#1Gold · 金
api-security-testing
★ Editor's Choice· 编辑首选API安全测试的专业技能和方法论
“
API安全测试的专业技能和方法论
Claude CodeCodexMedium risk · 中风险$
Category ranking· 品类排行
The best AI skills for security & compliance做安全与合规最好用的
Scan vulnerabilities, audit dependencies and permissions before anything ships.扫漏洞、查依赖、审权限：让代码和 AI Agent 上线前过一遍安全关。
Task shortcuts按用途继续找
Open the matching picks in the full catalog.这些入口会带你去完整目录里看对应用途。
Editor's picks编辑精选榜单
#2Silver · 银
aig-scanner
★ Runner-up· 次选A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via
“
A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via Tencent Zhuque Lab AI-Infra-Guard. Uses built-in exec + Python script, no plugin required. Requires AIGBASEURL to be configured. Triggers on: scan AI service, AI vulnerability scan, scan AI infra, check CVE, audit AI service, scan MCP, scan skills, audit AI tools, scan agent, red-team LLM, jailbreak test, 扫描AI服务, 检查AI漏洞, 扫描AI工具, 检查MCP安全, 审计Agent, 越狱测试.
Claude CodeCodexMedium risk · 中风险$
#3Bronze · 铜
wooyun-legacy
★ Pair with #1· 推荐配套WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati
“
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".
Claude CodeCodexLow risk · 低风险$
#4
threat detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers…
“
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
Claude CodeMedium risk · 中风险$
#5
senior secops
../../../engineering-team/skills/senior-secops/SKILL.md
“
../../../engineering-team/skills/senior-secops/SKILL.md
Claude CodeMedium risk · 中风险$
#6
senior secops
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure de…
“
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding…
Claude CodeMedium risk · 中风险$
#7
isms audit expert
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control asse…
“
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconfor…
Claude CodeMedium risk · 中风险$
#8
incident response
Use when a security incident has been detected or declared and needs classification, triage, escalation path determinat…
“
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.
Claude CodeMedium risk · 中风险$
#9
gdpr dsgvo expert
GDPR and German DSGVO compliance automation. Scans codebases for privacy risks, generates DPIA documentation, tracks da…
“
GDPR and German DSGVO compliance automation. Scans codebases for privacy risks, generates DPIA documentation, tracks data subject rights requests. Use for GDPR compliance assessments, privacy audits, data protection planning, DPIA generation, and data subject rights management.
Claude CodeMedium risk · 中风险$
#10
ciso advisor
Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIP…
“
Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIPAA/GDPR), security architecture strategy, incident response leadership, and board-level security reporting. Use when building security programs, justifying secu…
Claude CodeMedium risk · 中风险$
Why we didn't pick these为什么没选这些
Also common, but didn't make the picks同样常见，但未入精选- soc2 compliance
Workflows that require stronger human review than this catalog entry documents.
需要比当前目录条目更严格人工复核的工作流。
- threat detection
Workflows that require stronger human review than this catalog entry documents.
需要比当前目录条目更严格人工复核的工作流。
- soc2 compliance
Workflows that require stronger human review than this catalog entry documents.
需要比当前目录条目更严格人工复核的工作流。
Didn't find what you need?没看到合适的 skill？
Tell us your pain points and we'll go look.把你的痛点告诉我们，我们会去找。