Claude Security Skills

Claude security skills turn a one-off audit into a recurring check: finding secrets that reached the repository, reviewing dependencies with known vulnerabilities, and catching routine mistakes such as unvalidated user input or permissions granted more broadly than needed. The same set of checks meets every change instead of only the pre-release review. The most common finding is not an exotic vulnerability but a forgotten key in commit history or an over-broad permission. Simple rules catch those, yet no person runs them on every pull request. A skill does. One caveat matters: a security skill replaces neither an audit nor human review. It clears the stream of repetitive findings so that a specialist sees the cases that genuinely need a decision rather than a mechanical comparison. A skill also keeps the check list explicit, so a new team member can read what is verified on every change instead of asking.

An important limit: the output is a list of candidates, not a verdict. The model flags suspicious places and explains the risk, but the decision belongs to someone who knows the system's context. Automatically "fixing" security from that output is a bad idea.

The collection below covers code audits, secret handling and dependency checks. Tools of this class are for systems you own or have written permission to test.

Skills in this collection

192 skills in this collection; the 24 highest-rated are listed below.

• Настройка mTLS для взаимной аутентификации сервисов — mtls-configuration is a Claude Code skill that guides you through setting up mutual TLS (mTLS) for zero-trust service-to-service communication. It covers the full lifecycle: building a certificate hierarchy from Root CA through Intermediate CA down to per-workload certificates, configuring sidecar proxies in a service mesh, rotating short-lived certs, and debugging TLS handshake failures. Detailed templates and worked examples are stored in `references/details.md`. The skill is intended for teams implementing zero-trust networking, meeting PCI-DSS or HIPAA compliance requirements, securing internal microservice traffic, or establishing encrypted channels across multiple clusters.
• Безопасность смарт-контрактов на Solidity — solidity-security is a Claude Code skill that helps write secure Solidity smart contracts, audit existing code for vulnerabilities, and prepare contracts for professional security reviews. It covers protection against reentrancy attacks using the Checks-Effects-Interactions pattern, integer overflow prevention, proper access control with Ownable and ReentrancyGuard, and gas optimization that doesn't compromise security. Detailed pattern documentation is stored in `references/details.md`. Included Hardhat and Chai test examples show how to verify reentrancy guards, overflow handling, and unauthorized-call prevention in practice. The skill suits DeFi protocol developers and blockchain engineers who need a structured, audit-ready approach to smart contract security.
• Управление секретами в конвейерах сборки — secrets-management is a Claude Code skill that implements secure secrets management in CI/CD pipelines, eliminating the need to hardcode sensitive credentials. It covers HashiCorp Vault with kv-v2 engine, dynamic secret generation, and audit logging; AWS Secrets Manager with automatic rotation, RDS integration, and Terraform support; plus Azure Key Vault and Google Secret Manager. Practical examples include importing Vault secrets via hashicorp/vault-action in GitHub Actions and GitLab CI, retrieving AWS secrets with log masking, and working with platform-native environment variables and protected/masked GitLab CI variables. Automated secret rotation via AWS Lambda, least-privilege access patterns, and secret scanning with GitGuardian and TruffleHog are also covered — making this skill essential for teams securing credentials across deployment environments.
• Аутентификация и авторизация: JWT, OAuth2, RBAC — auth-implementation-patterns is a Claude Code skill that guides implementation of authentication and authorization patterns — JWT, OAuth2, session management, and RBAC — to build secure, scalable access control systems. It covers the distinction between AuthN and AuthZ, session-based and token-based approaches, and OAuth2/OpenID Connect for social login (Google, GitHub) and enterprise SSO, including multi-tenancy scenarios. Practical guidance addresses securing REST and GraphQL APIs, migrating existing auth systems, and debugging security issues. Built-in best practices enforce password hashing with bcrypt/argon2, short-lived access tokens (15–30 minutes), httpOnly cookies with secure and sameSite flags, rate limiting on auth endpoints, and mandatory server-side validation. Detailed pattern documentation and worked examples are stored in `references/details.md`. The skill is aimed at developers building login systems, protecting APIs, or rolling out enterprise single sign-on.
