cloudflare / security-audit-skill

A coding-agent skill that runs multi-phase security audits with isolated agents and independently verified, machine-readable findings.

affaan-m / ECC

Agent harness system of skills, agents, hooks, rules, memory, and security scanning for Claude Code, Codex, Cursor, and other AI coding tools.

T-Auto / dsh-ops

A toolkit for low-level operations in DSH, designed to reduce token usage and task execution time / DSH 底层操作工具插件，旨在减少 Token 消耗与任务耗时

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

3641397194-wq / gpt6-Astra

gpt6 Astra-claude-grok4.7-deepseekv4.1flash-glm5.3-gemini破甲越狱 · 冷咖啡 BREAK//OPEN 工作台

Nyankomintsu / world-execute-me-lyric-mv

world.execute(me); — an unofficial fan-made lyric MV told as a chat with Claude, rendered frame by frame from code. Prompts included; no music or lyrics. 非官方同人歌詞 MV:以程式碼逐幀渲染,附完整提示詞,不含歌曲與歌詞。

better-isms / grcskills

Open GRC skills for AI agents. By ISMS Copilot.

levantolabs / sagecut-release

House-standard QA for Remotion videos in your brand. Every frame is measured and read by the Sage decision model.

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

sandeco / reversa

Transform legacy systems into executable specifications for AI coding agents

Piebald-AI / claude-code-system-prompts

All parts of Claude Code's system prompt, 27 builtin tool descriptions, sub agent prompts (Plan/Explore/Task), utility prompts (CLAUDE.md, compact, statusline, magic docs, WebFetch, Bash cmd, security review, agent creation). Updated for each Claude Code version.

YeJe-cpu / SeeCut

An AI editor that watches its own cut: talking-head / AI-avatar video → auto-edited short video. 网感口播精剪：数字人/真人口播 → AI 自动精剪成网感动效短视频 → 可选剪映分层草稿

MarSeventh / CloudFlare-ImgBed

🏖️ A serverless, open-source file hosting solution built on Cloudflare. Supports image hosting, secure file storage, and personal cloud drive capabilities.

m0bilesecurity / RMS-Runtime-Mobile-Security

Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

jason5ng32 / MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

xixu-me / xget

Ultra-high-performance, secure, all-in-one acceleration engine for developer resources

Kritt-ai / open-kritt

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

GanyuanRan / Autoloom

AI coding with Aegis governance built into execution: baseline-aware changes, evidence-backed delivery. Free desktop client, your choice of model. 将哲科思维融入 AI 开发执行，让变更有依据、交付有证据。用创意编织现实。

Nehanth / pooled

Peer-to-peer LLM inference in the browser: pool your devices to run big open models, for chat and coding agents.

Jueze-2019 / dsh-redteam-mode

DSH RedTeam 模式：把 DeepSeek Harness 变成红队作战指挥台——一个靶标名称拉起信息收集/漏洞检测/漏洞利用/内网渗透四个角色，资产与战果实时落入本地 SQLite 事实库（仅供已授权测试）

openspug / spug

Spug is a lightweight agent-free automatic operation and maintenance platform designed for small and medium-sized enterprises. It integrates host management, host batch execution, host online terminal, file management, application release and deployment, pipelines, online task planning, configuration center, monitoring, alarm and so on.

sindresorhus / execa

Process execution for humans

Ch0pin / medusa

Mobile Edge-Dynamic Unified Security Analysis

atlassian / atlassian-mcp-server

Official remote MCP server for Atlassian. Securely connect Jira, Confluence, Jira Service Management, Bitbucket, and Compass to Claude, ChatGPT, Cursor, VS Code, and other AI tools using OAuth 2.1 or API tokens.

