Claude Security Skills

Claude security skills turn a one-off audit into a recurring check: finding secrets that reached the repository, reviewing dependencies with known vulnerabilities, and catching routine mistakes such as unvalidated user input or permissions granted more broadly than needed. The same set of checks meets every change instead of only the pre-release review.

The most common finding is not an exotic vulnerability but a forgotten key in commit history or an over-broad permission. Simple rules catch those, yet no person runs them on every pull request. A skill does.

An important limit: the output is a list of candidates, not a verdict. The model flags suspicious places and explains the risk, but the decision belongs to someone who knows the system's context. Automatically "fixing" security from that output is a bad idea.

The collection below covers code audits, secret handling and dependency checks. Tools of this class are for systems you own or have written permission to test.

Skills in this collection

• Защита кода от уязвимостей по OWASP и STRIDE — security-and-hardening is a Claude Code skill that hardens web applications against vulnerabilities at every stage of development, from design through deployment. It mandates a threat-modeling step before any hardening work: map trust boundaries, name valuable assets, then run STRIDE analysis across each boundary to select targeted mitigations rather than guessing. The skill covers the full OWASP Top 10 prevention surface — parameterized queries against SQL injection, DOMPurify and framework auto-escaping against XSS, bcrypt/scrypt/argon2 password hashing, httpOnly/secure/sameSite cookies, CSP and HSTS headers, and resource-level authorization checks. Hard rules are explicit: never commit secrets, never log tokens, never trust client-side validation as a security boundary. A separate category of operations — new auth flows, PII storage, CORS changes — requires human approval before implementation. Ideal for teams building features that handle user input, session management, third-party integrations, or compliance with GDPR and CCPA.
• secrets-management — secrets-management is a Claude Code skill that implements secure secrets management in CI/CD pipelines, eliminating the need to hardcode sensitive credentials. It covers HashiCorp Vault with kv-v2 engine, dynamic secret generation, and audit logging; AWS Secrets Manager with automatic rotation, RDS integration, and Terraform support; plus Azure Key Vault and Google Secret Manager. Practical examples include importing Vault secrets via hashicorp/vault-action in GitHub Actions and GitLab CI, retrieving AWS secrets with log masking, and working with platform-native environment variables and protected/masked GitLab CI variables. Automated secret rotation via AWS Lambda, least-privilege access patterns, and secret scanning with GitGuardian and TruffleHog are also covered — making this skill essential for teams securing credentials across deployment environments.
• Настройка mTLS для взаимной аутентификации сервисов — mtls-configuration is a Claude Code skill that guides you through setting up mutual TLS (mTLS) for zero-trust service-to-service communication. It covers the full lifecycle: building a certificate hierarchy from Root CA through Intermediate CA down to per-workload certificates, configuring sidecar proxies in a service mesh, rotating short-lived certs, and debugging TLS handshake failures. Detailed templates and worked examples are stored in `references/details.md`. The skill is intended for teams implementing zero-trust networking, meeting PCI-DSS or HIPAA compliance requirements, securing internal microservice traffic, or establishing encrypted channels across multiple clusters.
• Безопасность смарт-контрактов на Solidity — solidity-security is a Claude Code skill that helps write secure Solidity smart contracts, audit existing code for vulnerabilities, and prepare contracts for professional security reviews. It covers protection against reentrancy attacks using the Checks-Effects-Interactions pattern, integer overflow prevention, proper access control with Ownable and ReentrancyGuard, and gas optimization that doesn't compromise security. Detailed pattern documentation is stored in `references/details.md`. Included Hardhat and Chai test examples show how to verify reentrancy guards, overflow handling, and unauthorized-call prevention in practice. The skill suits DeFi protocol developers and blockchain engineers who need a structured, audit-ready approach to smart contract security.
