Security & Testing Agent Skills for Claude Code

Use when a repository, system, or major change needs a structured STRIDE-A threat model — map architecture, data flows, trust boundaries…

Generate a STRIDE-based security threat model for a repository.

Repository-grounded threat modeling. Enumerates trust boundaries, assets, attacker capabilities, and abuse paths tied to actual code. Not…

Expert in threat modeling methodologies, security architecture review, and risk assessment.

Generate and analyze TLA+ specifications for distributed systems verification

Expert skill for TLS/SSL implementation and certificate management.

Together AI security basics for inference, fine-tuning, and model deployment.

Track new token launches across DEXes with risk analysis and contract

Create runtime-aware hook enforcement for repo tool constraints.

Audit the active toolguard permission configuration for security risks and flag dangerous allow rules and takeover-mode misconfigurations…

Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category.

Tests and evaluates any Claude Code skill for structural validity, quality, and trigger accuracy.

Generates a current RFC 6238 TOTP two-factor code from a shared secret the user already holds, via a bundled zero-dependency script that…

Stores and retrieves 2FA shared secrets and single-use backup codes safely - OS keychain, gitignored directory, or CI secret store - and…

This skill enables Claude to track and run regression tests, ensuring new changes don't break existing functionality.

Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.

Classifies and prioritizes security incidents using structured IR

Runs integration- and E2E-first test-driven development with a small number of broad vertical tests, pure-function unit tests, real…

Security best practices for TwinMind: on-device audio processing, encrypted

GAN thinking mode — when delivering X, also run an adversarial pipe asking "is X fundamentally flawed as a concept? achievable with…

Use when a PR or feature needs both specification and code-quality review