ossf / wg-best-practices-os-developers

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

ronak-create / FableCut

Zero-dependency browser video editor that AI agents can drive — JSON timeline, MCP + REST, live-reloading UI

gitleaks / gitleaks-action

Protect your secrets using Gitleaks-Action

dslsdzc / rev-skills

122 个逆向工程 AI 技能：恶意软件分析 / 软件逆向 / 固件嵌入式 / 协议逆向 / 移动应用 / 脱壳反混淆 / 软件破解 / 漏洞挖掘 / 托管代码 / 取证情报 / CTF。

leepokai / jev-guard

Auto mode for every coding agent, built on Jev: risk-scores every tool call with session context (deny / ask / allow), flags prompt injection in results, checks skills and plugins. Claude Code, Codex, Copilot, Gemini, Cursor, pi, OpenCode, ACP.

Noob-stupid / dsh-plugin-gating-hub

DSH plugin - framework upgrade safety & plugin gating: contract pre-check, rollback point, auto-rollback on failure, evidence-based auto-disable; plus a multi-source plugin market. Unofficial. | DSH 插件：框架升级安全 + 插件门控——升级前契约预检、回滚点、失败自动回滚、有确证证据才自动禁用；另带多源插件市场。非官方社区项目。

huaweicloud / huaweicloud-devkit

Official Huawei Cloud plugin for AI agents — skills, MCP tools, safety guardrails, and cloud sandbox to help AI agents build, deploy, and operate on Huawei Cloud securely.

Elevate08 / qs-bitwarden-cli

Bitwarden on quickshell with keyboard navigation and a goal to capture every feature from the browser extension

capt-meelo / loupe

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, with no drivers or adb server.

GHJ20001017 / Full-Duplex-Model

🎤🤖A voice assistant that can converse freely and execute tasks！！

egdev6 / mobile-agent-orchestrator

Guided Pi skill for a secure persistent mobile AI-agent environment on macOS and Windows with WSL2.

jiangkoumo / ego-decision-layer

Pluggable decision layer for the ego lite browser: one System One (Jev) call per step replaces the per-step LLM turn, and the backend can be swapped for a local OpenAI-compatible model. Fail-closed execution guards. The measured one — raw bench data, 16 suites, changelog with corrections.

OWASP / CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

sampotts / plyr

Deprecated in favour of Video.js 10; security updates only. Simple HTML5, YouTube and Vimeo player.

ai / nanoid

A tiny (118 bytes), secure, URL-friendly, unique string ID generator for JavaScript

motdotla / dotenv

Loads environment variables from .env for nodejs projects.

amark / gun

An open source cybersecurity protocol for syncing decentralized graph data.

cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

upgundecha / howtheysre

A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)

WebGoat / WebGoat

WebGoat is a deliberately insecure application

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.

dotenvx / dotenvx

a secure dotenv—from the creator of `dotenv`

RetireJS / retire.js

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

patriksimek / vm2

Advanced vm/sandbox for Node.js

aquasecurity / cloudsploit

Cloud Security Posture Management (CSPM)

Minidoracat / mcp-feedback-enhanced

Enhanced MCP server for interactive user feedback and command execution in AI-assisted development, featuring dual interface support (Web UI and Desktop Application) with intelligent environment detection and cross-platform compatibility.

animir / node-rate-limiter-flexible

Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.

paralleldrive / cuid

Deprecated collision-resistant id spec. Insecure because it leaks timestamps. Use cuid2 instead.

2factorauth / twofactorauth

List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.

holepunchto / hypercore

Hypercore is a secure, distributed append-only log.

pwndoc / pwndoc

Pentest Report Generator

skills / secure-code-game

Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started for free in under 2 minutes, playing right from your browser.

TehShrike / deepmerge

A library for deep (recursive) merging of Javascript objects

video-react / video-react

Deprecated in favour of Video.js 10; security fixes only. A web video player built for the HTML5 world using React library.

msojocs / fiddler-everywhere-enhance

Fiddler Everywhere is a secure and modern web debugging proxy for macOS, Windows, and Linux.

Shuffle / Shuffle

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.