• Аутентификация и авторизация: JWT, OAuth2, RBAC — auth-implementation-patterns is a Claude Code skill that guides implementation of authentication and authorization patterns — JWT, OAuth2, session management, and RBAC — to build secure, scalable access control systems. It covers the distinction between AuthN and AuthZ, session-based and token-based approaches, and OAuth2/OpenID Connect for social login (Google, GitHub) and enterprise SSO, including multi-tenancy scenarios. Practical guidance addresses securing REST and GraphQL APIs, migrating existing auth systems, and debugging security issues. Built-in best practices enforce password hashing with bcrypt/argon2, short-lived access tokens (15–30 minutes), httpOnly cookies with secure and sameSite flags, rate limiting on auth endpoints, and mandatory server-side validation. Detailed pattern documentation and worked examples are stored in `references/details.md`. The skill is aimed at developers building login systems, protecting APIs, or rolling out enterprise single sign-on.
• Реверс-инжиниринг Go-малвари в Ghidra — analyzing-golang-malware-with-ghidra is a Claude Code skill that reverse-engineers Go-compiled malware inside Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped or garble-obfuscated function names via GoResolver (Volexity, 2025), and extracting embedded module paths, third-party dependency strings, and type information from the binary. Go malware poses a unique challenge: static linking produces self-contained binaries of 5–15 MB with thousands of functions, non-null-terminated strings, and goroutine concurrency patterns that confuse standard Ghidra analysis. The skill suits SOC analysts and threat hunters who need to deobfuscate a garble-packed sample, identify C2 frameworks or encryption libraries from embedded dependency metadata, or build detection rules mapped to MITRE ATT&CK techniques T1027, T1140, and T1620.
• Обнаружение утечки данных через DNS — analyzing-dns-logs-for-exfiltration is a Claude Code skill that examines DNS query logs to uncover data exfiltration via DNS tunneling, covert C2 channels, and DGA-generated domains. It provides ready-to-run Splunk SPL queries covering subdomain length analysis, vowel and digit ratio heuristics, Z-score-based volume anomaly detection, and TXT record abuse identification, alongside a Python implementation of Shannon entropy scoring with a threshold of 3.5 for flagging likely tunneling or DGA traffic. Designed for SOC teams investigating DNS-based threats that bypass traditional firewall and proxy controls, the skill maps to MITRE ATT&CK techniques T1048.003, T1071.004, and T1567, and aligns with NIST CSF functions DE.CM-01 and DE.AE-02.
• Анализ heap spray атак в дампах памяти — analyzing-heap-spray-exploitation is a Claude Code skill that detects and analyzes heap spray attacks in memory dumps using Volatility3 plugins. It follows four structured steps: scanning processes with windows.malfind for executable injected memory regions, examining VAD tree entries via windows.vadinfo for large contiguous allocations with RWX permissions, searching suspicious regions for NOP sled patterns (0x90 sequences and 0x0c0c0c0c), and dumping memory to extract embedded shellcode for byte-pattern analysis. Output is a JSON report covering suspicious processes, heap spray indicators, NOP sled locations, memory region sizes, and extracted shellcode hashes. The skill targets SOC analysts, malware researchers, and threat hunters who need a repeatable memory forensics procedure when investigating exploitation attempts linked to MITRE ATT&CK techniques T1203, T1059.007, and T1106.
• Криминалистический анализ дисковых образов с Autopsy — analyzing-disk-image-with-autopsy is a Claude Code skill that performs comprehensive forensic analysis of raw (dd), E01 (EnCase), and AFF disk images using Autopsy 4.x and The Sleuth Kit. It walks through the full investigation workflow: creating an Autopsy case, enabling ingest modules such as Recent Activity, Hash Lookup, Keyword Search, Exif Parser, and Encryption Detection, recovering deleted files with fls, icat, and tsk_recover, running regex searches for PII like credit card numbers and SSNs, and building investigation timelines with visual reports. The skill is designed for digital forensics examiners who need structured evidence analysis across multiple disk images or must present findings to non-technical stakeholders.