• Анализ заголовков email для расследования фишинга — analyzing-email-headers-for-phishing-investigation is a Claude Code skill that parses and analyzes email headers to trace the true origin of phishing messages and detect sender spoofing. It processes the Received chain, Return-Path, and Message-ID fields, then validates SPF, DKIM, and DMARC results to confirm or rule out domain forgery. The workflow covers extracting raw headers from EML and PST files using Python email libraries and pypff, running DNS lookups with dig for SPF and DMARC records, and performing programmatic SPF checks via pyspf against the sending IP. Designed for SOC analysts and incident responders who need to triage reported emails, map the relay delivery path, or determine whether a user interacted with a spoofed message during an active phishing investigation.
• Анализ вторжений по Cyber Kill Chain — analyzing-cyber-kill-chain is a Claude Code skill that maps intrusion activity against the Lockheed Martin Cyber Kill Chain framework to determine which of the seven phases an adversary completed, where defenses succeeded or failed, and which controls would have interrupted the attack earlier. The workflow covers artifact-to-phase mapping (Reconnaissance through Actions on Objectives), a phase completion matrix with detection gaps, integration with MITRE ATT&CK Enterprise for technique-level detail (TA0001–TA0040), and six courses of action per phase: Detect, Deny, Disrupt, Degrade, Deceive, and Destroy. Output is a structured kill chain analysis report with an attack narrative, evidence-backed phase findings, and a cost-effectiveness-ranked control roadmap. Intended for SOC analysts and incident responders conducting post-incident reviews, building layered defenses, or communicating attack progression to non-technical stakeholders. Aligns with NIST CSF functions ID.RA-01, ID.RA-05, DE.CM-01, and DE.AE-02.
• Анализ семейств малвари через Malpedia — analyzing-malware-family-relationships-with-malpedia is a Claude Code skill that queries the Malpedia API to map malware family relationships, resolve aliases, extract YARA rules, and link families to threat actors. Maintained by Fraunhofer FKIE, Malpedia catalogs over 2,600 malware families using the platform.family_name convention (e.g., win.cobalt_strike, apk.flubot); the skill calls /list/families, /get/family, /get/yara, and /get/actor endpoints to retrieve alternate vendor names, community and vendor YARA rules, loader-payload chains, and actor attribution data. SOC analysts and CTI researchers can use it to trace a sample's lineage, source detection rules for threat hunting, or identify the full malware toolkit of a specific adversary group. The skill requires Python 3.9+ with requests, yara-python, and stix2, plus a Malpedia API key.
• Анализ Linux audit logs для обнаружения вторжений — analyzing-linux-audit-logs-for-intrusion is a Claude Code skill that uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity on individual Linux hosts. It covers audit rule configuration — including monitoring of /etc/passwd, /etc/shadow, SSH authorized keys, kernel module loading, and process execution from /tmp or /dev/shm — as well as log querying, attack timeline reconstruction, and integration with SIEM platforms. The skill activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection. It is well suited for forensic investigations, incident response, and compliance auditing against CIS, STIG, or PCI-DSS baselines that require syscall-level monitoring.
• Анализ конфигурации Cobalt Strike Beacon — analyzing-cobalt-strike-beacon-configuration is a Claude Code skill that extracts and analyzes Cobalt Strike Beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable C2 profiles, and operator tradecraft. Beacon configs are stored as TLV-encoded blobs in the PE .data section, XOR-encrypted with a single byte (0x69 for version 3, 0x2e for version 4); the skill parses them using dissect.cobaltstrike alongside pefile and yara-python. Key fields surfaced include C2 domains, HTTP verbs, User-Agent strings, sleep and jitter timings, named pipes, spawn-to processes, and the 4-byte license watermark that can link separate beacons to the same operator or leaked license key. Designed for incident responders and SOC analysts, it accelerates campaign attribution, detection rule development, and security monitoring validation against MITRE ATT&CK techniques T1071.001, T1573.001, T1090.004, and T1105.
