Security & Testing Agent Skills for Claude Code

Fires when a trust boundary is created, moved, or deleted — during framing, planning, or review of one scoped subject (one diff, one…

Scan code changes or a whole repo for security vulnerabilities using STRIDE, validate findings for real exploitability, and report with…

Detect secrets, credentials, and sensitive data in code and configurations.

Detect exposed secrets, API keys, and credentials in code.

Design, provision, use, rotate, revoke, detect, and recover from application secrets safely.

Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google

USAP agent skill for Security Architecture.

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table.

Comprehensive security scanning and vulnerability detection.

Perform a comprehensive, adversarial security audit of a codebase, API, application, or system design.

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks.

Use when the user takes over an inherited system, codebase, server, or cloud account from a prior developer — or when leaked secrets, open…

Build a minimal but real security policy for sensitive apps.

Security-first auditing of AI-generated code — Level 1 quick checks during /toh-dev and /toh-test (hardcoded secrets, dangerous code…

Generated code must be aligned with security headers (e.g. no unsave JS eval).

Analyze code, infrastructure, and configurations by conducting comprehensive

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

Isolated analysis environment management for malware and exploit testing.

Run full security scans on the codebase using Ruflo security tools.

AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.