Oracle connectivity, authentication, networking and driver failures. - [reverse-engineering-android-malware-with-jadx](https://affpapa.org/en/nevibecode/skills/reverse-engineering-android-malware-with-jadx.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 486 installs — A skill that walks the agent through a malicious Android APK: JADX decompilation, manifest review, and hunting for data theft and C2. - [testing-api-authentication-weaknesses](https://affpapa.org/en/nevibecode/skills/testing-api-authentication-weaknesses.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 484 installs — Tests REST API authentication for bypasses, broken JWT implementations, and unprotected endpoints. - [VibeSec-Skill](https://affpapa.org/en/nevibecode/skills/vibesec-skill.md) — skill · BehiSecc · Claude Code, Codex, Cursor +3 · 1100 installs — A coding-agent skill that pushes the model toward secure web development and runs a security audit when you ask for one. - [gmgn-contract-dd](https://affpapa.org/en/nevibecode/skills/gmgn-contract-dd.md) — skill · GMGNAI · Claude Code, Codex, Cursor +3 · 7000 installs — Scores one token address from 0 to 100 using contract safety, holder data and price action. - [hack](https://affpapa.org/en/nevibecode/skills/hack.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 4300 installs — Acts as the primary router and safety gate for authorized penetration testing, code auditing, and incident triage. - [aws-auth](https://affpapa.org/en/nevibecode/skills/aws-auth.md) — skill · aws · Claude Code, Codex, Cursor +3 · 4500 installs — Adds Amazon Cognito authentication to web and mobile apps. - [analyzing-azure-activity-logs-for-threats](https://affpapa.org/en/nevibecode/skills/analyzing-azure-activity-logs-for-threats.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 471 installs — Runs KQL queries against Azure Monitor activity and sign-in logs to surface suspicious admin operations and sign-in anomalies. - [is-this-photo-real](https://affpapa.org/en/nevibecode/skills/is-this-photo-real.md) — skill · UseOSINT · Claude Code, Codex, Cursor +3 · 58300 installs — A skill that checks whether an image or video is authentic: finds the earliest copy, reads metadata, tests lighting and shadows. - [investigate-without-getting-made](https://affpapa.org/en/nevibecode/skills/investigate-without-getting-made.md) — skill · UseOSINT · Claude Code, Codex, Cursor +3 · 58200 installs — A skill that keeps your research from tipping off the subject: it maps your attribution surface, separates research identity from real identity, and says when a plain browser is enough. - [analyzing-indicators-of-compromise](https://affpapa.org/en/nevibecode/skills/analyzing-indicators-of-compromise.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 466 installs — Scores IPs, domains, hashes, URLs and email artifacts for maliciousness, then sorts them into block, monitor or whitelist. - [analyzing-campaign-attribution-evidence](https://affpapa.org/en/nevibecode/skills/analyzing-campaign-attribution-evidence.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 464 installs — A skill that scores cyber-campaign evidence against competing hypotheses and returns a confidence level for attribution. - [testing-cors-misconfiguration](https://affpapa.org/en/nevibecode/skills/testing-cors-misconfiguration.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 463 installs — Audits API endpoints for Cross-Origin Resource Sharing vulnerabilities during authorized penetration tests. - [what-leaked-about-you](https://affpapa.org/en/nevibecode/skills/what-leaked-about-you.md) — skill · UseOSINT · Claude Code, Codex, Cursor +3 · 57800 installs — This skill checks an email, username, phone or name against breach data and explains what each record means. - [waf](https://affpapa.org/en/nevibecode/skills/waf.md) — skill · aws · Claude Code, Codex, Cursor +3 · 4300 installs — A skill for configuring AWS WAF: web ACLs, managed rules, Bot Control, login and signup protection. - [fallow](https://affpapa.org/en/nevibecode/skills/fallow.md) — skill · fallow-rs · Claude Code, Codex, Cursor +3 · 9600 installs — Analyzes TypeScript and JavaScript codebases for dead code, duplicates, and architectural risks. - [analyzing-linux-system-artifacts](https://affpapa.org/en/nevibecode/skills/analyzing-linux-system-artifacts.