• Анализ злоупотреблений ACL в Active Directory — analyzing-active-directory-acl-abuse is a Claude Code skill that detects dangerous ACL misconfigurations in Active Directory using the ldap3 Python library. It connects to a Domain Controller via LDAP (port 389) or LDAPS (port 636), retrieves the nTSecurityDescriptor attribute for domain objects, parses the binary security descriptor into SDDL format, and identifies ACEs granting non-privileged principals permissions such as GenericAll, WriteDACL, WriteOwner, and GenericWrite on sensitive targets like Domain Admins groups, domain controllers, or GPOs. Each finding includes a mapped attack chain — for example, GenericAll on a group enables arbitrary membership changes — and the skill outputs a structured JSON report listing affected objects, trustees, access masks, and remediation steps. Security engineers use it for incident investigations, threat hunting, and validating detection coverage against privilege-escalation techniques similar to those surfaced by BloodHound.
• Анализ вредоносных URL через URLScan.io — analyzing-malicious-url-with-urlscan is a Claude Code skill that leverages URLScan.io to safely investigate suspicious URLs, phishing pages, and malicious redirects without exposing the analyst's system to risk. It covers both the URLScan.io web interface and API: submitting URLs for scanning, capturing page screenshots, analyzing post-JavaScript DOM content, HAR-format HTTP network logs, SSL/TLS certificate details, and infrastructure intelligence — all rendered inside an isolated Chromium instance. The included `scripts/process.py` automates IOC extraction and cross-references findings with VirusTotal, PhishTank, and Google Safe Browsing. Designed for SOC analysts and incident responders who need structured workflows for investigating phishing campaigns, credential harvesting pages, and social engineering threats.
• Анализ MFT NTFS для восстановления удалённых файлов — analyzing-mft-for-deleted-file-recovery is a Claude Code skill that analyzes the NTFS Master File Table ($MFT) to recover metadata and content of deleted files using MFTECmd, analyzeMFT, and X-Ways Forensics. It examines 1024-byte MFT record attributes — $STANDARD_INFORMATION, $FILE_NAME, and $DATA — alongside $LogFile transactions, USN Journal ($UsnJrnl:$J) entries, and MFT slack space to surface evidence that survives after deletion. Supported disk image formats include E01, raw/dd, VMDK, and VHDX, with CSV output processed in Timeline Explorer or Excel. Designed for DFIR analysts and forensic examiners, the skill helps reconstruct Windows file-system timelines, recover deleted file evidence, and detect anti-forensic timestomping, mapping to MITRE ATT&CK techniques T1070.004, T1070.006, and T1005.
• Анализ буткитов и руткитов уровня прошивки — analyzing-bootkit-and-rootkit-samples is a Claude Code skill that analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to achieve persistence below the operating system level. The workflow covers disk acquisition with dd and FTK Imager, 16-bit MBR disassembly via ndisasm, UEFI firmware volume inspection with UEFITool and chipsec, YARA-based detection of known implants such as LoJax, BlackLotus, CosmicStrand, and MoonBounce, plus Volatility 3 memory forensics for uncovering DKOM-hidden processes and SSDT hooks. It is intended for cases where compromise survives OS reinstallation, antivirus and EDR fail despite clear infection signs, or an investigation targets nation-state threats like APT28 or the Equation Group. Standard user-mode malware analysis is outside its scope.
• Анализ аудит-логов Kubernetes для выявления угроз — analyzing-kubernetes-audit-logs is a Claude Code skill that parses Kubernetes API server audit logs in JSON lines format to surface security-relevant events across a cluster. It covers five threat categories: container exec sessions (pods/exec and pods/attach), secret enumeration via get/list/watch verbs, clusterrolebinding creation indicating RBAC privilege escalation, privileged pod creation, and anonymous or system:unauthenticated API access. Detected patterns are translated into threat detection rules suitable for k8s-specific SIEM queries. The skill targets SOC analysts and security engineers investigating cluster compromise or building proactive threat-hunting coverage — Python 3.8+ and access to audit log files are required.