• Обнаружение аномального доступа к облачным хранилищам — analyzing-cloud-storage-access-patterns is a Claude Code skill that detects abnormal access patterns in AWS S3, Google Cloud Storage, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. It builds statistical baselines covering hourly request volumes, per-user object counts, and source IP history, then flags deviations: bulk downloads exceeding 100 GetObject calls from a single principal within one hour, after-hours access outside 8 AM–6 PM, source IPs unseen in the prior 30 days, and ListBucket enumeration spikes as reconnaissance indicators. Running `python scripts/agent.py` with a bucket name and lookback window produces a prioritized JSON findings report. The skill is aimed at SOC analysts investigating suspected cloud data exfiltration or building detection rules aligned with MITRE ATT&CK techniques T1530 and T1619.
• Извлечение секретов через Windows DPAPI — abusing-dpapi-for-credential-access is a Claude Code skill that guides authorized red-team operators through extracting and decrypting Windows DPAPI-protected secrets, including Credential Manager entries, browser saved logins and cookies (Chrome/Edge via SharpChrome), KeePass keys, Wi-Fi credentials, and certificate private keys. Three decryption paths are covered: online decryption in the target user's context using CryptUnprotectData, offline decryption with a plaintext password or NTLM hash, and estate-wide decryption via the domain DPAPI backup key obtained from a Domain Admin account. The skill maps to MITRE ATT&CK T1555.004 and T1555.003, provides ready-to-run SharpDPAPI, Mimikatz, and Impacket dpapi.py commands, and includes build instructions for GhostPack tooling. It is intended strictly for post-exploitation phases of authorized penetration tests and purple-team exercises with explicit written rules of engagement.
• Статический анализ вредоносных APK-файлов — analyzing-android-malware-with-apktool is a Claude Code skill that performs static triage of malicious Android APK files without executing them, combining apktool for resource decompilation, jadx for Java source recovery, and androguard for programmatic manifest inspection. It enumerates requested permissions and flags dangerous combinations, lists activities, services, broadcast receivers, and content providers, and identifies obfuscated code, dynamic class loading (DexClassLoader, Runtime.exec), and reflection-based API calls. Hardcoded URLs, IP addresses, and C2 indicators are extracted from strings. The skill outputs a JSON report with a risk score, MITRE ATT&CK Mobile mappings, and a list of IOCs — making it practical for SOC analysts triaging suspicious APKs or building mobile malware detection rules.
• Анализ вредоносных URL через URLScan.io — analyzing-malicious-url-with-urlscan is a Claude Code skill that leverages URLScan.io to safely investigate suspicious URLs, phishing pages, and malicious redirects without exposing the analyst's system to risk. It covers both the URLScan.io web interface and API: submitting URLs for scanning, capturing page screenshots, analyzing post-JavaScript DOM content, HAR-format HTTP network logs, SSL/TLS certificate details, and infrastructure intelligence — all rendered inside an isolated Chromium instance. The included `scripts/process.py` automates IOC extraction and cross-references findings with VirusTotal, PhishTank, and Google Safe Browsing. Designed for SOC analysts and incident responders who need structured workflows for investigating phishing campaigns, credential harvesting pages, and social engineering threats.
• Анализ злоупотреблений ACL в Active Directory — analyzing-active-directory-acl-abuse is a Claude Code skill that detects dangerous ACL misconfigurations in Active Directory using the ldap3 Python library. It connects to a Domain Controller via LDAP (port 389) or LDAPS (port 636), retrieves the nTSecurityDescriptor attribute for domain objects, parses the binary security descriptor into SDDL format, and identifies ACEs granting non-privileged principals permissions such as GenericAll, WriteDACL, WriteOwner, and GenericWrite on sensitive targets like Domain Admins groups, domain controllers, or GPOs. Each finding includes a mapped attack chain — for example, GenericAll on a group enables arbitrary membership changes — and the skill outputs a structured JSON report listing affected objects, trustees, access masks, and remediation steps. Security engineers use it for incident investigations, threat hunting, and validating detection coverage against privilege-escalation techniques similar to those surfaced by BloodHound.
