Claude Code Skills·Claude Skills·The open SKILL.md registry for Claude
ClaudSkills › Security › Web Security › Page 12

Web Security (Page 12 of 19)

1094 Claude Code skills in the Web Security sub-category of Security.

1,094 skills · updated 2026-08-26 · showing 661–720 of 1,094 by quality score

For the full experience including quality scoring and one-click install features for each skill — upgrade to Pro.

persona-security
Security-first decision framework for threat modeling, vulnerability assessment, and compliance review.
peter
Build a production-ready feature, app, or multi-task goal from a short description. Small changes run one enforced loop: spec and pass/fail bars first, implement, machine gates…
pexels-api-stock-photo-curator
Searches and downloads royalty-free images from Pexels API with smart filtering by orientation, color, and size.
pf-security-scan
Scan PatternFly React code for security anti-patterns — XSS via dangerouslySetInnerHTML, unsanitized user input in tooltips/labels, and insecure href patterns.
phoenix-sqlean
Maintaining packages/phoenix-sqlean, the vendored fork of nalgeon/sqlean.py published as arize-phoenix-sqlean.
PHP Security Patterns
Use when essential PHP security patterns including input validation, SQL injection prevention, XSS protection, CSRF tokens, password hashing, secure session management, and…
phy-cors-audit
CORS (Cross-Origin Resource Sharing) misconfiguration auditor. Probes any API endpoint with crafted Origin headers to detect the most dangerous CORS vulnerabilities — reflecting…
phy-deserialization-audit
Unsafe deserialization vulnerability scanner (OWASP A08:2021). Detects Python pickle/yaml/eval, Java ObjectInputStream/XStream/XMLDecoder, PHP unserialize, Ruby Marshal.load,…
phy-path-traversal-audit
Path traversal and Local File Inclusion (LFI) vulnerability scanner (OWASP A01:2021). Detects user-controlled paths passed to file system sinks in Python/Java/PHP/Node.js/Go/Ruby…
phy-security-headers
HTTP security header auditor that fetches response headers from any URL and grades them against OWASP, Mozilla Observatory, and Google standards.
phy-ssrf-audit
Server-Side Request Forgery (SSRF) vulnerability scanner (OWASP A10:2021). Detects URL-fetching sinks in Python/Java/Node.js/PHP/Go/Ruby that accept user-controlled URLs without…
pigeon
Inter-session pmail - send and receive messages between Claude Code sessions running in different project directories. Uses global SQLite database at ~/.claude/pmail.db.
sql-plan-audit
Run EXPLAIN QUERY PLAN against every query in a sqlc-style catalog and diff the plans against a baseline.
plan-input-validation
Audit every trust boundary for unvalidated input, injection, and forged-request gaps, then produce a phased hardening plan.
plan-security-audit
OWASP Top 10 security audit with Supabase-first methodology — RLS pass, bundle/secret scan, auth-path tracing, dependency CVEs. Plan only, no patches or destructive testing.
plang
Expert guidance for Plang programming language (plang.is). Use when the user asks about Plang syntax, wants to generate Plang code, needs help debugging Plang goals, wants to…
pmd-apex-rules
Runs PMD's built-in Apex security ruleset (`category/apex/security.xml`) against Salesforce Apex source to detect injection, privilege-escalation, cryptographic, and XSS…
pocketbase-open-source-realtime-backend-single-binary
PocketBase is an open-source Go backend that ships as a single portable executable. It includes an embedded SQLite database with realtime subscriptions, built-in file and user…
pocketbase-patterns
PocketBase — single-file backend with SQLite, realtime subscriptions, auth, file storage, custom JS extensions
pokchop-gang-security
Multi-agent SECURITY review and pentest of a focus area (feature, section, or whole platform) via external AI advisors Codex Cursor Claude OpenCode Kilo Gemini.
pop-assessment-security
Validates PopKit security posture using concrete vulnerability patterns, automated secret scanning, and OWASP-aligned checklists
portability
How to keep template code database-agnostic and hosting-agnostic. Use when defining schemas, writing raw SQL, creating server routes, or anything that could leak a SQLite-only,…
dartai-post-task-reviewer
Forked-context deep post-task reviewer — preloads verdict schema + OWASP security + deep code analysis + PM/docs accuracy + replan lens.
prevent-clickjacking
Use when building any web page that performs state-changing actions on click — login forms, payment buttons, delete confirmations, or settings toggles that could be exploited if…
principle-security
Security design principles — trust boundaries and input validation, authentication vs authorization, secrets handling, secure defaults and defense in depth, lightweight threat…
prisma-database-setup
Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, MongoDB, etc.).
prisma-expert
You are an expert in Prisma ORM with deep knowledge of schema design, migrations, query optimization, relations modeling, and database operations across PostgreSQL, MySQL, and…
prisma-next-queries
Write Prisma Next queries for Postgres, SQLite, or Mongo — pick a lane (Postgres/SQLite `db.orm.` + `db.sql.`; Mongo `db.orm.` + `db.query.from(...)` pipeline…
prisma-next-runtime
Wire the Prisma Next runtime — `db.ts` setup using `postgres(...)` from `@prisma-next/postgres/runtime`, `sqlite(...)` from `@prisma-next/sqlite/runtime`, or…
probe
OWASP ZAP/Burp Suite/Nuclei integration, penetration test planning, DAST execution, and vulnerability scanning.
