—skills · counting…
30,375MCP servers
Protect your applications before deployment. Integrate static analysis, secret scanning, and automated security audit skills directly into your agentic coding sessions.
Sentry's systematic security code review for injection, XSS, authentication, authorization and cryptography issues, with confidence levels that keep false positives out of the report.
npx skills add getsentry/skills --skill security-reviewTrail of Bits' Semgrep workflow: detects your languages, selects rulesets, asks for approval, then runs the scans and merges the results into SARIF — with cross-file taint analysis when Semgrep Pro is available.
npx skills add trailofbits/skills --skill semgrepConfigures GitHub secret scanning and push protection, defines custom patterns, triages alerts and lets your agent check code for secrets before it commits.
npx skills add github/awesome-copilot --skill secret-scanningAudits every dependency in your lockfile for known advisories, abandoned or archived upstreams, publisher concentration and install-time scripts before they reach production.
npx skills add trailofbits/skills --skill supply-chain-risk-auditorEvery card above has its own npx skills add command and a copy button. Installing only requires Node.js; a few skills need an extra tool or API key, noted in their description.
The CLI asks which agents to install for — Claude Code, Cursor and other supported agents — and adds the skill to your project. Add -g to install it for your user account across every project.
Start a new agent session and ask in plain words. The agent loads the skill when your request matches its description. Read the SKILL.md on GitHub before installing anything on a system that matters.
They are strong at spotting common issues — injection, XSS, broken access control, hard-coded secrets — and at explaining them, especially when a skill pairs the agent's reasoning with deterministic tools like Semgrep. They can still miss business-logic flaws or raise false positives, so treat findings as leads to confirm and keep human review on critical code.
The skills run inside your own agent session. Scanners such as Semgrep run locally on your machine, and the Trail of Bits workflow disables Semgrep's metrics. The code your agent reads is processed by the AI service behind that agent, as in any coding session — check its data policy before scanning sensitive repositories.
No. Use them while you code to catch problems early, and keep automated gates in CI: secret scanning with push protection, dependency audits and static analysis on every pull request. secret-scanning helps you configure push protection, and supply-chain-risk-auditor reviews a dependency tree before you adopt it.
Code review, conventional commits, test-driven development and safe refactoring.
Explore Coding skillsTechnical SEO audits, crawls, structured data and Core Web Vitals fixes.
Explore SEO skillsScrape pages to Markdown, crawl whole sections and drive real browsers.
Explore Scraping skillsDockerfiles, Kubernetes manifests, CI/CD workflows and Terraform.
Explore DevOps skillsBuild, generate and call Model Context Protocol servers and MCP Apps.
Explore MCP skillsThe open skills directory for Claude Code & AI agents
© 2026 findaskill