• Анализ скрытых каналов связи вредоносного ПО — analyzing-network-covert-channels-in-malware is a Claude Code skill that detects and analyzes covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 communication and data exfiltration. The skill provides Python scripts built on scapy, dpkt, and dnslib that parse PCAP files, compute subdomain entropy, unique-query ratios, and average subdomain lengths, then score suspicious domains; ICMP payloads are examined separately for tunneling artifacts from tools like icmpsh and ptunnel. It is aimed at SOC analysts, threat hunters, and network forensics practitioners investigating anomalous traffic, hunting hidden C2 channels in packet captures, or attributing exfiltration to known toolsets such as iodine or dnscat2. The skill maps to MITRE ATT&CK techniques T1071.001, T1095, T1572, and T1001, and requires Python 3.9+ along with Wireshark/tshark and optionally Zeek.
• Анализ вредоносных ELF-файлов Linux — analyzing-linux-elf-malware is a Claude Code skill that analyzes malicious Linux ELF binaries — botnets (Mirai, Gafgyt, XorDDoS), cryptominers, ransomware, and rootkits targeting Linux servers, Docker containers, Kubernetes pods, and cloud infrastructure. The skill combines static inspection using readelf, objdump, nm, and the pyelftools Python library with dynamic tracing via strace, ltrace, and GDB, plus reverse engineering of x86_64, ARM, and MIPS samples in Ghidra or Radare2. It covers IOC extraction from embedded strings, section entropy analysis to detect packers like UPX, and identification of persistence mechanisms such as crontab, systemd, and ld.so.preload. Use it when triaging a suspicious ELF binary, investigating a compromised Linux server, or examining container-targeted malware.
• Анализ логов API Gateway на угрозы безопасности — analyzing-api-gateway-access-logs is a Claude Code skill that parses API Gateway access logs from AWS API Gateway, Kong, and Nginx to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. It applies pandas for statistical pattern analysis — for instance, grouping by user_id and endpoint to flag resource ID enumeration exceeding 50 unique values, or spotting 401 surges from a single source IP that indicate credential scanning. The skill also catches unusual HTTP methods like DELETE or PATCH on read-only endpoints and flags excessive data exposure patterns. It is intended for SOC analysts investigating API abuse and for engineers building API-specific threat detection rules; requires Python 3.8+ and JSON-formatted log files.
• Обнаружение утечки данных через DNS — analyzing-dns-logs-for-exfiltration is a Claude Code skill that examines DNS query logs to uncover data exfiltration via DNS tunneling, covert C2 channels, and DGA-generated domains. It provides ready-to-run Splunk SPL queries covering subdomain length analysis, vowel and digit ratio heuristics, Z-score-based volume anomaly detection, and TXT record abuse identification, alongside a Python implementation of Shannon entropy scoring with a threshold of 3.5 for flagging likely tunneling or DGA traffic. Designed for SOC teams investigating DNS-based threats that bypass traditional firewall and proxy controls, the skill maps to MITRE ATT&CK techniques T1048.003, T1071.004, and T1567, and aligns with NIST CSF functions DE.CM-01 and DE.AE-02.
• Cuckoo Sandbox — динамический анализ вредоносных программ — analyzing-malware-behavior-with-cuckoo-sandbox is a Claude Code skill that detonates malware samples in Cuckoo Sandbox to capture runtime behavior — process creation, file system and registry changes, network communications, and API calls — and produces structured behavioral reports for classification and IOC extraction. The skill covers the full workflow: submitting a file or URL via CLI or REST API with a configurable timeout and guest VM selection, parsing the JSON report to flag suspicious API calls such as CreateRemoteThread, WriteProcessMemory, and URLDownloadToFileA, reviewing DNS queries, HTTP requests, and TCP connections, and documenting dropped files with SHA-256 hashes alongside registry key modifications. It is intended for use after static triage when mapping a full infection chain, extracting indicators of compromise, or building YARA and behavioral signatures from sandbox activity. Designed for malware analysts and incident response teams running Cuckoo 3.x on a dedicated server with an isolated network and InetSim or FakeNet-NG for internet simulation.
• Форензик-анализ памяти Linux с LiME и Volatility — analyzing-memory-forensics-with-lime-and-volatility is a Claude Code skill that performs Linux memory acquisition using the LiME (Linux Memory Extractor) kernel module and forensic analysis with the Volatility 3 framework. The skill covers a complete forensic workflow: capturing a memory image via insmod in lime or raw format, then running vol3 plugins to extract process lists (linux.pslist, linux.psscan), bash command history, network connections (linux.sockstat), loaded kernel modules (linux.lsmod), and injected code artifacts (linux.malfind). It targets SOC analysts and incident responders investigating compromised Linux systems, hunting for rootkits, or reconstructing an attack from volatile memory. The skill maps to MITRE ATT&CK techniques T1055, T1003.001, T1620, and T1564.001.
