# Skills for Security Skills for Security: what each one does, an install command and example prompts. 1434 cards · page 16 of 36 - HTML: https://affpapa.org/en/nevibecode/skills/topic/security?page=16 - Instructions for agents: https://affpapa.org/en/nevibecode/agents.md - [ghost-scan-code](https://affpapa.org/en/nevibecode/skills/ghost-scan-code.md) — skill · ghostsecurity · Claude Code, Codex, Cursor +3 · 5200 installs — Finds security flaws in source code: SQL injection, XSS, SSRF and other OWASP categories. - [senior-secops](https://affpapa.org/en/nevibecode/skills/senior-secops.md) — skill · Alireza Rezvani · Claude Code · 903 installs — Checks source code, dependencies and security controls. - [owasp-security](https://affpapa.org/en/nevibecode/skills/agamm-owasp-security.md) — skill · agamm · Claude Code, Codex, Cursor +3 · 2400 installs — A skill that reviews code and diffs for vulnerabilities against OWASP Top 10:2025, ASVS 5.0, and the LLM and agentic risk lists. - [reverse-shell-techniques](https://affpapa.org/en/nevibecode/skills/reverse-shell-techniques.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 3400 installs — A playbook for reverse shells: language one-liners, encrypted channels, web shells, PTY upgrades and msfvenom payload generation. - [unauthorized-access-common-services](https://affpapa.org/en/nevibecode/skills/unauthorized-access-common-services.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 3400 installs — A pentest skill covering Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN and H2 Console when they sit exposed without authentication. - [upload-insecure-files](https://affpapa.org/en/nevibecode/skills/upload-insecure-files.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 3500 installs — Security testing playbook for file upload endpoints. - [restore-credentials](https://affpapa.org/en/nevibecode/skills/restore-credentials.md) — skill · Google LLC · Claude Code, Codex, Cursor +3 · 638 installs — This skill guides Android Restore Credentials integration with androidx.credentials for silent sign-in after an app is restored on a new device. - [analyzing-network-covert-channels-in-malware](https://affpapa.org/en/nevibecode/skills/analyzing-network-covert-channels-in-malware.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 372 installs — Reads a PCAP for DNS tunneling, ICMP exfiltration and C2 hidden in HTTP. - [analyzing-network-flow-data-with-netflow](https://affpapa.org/en/nevibecode/skills/analyzing-network-flow-data-with-netflow.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 372 installs — This skill parses NetFlow v9 and IPFIX records to spot volumetric anomalies, port scanning, data exfiltration and C2 beaconing. - [analyzing-heap-spray-exploitation](https://affpapa.org/en/nevibecode/skills/analyzing-heap-spray-exploitation.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 372 installs — A skill that reads memory dumps and finds heap spray artifacts: NOP sleds, executable injected regions and embedded shellcode. - [security-audit](https://affpapa.org/en/nevibecode/skills/donchitos-security-audit.md) — skill · Donchitos · Claude Code, Codex, Cursor +3 · 416 installs — This skill scans a game codebase for save tampering, cheat vectors, network exploits and input validation gaps. - [skill-scanner](https://affpapa.org/en/nevibecode/skills/skill-scanner.md) — skill · getsentry · Claude Code, Codex, Cursor +3 · 3800 installs — Scans agent skills for prompt injection, malicious code, excessive permissions, secret exposure, and supply-chain risks before installation. - [ghost-bits-cast-attack](https://affpapa.org/en/nevibecode/skills/ghost-bits-cast-attack.md) — skill · yaklang · Claude Code, Codex, Cursor +3 · 3300 installs — A Ghost Bits playbook: how a 16-bit Java char narrows to an 8-bit byte and slips past WAFs in front of SQLi, deserialization and webshell uploads. - [analyzing-malware-sandbox-evasion-techniques](https://affpapa.org/en/nevibecode/skills/analyzing-malware-sandbox-evasion-techniques.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 363 installs — Reads Cuckoo and AnyRun behavioral reports and flags the signs that a sample spotted the sandbox and played dead. - [exploiting-idor-vulnerabilities](https://affpapa.org/en/nevibecode/skills/exploiting-idor-vulnerabilities.