• Анализ конфигурации Cobalt Strike Beacon — analyzing-cobalt-strike-beacon-configuration is a Claude Code skill that extracts and analyzes Cobalt Strike Beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable C2 profiles, and operator tradecraft. Beacon configs are stored as TLV-encoded blobs in the PE .data section, XOR-encrypted with a single byte (0x69 for version 3, 0x2e for version 4); the skill parses them using dissect.cobaltstrike alongside pefile and yara-python. Key fields surfaced include C2 domains, HTTP verbs, User-Agent strings, sleep and jitter timings, named pipes, spawn-to processes, and the 4-byte license watermark that can link separate beacons to the same operator or leaked license key. Designed for incident responders and SOC analysts, it accelerates campaign attribution, detection rule development, and security monitoring validation against MITRE ATT&CK techniques T1071.001, T1573.001, T1090.004, and T1105.
• Анализ логов Azure Monitor для поиска угроз — analyzing-azure-activity-logs-for-threats is a Claude Code skill that queries Azure Monitor activity logs and sign-in logs via the azure-monitor-query library to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. It builds KQL queries against Azure Log Analytics workspaces and covers five core detection scenarios: role assignment changes, resource group and subscription modifications, Key Vault secret access from new IPs, Network Security Group rule changes, and conditional access policy modifications. SOC analysts can use it both for investigating active incidents in an Azure tenant and for building cloud SIEM detection rules. The skill requires Python 3.8+, a configured Log Analytics Workspace ID, and appropriate Azure permissions.
• Анализ логов API Gateway на угрозы безопасности — analyzing-api-gateway-access-logs is a Claude Code skill that parses API Gateway access logs from AWS API Gateway, Kong, and Nginx to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. It applies pandas for statistical pattern analysis — for instance, grouping by user_id and endpoint to flag resource ID enumeration exceeding 50 unique values, or spotting 401 surges from a single source IP that indicate credential scanning. The skill also catches unusual HTTP methods like DELETE or PATCH on read-only endpoints and flags excessive data exposure patterns. It is intended for SOC analysts investigating API abuse and for engineers building API-specific threat detection rules; requires Python 3.8+ and JSON-formatted log files.
• Анализ буткитов и руткитов уровня прошивки — analyzing-bootkit-and-rootkit-samples is a Claude Code skill that analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to achieve persistence below the operating system level. The workflow covers disk acquisition with dd and FTK Imager, 16-bit MBR disassembly via ndisasm, UEFI firmware volume inspection with UEFITool and chipsec, YARA-based detection of known implants such as LoJax, BlackLotus, CosmicStrand, and MoonBounce, plus Volatility 3 memory forensics for uncovering DKOM-hidden processes and SSDT hooks. It is intended for cases where compromise survives OS reinstallation, antivirus and EDR fail despite clear infection signs, or an investigation targets nation-state threats like APT28 or the Equation Group. Standard user-mode malware analysis is outside its scope.
• Анализ уязвимостей Solidity смарт-контрактов — analyzing-ethereum-smart-contract-vulnerabilities is a Claude Code skill that performs static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control flaws, and other vulnerability classes before deployment to Ethereum mainnet. Slither leverages an intermediate representation with 90+ built-in detectors for fast pattern-based checks, while Mythril applies symbolic execution and SMT solving to uncover complex execution-path vulnerabilities. The skill covers running both tools, correlating and deduplicating findings, triaging results by exploitability and financial impact, and generating a structured audit report with SWC identifiers, severity ratings, affected functions, and remediation guidance. It is aimed at DeFi protocol auditors, SOC analysts building detection procedures, and developers who need to eliminate smart contract risks before funds are at stake.
