awesome-skills-security - Security testing toolkit for AI Agent: curated Sec

项目说明

Awesome Security Skills: Security Collection

![skills.sh]()

A curated collection of security testing resources packaged as agent skills, a on skills.sh

Repository: Eyadkelleh/awesome-skills-security · skills.sh: Eyadkelleh/awesome-skills-security

O

This repository contains a curated collection of security testing resources from SecLists packaged as Agent Skills for use with Claude Code, Cursor, Codex, and 60+ other supported agents. These skills provide instant access to essential wordlists, payloads, patterns, and web shells for authorized security testing, penetration testing, CTF competitions, and security research.

The goal of this project is to provide organized, immediately accessible security testing resources that integrate seamlessly with AI agent workflows for:

Quick Start

Install from skills.sh (Recommended)

The easiest way to get started is to install from the skills.sh directory using the open agent skills CLI:

Browse and discover this collection on skills.sh: skills.sh/Eyadkelleh/awesome-skills-security

Installation

After installing, the skills are a:

What You Get

Once installed, you'll ha to:

Troubleshooting

"No skills found"

"Skill not loading in agent"

Need help?

A Skills

All skills li skills/ and are disco by the skills.sh CLI. Each skill has a SKILL.md with name and description frontmatter.

| Skill ID | Description | Install command |
|:---------|:------------|:----------------|
| security-fuzzing | SQL, NoSQL, command injection, and LDAP fuzzing payloads | npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -y |
| security-passwords | Curated password wordlists for authorized credential testing | npx skills add Eyadkelleh/awesome-skills-security --skill security-passwords -y |
| security-patterns | API keys, credit cards, emails, and sensitive data patterns | npx skills add Eyadkelleh/awesome-skills-security --skill security-patterns -y |
| security-payloads | XSS, XXE, template injection, and file upload payloads | npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -y |
| security-usernames | Common username wordlists for enumeration | npx skills add Eyadkelleh/awesome-skills-security --skill security-usernames -y |
| security-webshells | Web shell samples for detection and defensi | npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -y |
| llm-testing | LLM bias, data leakage, alignment, and ad testing prompts | npx skills add Eyadkelleh/awesome-skills-security --skill llm-testing -y |

Fuzzing (security-fuzzing)

Passwords (security-passwords)

Pattern-Matching (security-patterns)

Payloads (security-payloads)

Usernames (security-usernames)

Web-Shells (security-webshells)

LLM Testing (llm-testing)

Requirements

Installation

Method 1: skills.sh CLI (Recommended)

Install skills into your agent using the skills.sh ecosystem:

Skills are installed to your agent's skills directory (e.g. .cursor/skills/ for Cursor, .claude/skills/ for Claude Code). Use -g for a global install a across all projects.

Method 2: Clone Repository

Clone and use directly:

Usage

Using Skills in Natural Language

Reference skills in your con with any supported agent:

Practical Usage Examples

Example 1: SQL Injection Testing

Example 2: Password Auditing

Example 3: Code Review for Secrets

Example 4: CTF Challenge

Example 5: LLM Security Testing

Direct File Access

If you cloned the repository, access wordlists directly:

Example Workflows

SQL Injection Testing (Authorized)

CTF Challenge

Bug Bounty Hunting

Project Structure

Features

Security & Ethics

Authorized Use Cases

Prohibited Use Cases

Responsible Usage Guidelines

1. Always obtain written authorization before conducting security tests
2. Stay within scope of authorized testing boundaries
3. Document all acti during security assessments
4. Report responsibly through proper disclosure channels
5. Respect rate limits and avoid denial-of-service conditions
6. Protect sensitive data discovered during testing
7. Follow applicable laws and regulations in your jurisdiction

Why This Project Exists

SecLists is an incredible resource containing over 6,000 files and 4.5GB of security testing data. However, its size and breadth can be o. This project:

Source & Attribution

All security testing resources in this repository are sourced from SecLists by Daniel Miessler and contributors.

This project is a curated, skill-packaged subset for agent skill integration. For the complete SecLists collection (4.5GB, 6,000+ files), visit the original repository.

Best Practices

When Using Password Lists

When Using Fuzzing Payloads

When Using Web Shells

Contributing

Contributions are welcome! If you'd like to:

Please open an issue or pull request.

How to Use This on skills.sh

This repository is published on the skills.sh open agent skills directory — the public registry for the Agent Skills ecosystem. Skills are discovered from the skills/ directory and appear on the skills.sh leaderboard as users install them.

Collection page: skills.sh/Eyadkelleh/awesome-skills-security

What is skills.sh?

skills.sh is the directory and CLI for reusable agent skills. A single install command works across Claude Code, Cursor, Codex, OpenCode, and dozens of other agents. No separate packaging or publish step is required — push valid SKILL.md files to a public GitHub repo and users can install immediately.

For Users

After installing, ask your agent to use a skill naturally:

Supported Agents

Install to any supported agent with the -a flag:

| Agent | Install example |
|:------|:----------------|
| Cursor | npx skills add Eyadkelleh/awesome-skills-security -a cursor -y |
| Claude Code | npx skills add Eyadkelleh/awesome-skills-security -a claude-code -y |
| Codex | npx skills add Eyadkelleh/awesome-skills-security -a codex -y |
| OpenCode | npx skills add Eyadkelleh/awesome-skills-security -a opencode -y |

See the full list of supported agents.

SKILL.md Requirements

Each skill directory must contain a SKILL.md with YAML frontmatter:

For Contributors

Want to add your own skills to this collection?

1. Fork this repository
2. Add your skill under skills/your-skill-name/
3. Create a SKILL.md with valid frontmatter (name must be lowercase with hyphens, plus description)
4. locally: npx skills add . --list
5. Submit a pull request with a description of your contribution

Publishing Your Own Skills

To create your own skill collection for skills.sh:

1. Create a repository with a skills/ directory
2. Add SKILL.md files in each skill directory with name and description frontmatter
3. Push to GitHub and make it public
4. discovery: npx skills add username/repo-name --list
5. Share your repo — users install with npx skills add username/repo-name

Related OSINT Tools

| Tool | Description |
|:-----|:------------|
| x-twitter-scraper | X/Twitter OSINT skill — user lookup, follower extraction, engagement analysis, account monitoring. MCP server, REST API, 20 extraction tools. |

Documentation and References

License

MIT License - Use responsibly with proper authorization.

This is a curated collection and redistribution of SecLists content. The original SecLists project is maintained by Daniel Miessler under the MIT License. All credit for the original content goes to the SecLists project and its contributors.

Disclaimer

This repository is provided for educational and authorized security testing purposes only. The maintainers of this repository are not responsible for any misuse or damage caused by the resources contained herein. Users are solely responsible for ensuring they ha authorization before conducting any security testing acti.

---

Note: This is a curated reference repository. Always you ha authorization before conducting security testing. When in doubt, ask for explicit written permission.

Awesome Security Skills | Security Collection for skills.sh

项目信息

开发语言：PHP

Star 数：386

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security testing toolkit for AI Agent: curated SecLists wordlists, injection payloads, and expert agents for authorized pentesting, CTFs, and bug bounties展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。