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 365 installs — Guides authorized testing of IDOR vulnerabilities across API endpoints using Burp Suite, the Authorize extension, and curl scripts. - [analyzing-malware-behavior-with-cuckoo-sandbox](https://affpapa.org/en/nevibecode/skills/analyzing-malware-behavior-with-cuckoo-sandbox.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 361 installs — A skill that detonates samples in Cuckoo Sandbox and walks through what they do at runtime: processes, files, registry, network. - [modern-cpp](https://affpapa.org/en/nevibecode/skills/modern-cpp.md) — skill · trailofbits · Claude Code, Codex, Cursor +3 · 1200 installs — Directs C++ development toward C++20/23/26 idioms, replacing dangerous raw pointers, legacy macros, and SFINAE boilerplate with memory-safe patterns. - [information-security-manager-iso27001](https://affpapa.org/en/nevibecode/skills/information-security-manager-iso27001.md) — skill · Alireza Rezvani · Claude Code · 855 installs — Automates ISO 27001:2022 ISMS implementation, security risk assessment, and compliance checking for HealthTech and MedTech companies. - [testing-for-sensitive-data-exposure](https://affpapa.org/en/nevibecode/skills/testing-for-sensitive-data-exposure.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 356 installs — A skill that walks an agent through checks for leaked secrets, PII in API responses, and unencrypted data transmission. - [performing-security-headers-audit](https://affpapa.org/en/nevibecode/skills/performing-security-headers-audit.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 359 installs — Audits HTTP security headers including CSP, HSTS, and cookie flags. - [analyzing-malware-persistence-with-autoruns](https://affpapa.org/en/nevibecode/skills/analyzing-malware-persistence-with-autoruns.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 356 installs — A skill that walks the agent through Windows persistence hunting with Sysinternals Autoruns: registry keys, services, tasks, drivers. - [unsafe-checker](https://affpapa.org/en/nevibecode/skills/unsafe-checker.md) — skill · actionbook · Claude Code, Codex, Cursor +3 · 3200 installs — Reviews unsafe Rust blocks and FFI boundaries, tracking required SAFETY comments and catching common causes of undefined behavior. - [analyzing-memory-dumps-with-volatility](https://affpapa.org/en/nevibecode/skills/analyzing-memory-dumps-with-volatility.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 354 installs — Investigates RAM memory dumps using Volatility 3 to uncover hidden malware, code injections, network activity, and cached credentials. - [security-pen-testing](https://affpapa.org/en/nevibecode/skills/security-pen-testing.md) — skill · Alireza Rezvani · Claude Code · 834 installs — This skill guides vulnerability checks across web apps, APIs, and dependencies, from OWASP reviews to pen test reports. - [code-review](https://affpapa.org/en/nevibecode/skills/llama-farm-code-review.md) — skill · llama-farm · Claude Code, Codex, Cursor +3 · 1200 installs — Walks the changed lines of a diff looking for leaked secrets, injection, empty catch blocks and placeholder code. - [testing-oauth2-implementation-flaws](https://affpapa.org/en/nevibecode/skills/testing-oauth2-implementation-flaws.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 350 installs — A skill that probes OAuth 2.0 and OpenID Connect flows for code interception, redirect URI tricks, CSRF, token leakage and PKCE bypass. - [implementing-api-rate-limiting-and-throttling](https://affpapa.org/en/nevibecode/skills/implementing-api-rate-limiting-and-throttling.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 348 installs — This skill configures Redis-backed sliding window and token bucket rate limiters to protect API endpoints against brute force attacks. - [analyzing-malware-family-relationships-with-malpedia](https://affpapa.org/en/nevibecode/skills/analyzing-malware-family-relationships-with-malpedia.