• Мониторинг Certificate Transparency для защиты от фишинга — analyzing-certificate-transparency-for-phishing is a Claude Code skill that monitors Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized SSL/TLS certificate issuance targeting your organization. The skill covers querying crt.sh via its JSON API and PostgreSQL database with wildcard searches, real-time stream monitoring through Certstream, building automated alerts for suspicious certificates, and integrating findings into threat intelligence workflows. It requires Python 3.9+ with the requests, certstream, tldextract, and Levenshtein libraries, plus a list of organization domains and brand keywords to watch. Designed for SOC analysts and threat hunters, it exploits a key window: attacker certificates appear in CT logs before a phishing campaign launches, enabling proactive blocking of lookalike domains registered through free CAs like Let's Encrypt.
• Анализ техник обхода песочниц в малвари — analyzing-malware-sandbox-evasion-techniques is a Claude Code skill that detects sandbox and VM evasion techniques in malware samples by parsing behavioral reports from Cuckoo Sandbox and AnyRun. It processes JSON report exports, extracts API call sequences, and identifies four evasion categories: timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, processes such as vmtoolsd.exe), user interaction checks (GetCursorPos, GetAsyncKeyState), and environment fingerprinting (disk size, CPU count, RAM). Output is a structured JSON report with detected techniques, API-level evidence, an evasion sophistication score, and mappings to MITRE ATT&CK T1497 sub-techniques. SOC analysts and malware researchers use it when a sample shows little sandbox activity or when building detection rules for anti-analysis behaviors.
• Форензика Linux — анализ следов компрометации — analyzing-linux-system-artifacts is a Claude Code skill that examines Linux system artifacts — authentication logs, cron and systemd persistence mechanisms, shell history, SSH keys, and system configuration — to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user and attacker activity. The workflow covers mounting a forensic image read-only, collecting artifacts from /var/log/, /etc/, and home directories, analyzing user accounts and password hashes, and auditing persistence vectors including cron jobs, systemd units, and SSH authorized_keys. It leverages tools such as chkrootkit, rkhunter, AIDE, and auditd, and maps findings to MITRE ATT&CK techniques T1070, T1059.004, T1543.002, and T1053.003. Built for incident responders and digital forensics analysts investigating compromised Linux servers or workstations.
• Криминалистический анализ браузеров с Hindsight — analyzing-browser-forensics-with-hindsight is a Claude Code skill that parses Chromium-based browser profiles — Chrome, Edge, Brave, Opera, and Vivaldi — using Hindsight to produce a unified chronological timeline of web activity. It extracts URLs, download history, cookies, cached content, autofill records, saved passwords, extensions, Local Storage, and session data, with output in XLSX, JSON, or SQLite formats. The skill covers profile paths across Windows, macOS, and Linux, and includes Hindsight CLI usage with flags such as `--format jsonl` and `--cache` for more complete artifact recovery. It is intended for incident responders, insider-threat investigators, and digital forensics analysts who need to reconstruct a suspect's browser activity from a forensic image or copied profile directory.
• Анализ заголовков email для расследования фишинга — analyzing-email-headers-for-phishing-investigation is a Claude Code skill that parses and analyzes email headers to trace the true origin of phishing messages and detect sender spoofing. It processes the Received chain, Return-Path, and Message-ID fields, then validates SPF, DKIM, and DMARC results to confirm or rule out domain forgery. The workflow covers extracting raw headers from EML and PST files using Python email libraries and pypff, running DNS lookups with dig for SPF and DMARC records, and performing programmatic SPF checks via pyspf against the sending IP. Designed for SOC analysts and incident responders who need to triage reported emails, map the relay delivery path, or determine whether a user interacted with a spoofed message during an active phishing investigation.

FAQ

Does this replace a real security audit?

No. Skills cover the recurring layer: routine mistakes, forgotten secrets, outdated dependencies. A real audit includes threat modeling, architecture review, and a specialist looking for what is not on any known-pattern list.

Is it safe to give a model access to code for this?

That is a trust decision, not a technical one. For sensitive repositories the practical route is a local model or an isolated environment with no network egress. Check separately whether the secrets themselves end up in the model's context: scanning for leaks by shipping the leaked keys outward is a poor trade.

All Claude Code skills