florianbuetow/claude-code

1

ssrf This skill should be used when the user asks to "check for SSRF", "analyze server-side request forgery", "find URL fe…

florianbuetow/claude-code

58

2

spec-writer An expert-guided skill for creating layered software specification documents for greenfield projects. Produces five d…

florianbuetow/claude-code

34

3

sans25 This skill should be used when the user asks to "check CWE Top 25", "run SANS analysis", "check for common weaknesses…

florianbuetow/claude-code

31

4

solid-principles This skill should be used when the user asks to "check SOLID violations", "audit class design", "review code quality"…

florianbuetow/claude-code

23

5

file-upload This skill should be used when the user asks to "check file upload security", "analyze upload validation", "find uplo…

florianbuetow/claude-code

14

6

stride This skill should be used when the user asks to "run STRIDE analysis", "check STRIDE", "threat model with STRIDE", or…

florianbuetow/claude-code

14

7

beyond-solid-principles This skill should be used when the user asks to "check architecture principles", "audit system design", "review code …

florianbuetow/claude-code

13

8

business-logic This skill should be used when the user asks to "check business logic security", "find logic flaws", "audit workflow …

florianbuetow/claude-code

13

9

dos This skill should be used when the user asks to "check for denial of service", "analyze availability risks", "find Do…

florianbuetow/claude-code

13

10

pasta-risk This skill should be used when the user asks to "calculate risk scores", "prioritize mitigations", "generate remediat…

florianbuetow/claude-code

13

11

report This skill should be used when the user asks to "generate security report", "create appsec report", "export findings"…

florianbuetow/claude-code

13

12

access-control This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDO…

florianbuetow/claude-code

12

13

api This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", …

florianbuetow/claude-code

12

14

attack-surface This skill should be used when the user asks to "map attack surface", "list entry points", "inventory API endpoints",…

florianbuetow/claude-code

12

15

config This skill should be used when the user asks to "configure security", "appsec settings", "security preferences", or i…

florianbuetow/claude-code

12

16

data-disclosure This skill should be used when the user asks to "check for personal data disclosure", "analyze PII exposure", "find p…

florianbuetow/claude-code

12

17

info-disclosure This skill should be used when the user asks to "check for information disclosure", "analyze data leakage risks", "fi…

florianbuetow/claude-code

12

18

pasta This skill should be used when the user asks to "run PASTA analysis", "PASTA threat model", "risk-centric threat anal…

florianbuetow/claude-code

12

19

pasta-attack-sim This skill should be used when the user asks to "simulate attacks", "build attack trees", "model exploit chains", "sc…

florianbuetow/claude-code

12

20

auth This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential v…

florianbuetow/claude-code

11

21

crypto This skill should be used when the user asks to "check for cryptographic issues", "analyze encryption", "find weak ha…

florianbuetow/claude-code

11

22

detecting This skill should be used when the user asks to "check for detectability", "analyze timing side channels", "find priv…

florianbuetow/claude-code

11

23

explain-system-tradeoffs This skill should be used when the user asks to "explain system tradeoffs", "analyze architecture tradeoffs", "what t…

florianbuetow/claude-code

11

24

insecure-design This skill should be used when the user asks to "check for design flaws", "analyze security design", "find insecure d…

florianbuetow/claude-code

11

25

mitre This skill should be used when the user asks to "map to ATT&CK", "show attack techniques", "MITRE mapping", or wants …

florianbuetow/claude-code

11

26

non-compliance This skill should be used when the user asks to "check for non-compliance", "analyze GDPR compliance", "find CCPA vio…

florianbuetow/claude-code

11

27

pasta-decompose This skill should be used when the user asks to "decompose the application", "map trust boundaries", "identify compon…

florianbuetow/claude-code

11

28

pasta-objectives This skill should be used when the user asks to "define business objectives", "identify business-critical assets", "d…

florianbuetow/claude-code

11

29

pasta-vulns This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "r…

florianbuetow/claude-code

11

30

privilege-escalation This skill should be used when the user asks to "check for privilege escalation", "analyze authorization risks", "fin…

florianbuetow/claude-code

11

31

repudiation This skill should be used when the user asks to "check for repudiation", "analyze audit logging", "find logging gaps"…

florianbuetow/claude-code

11

32

secrets This skill should be used when the user asks to "check for secrets", "find hardcoded credentials", "scan for API keys…

florianbuetow/claude-code

11

33

spoofing This skill should be used when the user asks to "check for spoofing", "analyze identity spoofing risks", "find authen…

florianbuetow/claude-code

11

34

tampering This skill should be used when the user asks to "check for tampering", "analyze data integrity risks", "find injectio…

florianbuetow/claude-code

11

35

verify This skill should be used when the user asks to "verify fix", "confirm fix", "check if vulnerability is fixed", "vali…

florianbuetow/claude-code

11

36

explain This skill should be used when the user asks to "explain security concept", "what is OWASP", "explain this finding", …

florianbuetow/claude-code

10

37

fix This skill should be used when the user asks to "fix security finding", "fix vulnerability", "generate security fix",…

florianbuetow/claude-code

10

38

fuzz This skill should be used when the user asks to "generate fuzz inputs", "create fuzz tests", "fuzz test generation", …

florianbuetow/claude-code

10

39

graphql This skill should be used when the user asks to "check GraphQL security", "analyze GraphQL endpoint", "find GraphQL v…

florianbuetow/claude-code

10

40

identifying This skill should be used when the user asks to "check for identifiability", "analyze re-identification risks", "find…

florianbuetow/claude-code

10

41

injection This skill should be used when the user asks to "check for injection", "analyze SQL injection", "find injection vulne…

florianbuetow/claude-code

10

42

integrity This skill should be used when the user asks to "check for integrity issues", "analyze deserialization", "find supply…

florianbuetow/claude-code

10

43

learn This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn…

florianbuetow/claude-code

10

44

linddun This skill should be used when the user asks to "run LINDDUN analysis", "check privacy threats", "privacy threat mode…

florianbuetow/claude-code

10

45

linking This skill should be used when the user asks to "check for linkability", "analyze cross-service tracking", "find priv…

florianbuetow/claude-code

10

46

logging This skill should be used when the user asks to "check for logging issues", "analyze security logging", "find missing…

florianbuetow/claude-code

10

47

model This skill should be used when the user asks to "create threat model", "threat model architecture", "map security arc…

florianbuetow/claude-code

10

48

non-repudiation-privacy This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit l…

florianbuetow/claude-code

10

49

outdated-deps This skill should be used when the user asks to "check for vulnerable dependencies", "audit dependencies", "find outd…

florianbuetow/claude-code

10

50

owasp This skill should be used when the user asks to "run OWASP analysis", "check OWASP Top 10", "OWASP scan", or invokes …

florianbuetow/claude-code

10