project-state
Use when implementing project state detection, designing STATE.md/TASKS.md templates, or configuring SQLite state store and MCP state protocol
protect-spa-and-api
Protect a React/Next.js SPA with route guards and middleware, and protect an API with token-verification middleware (signature + iss + aud + exp).
pschool-tutor
pschool (個人プログラミングスクール) の Q&A 教師エージェント。ユーザーが pschool コース (Udemy 1 コース粒度の座学 + ハンズオン演習) を受講中に詰まったときに起動し、答えを絶対に教えずに 3 段階のヒント (Lv 1 Conceptual / Lv 2 Directional / Lv 3 Specific)…
tspoonbase
TspoonBase — a TypeScript backend-as-a-service with SQLite, auth, realtime, file storage, AI tools, vector search, and Admin UI.
Pynchy Development
Use when running pynchy locally — running the app, tests, linting, formatting, pre-commit hooks, or rebuilding the agent container.
python-security
Guideline for designing, implementing, and verifying secure Python applications following OWASP Top 10 best practices.
python-web-app-security-audit
Run defensive pre-release security tests for Python web applications. Use for FastAPI, Django, Flask, and ASGI services: the common interface between Python web apps and servers.
qa-form-validation
Consolidated form validation skill. Owns ALL validation testing: empty-submit, invalid-format, real-time/blur feedback, whitespace, oversize input (10K), maxlength enforcement,…
qa-security-scan
Security scanning templates and checklists for OWASP Top 10, authentication, authorization, data protection. Use when conducting security testing or vulnerability assessment.
quality-gates-parallel
Launch quality subagents in parallel using Claude Code 2.1+ native Task tool. Includes ralph-security for OWASP validation and ralph-frontend for WCAG checks.
quarkus-security
Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.
query_authoring_pg
Compose + run SQL against a Postgres-backed fork's app DB — psql mechanics, psql variables vs driver :params, SQLite→Postgres dialect traps, read-only diagnostics, paste-ready…
Query operational databases from MCP clients with DBHub
Use DBHub to expose guarded, token-efficient database inspection and SQL tools to MCP clients across Postgres, MySQL, SQL Server, MariaDB, and SQLite.
rails-ai:security
CRITICAL - Use when securing Rails applications - XSS, SQL injection, CSRF, file uploads, command injection prevention
rails-security-baseline
Security baseline for Ruby on Rails 8 apps — strong params (and their common bypass mistakes), CSRF for browser apps, CSRF for SPAs, Brakeman + bundler-audit + Dependabot, Rails…
rails-security-review
Performs security audits and vulnerability assessments on Ruby on Rails application code. Use when reviewing Rails code for security risks, assessing authentication or…
ralph-promax
Maximum paranoia security audit with 10,000 iterations (~2-5 days) using 8 expert personas. Use when user says 'ralph promax', 'maximum security audit', 'full paranoia audit',…
ralph-quick
Fast security spot-check with 10 iterations (~5-10 min). Use when user says 'quick security check', 'pre-deploy audit', 'ralph quick', 'fast security scan', 'spot check before…
ralph-security
Comprehensive security audit with 100 iterations (~30-60 min). Use when user says 'security audit', 'ralph security', 'weekly security check', 'audit this project', 'new project…
ralph-ultra
Deep-dive security audit with 1,000 iterations (~4-8 hours). Use when user says 'deep security audit', 'ralph ultra', 'compliance audit prep', 'thorough security review', 'before…
reactive-sqlite-ui
Build SQLite-backed reactive UI in `apps/desktop` using stable patterns for reads, selection, forms, writes, and loading states.
recettix
Recettix : compétence de recette et validation des livrables d'une application métier TypeScript. Couvre : Plan de Recette contractuel, critères d'acceptance Gherkin, jeux de…
rechtssicherheit
Prueft Android-Apps vor Release als technische Pruefhilfe (KEINE anwaltliche Beratung) auf Abmahn-, Datenschutz-, Impressums-, Nutzungsbedingungen-, Widerrufs-, Google-Play-…
recipe
Brainstorma receptidéer, föreslå kompletta recept på svenska och spara nya recept till SQLite-databasen.
recipe-sqlite-sqlc
Accès SQLite fortement typé en Go via la génération de code sqlc v1.31.1 et le pilote pure-Go modernc.org/sqlite v1.56.0 (sans cgo).
redirect-forge
Complete open redirect detection and exploitation methodology — parameter discovery, 30+ bypass techniques, OAuth token theft, SSRF chaining, CSP abuse, phishing escalation, and…
redteam-csrf-detail-pack
Domain routing and boundary guidance for authorized CSRF testing, including token bypasses, SameSite bypasses, and JSON CSRF.
redteam-injection-detail-pack
Detailed injection pack for SSRF, SQLi, XSS, SSTI, deserialization, XML, command, and expression injection paths.
redteam-sqli-detail-pack
Domain routing and boundary guidance for authorized SQL injection testing, including union-based, blind, error-based, stacked query, and second-order SQL injection variants.
redteam-xss-detail-pack
Domain routing and boundary guidance for authorized cross-site scripting testing, including reflected, stored, DOM-based, mXSS, and CSP bypass variants.
All Security skills →
More in SecurityRed Team (1,582) · Threat Hunting (754) · Identity Access (496) · Network Security (414) · Appsec Tools (381) · Forensics (295) · Malware Analysis (207) · Compliance (204) · Cloud Security (94) · Zero Trust (82) · Appsec Build (66) · Crypto Keymgmt (65) · Incident Response (20) · Ot Ics Security (9)

Categories

Use cases

Popular tags

Learn

Site