Security & Testing Agent Skills for Claude Code

Detects anomalous authentication patterns using UEBA analytics, statistical

Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP

Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE

This skill covers detecting cyber attacks targeting Supervisory Control

Detect unusual API call patterns in AWS CloudTrail logs using boto3,

Scan source code repositories, CI/CD pipelines, and configuration files

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining

Audit Azure Blob and ADLS storage accounts for public access exposure, weak

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization

Detect command-and-control (C2) traffic tunneled over DNS from tools like

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing

Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function()…

Detects defense evasion techniques used by adversaries in endpoint logs

Detect abuse of legitimate Windows binaries (LOLBins) used for living

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network…

Detects early-stage ransomware indicators in network traffic before

This skill enables Claude to detect SQL injection vulnerabilities in code.

Automates comprehensive web application testing including visual, accessibility, and E2E checks using Playwright CLI.

Prowler UI-specific patterns. For generic patterns, see: typescript, react-19, nextjs-16, tailwind-4. Trigger: When working inside ui/ on…