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 349 installs — This skill connects malware aliases, YARA rules, and threat actors through Malpedia. - [red-team](https://affpapa.org/en/nevibecode/skills/red-team.md) — skill · Alireza Rezvani · Claude Code · 826 installs — Skill for structured authorized red team operations: MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, and OPSEC risk assessment. - [analyzing-lnk-file-and-jump-list-artifacts](https://affpapa.org/en/nevibecode/skills/analyzing-lnk-file-and-jump-list-artifacts.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 348 installs — Parses Windows shortcut files and Jump Lists with LECmd, JLECmd and manual Shell Link parsing. - [domain-web](https://affpapa.org/en/nevibecode/skills/domain-web.md) — skill · actionbook · Claude Code, Codex, Cursor +3 · 3100 installs — A Rust web-service skill covering async handlers, shared state, errors, extractors, and middleware. - [adversarial-reviewer](https://affpapa.org/en/nevibecode/skills/adversarial-reviewer.md) — skill · ekreloff · Claude Code · 813 installs — This skill reviews changes through Saboteur, New Hire, and Security Auditor personas. - [assuredworkloads-frameworks-navigator](https://affpapa.org/en/nevibecode/skills/assuredworkloads-frameworks-navigator.md) — skill (official Google) · google · Claude Code, Gemini CLI, Codex · 191 installs — Maps compliance requirements to Google Cloud Data Boundary Frameworks and cloud controls. - [analyzing-macro-malware-in-office-documents](https://affpapa.org/en/nevibecode/skills/analyzing-macro-malware-in-office-documents.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 336 installs — Examines malicious VBA macros in Word, Excel, and PowerPoint files. - [testing-for-business-logic-vulnerabilities](https://affpapa.org/en/nevibecode/skills/testing-for-business-logic-vulnerabilities.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 333 installs — This skill manually checks web app business logic with Burp Suite. - [isms-audit-expert](https://affpapa.org/en/nevibecode/skills/isms-audit-expert.md) — skill · Alireza Rezvani · Claude Code · 791 installs — Skill for ISO 27001 compliance verification, security control assessment, and certification support. - [assuredworkloads-frameworks-author](https://affpapa.org/en/nevibecode/skills/assuredworkloads-frameworks-author.md) — skill (official Google) · google · Claude Code, Gemini CLI, Codex · 185 installs — This skill authors custom cloud controls and customized frameworks for Assured Workloads when built-in resources do not cover the requirement. - [skill-security-auditor](https://affpapa.org/en/nevibecode/skills/skill-security-auditor.md) — skill · Alireza Rezvani · Claude Code · 785 installs — Scans AI agent skills for malicious code before install: detects eval(), os.system(), data exfiltration, prompt injection, and vulnerable dependencies. - [ms365-tenant-manager](https://affpapa.org/en/nevibecode/skills/ms365-tenant-manager.md) — skill · Alireza Rezvani · Claude Code · 783 installs — This skill assists Global Administrators with Microsoft 365 tenant setup, user lifecycle tasks, licensing, Exchange Online, Teams, and security policies. - [testing-websocket-api-security](https://affpapa.org/en/nevibecode/skills/testing-websocket-api-security.md) — skill · mahipal · Claude Code, Codex, Cursor +3 · 328 installs — Audits WebSocket API security, checking upgrade handshake authentication, token validation, and CSWSH vulnerabilities. Next: https://affpapa.org/en/nevibecode/skills/topic/security.md?page=17 ## Refine [audit](https://affpapa.org/en/nevibecode/tag/audit.md) · [owasp](https://affpapa.org/en/nevibecode/tag/owasp.md) · [python](https://affpapa.org/en/nevibecode/tag/python.md) · [compliance](https://affpapa.org/en/nevibecode/tag/compliance.md) · [google-cloud](https://affpapa.org/en/nevibecode/tag/google-cloud.md) · [api](https://affpapa.org/en/nevibecode/tag/api.md) · [oauth](https://affpapa.org/en/nevibecode/tag/oauth.md) · [auth](https://affpapa.org/en/nevibecode/tag/auth.md) · [typescript](https://affpapa.org/en/nevibecode/tag/typescript.md) · [jwt](https://affpapa.org/en/nevibecode/tag/jwt.md) · [secrets](https://affpapa.org/en/nevibecode/tag/secrets.md) · [reverse-engineering](https://affpapa.org/en/nevibecode/tag/reverse-engineering.md) ## Narrow this list Parameters: `?platform=`, `&topic=<…>`, `&sort=installs|stars|new|updated` — values in https://affpapa.org/en/nevibecode/agents.md --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md