• Анализ heap spray атак в дампах памяти — analyzing-heap-spray-exploitation is a Claude Code skill that detects and analyzes heap spray attacks in memory dumps using Volatility3 plugins. It follows four structured steps: scanning processes with windows.malfind for executable injected memory regions, examining VAD tree entries via windows.vadinfo for large contiguous allocations with RWX permissions, searching suspicious regions for NOP sled patterns (0x90 sequences and 0x0c0c0c0c), and dumping memory to extract embedded shellcode for byte-pattern analysis. Output is a JSON report covering suspicious processes, heap spray indicators, NOP sled locations, memory region sizes, and extracted shellcode hashes. The skill targets SOC analysts, malware researchers, and threat hunters who need a repeatable memory forensics procedure when investigating exploitation attempts linked to MITRE ATT&CK techniques T1203, T1059.007, and T1106.
• Анализ вредоносных макросов в Office-документах — analyzing-macro-malware-in-office-documents is a Claude Code skill that analyzes malicious VBA macros embedded in Microsoft Office documents — Word, Excel, and PowerPoint — to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. It uses olevba, oledump, and programmatic VBA deobfuscation to resolve Chr(), StrReverse(), Replace(), and string concatenation, reconstructing the full attack chain from a suspect file. The skill also covers Excel 4.0 (XLM) macro analysis via xlmdeobfuscator and detects DDE, embedded objects, and remote template injection as alternative attack vectors. It requires Python 3.8+ with oletools installed and an isolated analysis VM, making it the right fit for incident responders and threat intelligence analysts investigating maldoc-based phishing campaigns.
• Scapy — анализ сетевых пакетов и трафика — analyzing-network-packets-with-scapy is a Claude Code skill that leverages the Scapy Python library to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets for authorized network security testing and forensic analysis. It covers reading and parsing PCAP/PCAPng files via `rdpcap()`, extracting protocol layer fields, computing traffic statistics, implementing SYN scans, analyzing DNS queries for tunneling indicators, and detecting anomalous patterns such as fragmented packets, malformed headers, and SYN flood activity. Prerequisites include Python 3.8+, root or administrator privileges for raw socket operations, and Npcap (Windows) or libpcap (Linux). The skill outputs a structured JSON report with packet statistics, protocol distribution, top talkers, and per-flow anomaly summaries — making it practical for SOC analysts, network forensics engineers, and penetration testers who need deep protocol-level traffic inspection.
• Обнаружение Linux-руткитов в дампах памяти — analyzing-linux-kernel-rootkits is a Claude Code skill that detects kernel-level rootkits in Linux memory dumps using Volatility3 plugins and cross-view discrepancy analysis. It runs linux.check_syscall, linux.lsmod, linux.hidden_modules, and linux.check_idt to identify hooked syscalls, hidden LKMs, and tampered function pointers in physical memory acquired via LiME or AVML. Module lists from /proc/modules, lsmod, and /sys/module are compared to surface modules hidden from any single view, while rkhunter and chkrootkit scan for known rootkit signatures and SHA-256 mismatches in system binaries. The final JSON report covers syscall hooks, hidden processes, modified IDT entries, concealed network connections, and rkhunter findings. Designed for digital forensics analysts and SOC teams investigating ring-0 Linux compromises, it maps to MITRE ATT&CK T1014, T1547.006, and T1564.001.

FAQ

Does this replace a real security audit?

No. Skills cover the recurring layer: routine mistakes, forgotten secrets, outdated dependencies. A real audit includes threat modeling, architecture review, and a specialist looking for what is not on any known-pattern list.

Is it safe to give a model access to code for this?

That is a trust decision, not a technical one. For sensitive repositories the practical route is a local model or an isolated environment with no network egress. Check separately whether the secrets themselves end up in the model's context: scanning for leaks by shipping the leaked keys outward is a poor trade.

All Claude Code skills