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 461 installs — Walks an agent through Linux system artifacts after a breach: auth logs, cron and systemd persistence, shell history, SSH keys. - [supabase-server](https://affpapa.org/en/nevibecode/skills/supabase-server.md) — skill · supabase · Claude Code, Codex, Cursor +3 · 9700 installs — Tells the agent how to write Edge Functions, Hono apps and webhook handlers on @supabase/server: auth modes, clients, inbound request checks. - [analyzing-linux-elf-malware](https://affpapa.org/en/nevibecode/skills/analyzing-linux-elf-malware.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 457 installs — A skill that walks an agent through dissecting suspicious Linux ELF binaries: headers, strings, syscalls, Ghidra. - [analyzing-disk-image-with-autopsy](https://affpapa.org/en/nevibecode/skills/analyzing-disk-image-with-autopsy.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 454 installs — Guides forensic investigation of raw, E01, and AFF disk images using Autopsy and The Sleuth Kit. - [find-the-original-image](https://affpapa.org/en/nevibecode/skills/find-the-original-image.md) — skill · UseOSINT · Claude Code, Codex, Cursor +3 · 56500 installs — Searches multiple image engines for a picture’s source and earliest publication. - [aws-security](https://affpapa.org/en/nevibecode/skills/aws-security.md) — skill · aws · Claude Code, Codex, Cursor +3 · 4300 installs — Assesses AWS security architectures, network firewall policies, and findings from services like GuardDuty. - [analyzing-kubernetes-audit-logs](https://affpapa.org/en/nevibecode/skills/analyzing-kubernetes-audit-logs.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 450 installs — Parses kube-apiserver audit logs in JSON lines and flags exec into pods, secret reads, RBAC edits and anonymous access. - [analyzing-sbom-for-supply-chain-vulnerabilities](https://affpapa.org/en/nevibecode/skills/analyzing-sbom-for-supply-chain-vulnerabilities.md) — skill · mukul975 · Claude Code, Codex, Cursor +3 · 444 installs — Parses CycloneDX and SPDX SBOM files, matches components against the NVD CVE database through the NVD 2.0 API and builds a dependency graph. - [code-obfuscation-deobfuscation](https://affpapa.org/en/nevibecode/skills/code-obfuscation-deobfuscation.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 4000 installs — Binary deobfuscation playbook covering junk code, opaque predicates, control flow flattening, self-modifying code, and virtual machine protectors. - [sqli-sql-injection](https://affpapa.org/en/nevibecode/skills/sqli-sql-injection.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 4000 installs — A playbook for SQL injection work: which payloads to try first, how to fingerprint the DBMS, and how to pull data blind. - [android-pentesting-tricks](https://affpapa.org/en/nevibecode/skills/android-pentesting-tricks.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 4100 installs — An Android pentesting playbook: SSL pinning bypass, exported component abuse, WebView attacks and intent redirection. - [abusing-dpapi-for-credential-access](https://affpapa.org/en/nevibecode/skills/abusing-dpapi-for-credential-access.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 442 installs — Guides extraction and decryption of Windows DPAPI secrets, including Credential Manager entries and browser data. Next: https://affpapa.org/en/nevibecode/skills/topic/security.md?page=13 ## Refine [audit](https://affpapa.org/en/nevibecode/tag/audit.md) · [owasp](https://affpapa.org/en/nevibecode/tag/owasp.md) · [python](https://affpapa.org/en/nevibecode/tag/python.md) · [compliance](https://affpapa.org/en/nevibecode/tag/compliance.md) · [google-cloud](https://affpapa.org/en/nevibecode/tag/google-cloud.md) · [api](https://affpapa.org/en/nevibecode/tag/api.md) · [oauth](https://affpapa.org/en/nevibecode/tag/oauth.md) · [auth](https://affpapa.org/en/nevibecode/tag/auth.md) · [typescript](https://affpapa.org/en/nevibecode/tag/typescript.md) · [jwt](https://affpapa.org/en/nevibecode/tag/jwt.md) · [secrets](https://affpapa.org/en/nevibecode/tag/secrets.md) · [reverse-engineering](https://affpapa.org/en/nevibecode/tag/reverse-engineering.md) ## Narrow this list Parameters: `?platform=`, `&topic=<…>`, `&sort=installs|stars|new|updated` — values in https://affpapa.org/en/nevibecode/agents.md --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md