Topic · Code and Developer
Vulnerability Scanning skills for Claude Code and Codex
Skills for finding vulnerabilities: static analysis with CodeQL and Semgrep, fuzzing with libFuzzer, AFL++, cargo-fuzz and Atheris, Dependabot, SARIF triage, AWS Security Agent scans and pentests, and chain-specific scanners. They help an agent find exploitable bugs and separate real findings from noise.
Highest-scoring vulnerability scanning skills in the October 22, 2026 snapshot: codeql from trailofbits/skills (92/100), skill-scanner from getsentry/skills (88/100) and aig-scanner from Tencent/AI-Infra-Guard (82/100). Scores come from the Suede Skill Check.
- 55 listed skills
- 9 repositories
- 10 with full pages
51 from official publishers. 7 bundle scripts. 4 connect to an outside service. Listed in Security (41), Testing and QA (12), Code Review and Code Quality (1), AI Agents and LLM Engineering (1).
All 55 vulnerability scanning skills
No matching skills. Try fewer words or clear your search.
| Skill | Repository | What it does |
|---|---|---|
| agentic-actions-auditor 89/100 · B | trailofbits/skills | Audits GitHub Actions workflows for security vulnerabilities where attacker-controlled input reaches AI agents like Claude Code Action, Gemini CLI, or Codex in CI/CD. |
| aig-scanner 82/100 · B | Tencent/AI-Infra-Guard | Runs AI security scans of infrastructure, AI tools and skills, and AI agents, and evaluates LLM jailbreak resistance with Tencent's AI-Infra-Guard. |
| codeql 92/100 · A | trailofbits/skills | Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes. |
| firebase-security-rules-auditor 78/100 · C | firebase/skills | Audits Firebase Firestore and Cloud Storage security rules for vulnerabilities including privilege escalation, role bypasses, and resource exhaustion. |
| gha-security-review 86/100 · B | getsentry/skills | Reviews GitHub Actions workflows for exploitation vulnerabilities such as pwn requests, expression injection, credential theft, and supply chain attacks, with concrete proof-of-concept scenarios. |
| security-audit 72/100 · C | cloudflare/security-audit-skill | Provides security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons, including focused reviews, vulnerability research, audits, and pen tests. |
| security-review 86/100 · B | getsentry/skills | Reviews code for security vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues, using a systematic process with confidence-based reporting. |
| semgrep 92/100 · A | trailofbits/skills | Runs a Semgrep security scan over a codebase, detecting languages, selecting rulesets, requiring approval of the plan, and merging output to SARIF. |
| skill-scanner 88/100 · B | getsentry/skills | Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation. |
| trailmark-finding-triage 91/100 · A | trailofbits/skills | Performs graph-assisted triage of a single security finding, SARIF result, or suspicious function using Trailmark reachability, taint, privilege-boundary, and blast-radius evidence. |
| address-sanitizer 84/100 · B | trailofbits/skills | Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers… |
| aflpp 73/100 · C | trailofbits/skills | Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel… |
| algorand-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and… |
| atheris 84/100 · B | trailofbits/skills | Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting… |
| audit-prep-assistant 88/100 · B | trailofbits/skills | Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage… |
| burpsuite-project-parser 88/100 · B | trailofbits/skills | Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns… |
| c-review 86/100 · B | trailofbits/skills | Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use… |
| cairo-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address… |
| cargo-fuzz 84/100 · B | trailofbits/skills | Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement… |
| codeql 80/100 · B | github/awesome-copilot | Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used… |
| constant-time-analysis 89/100 · B | trailofbits/skills | Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets… |
| cosmos-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25… |
| dependabot 78/100 · C | github/awesome-copilot | Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files… |
| diff-scanning-with-aws-security-agent 74/100 · C | aws/agent-toolkit-for-aws | Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check… |
| edgeone-clawscan 62/100 · D | Tencent/AI-Infra-Guard | The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment… |
| entry-point-analyzer 87/100 · B | trailofbits/skills | Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify… |
| find-bugs 75/100 · C | getsentry/skills | Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review… |
| firebase-apk-scanner 89/100 · B | trailofbits/skills | Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud… |
| fp-check 93/100 · A | trailofbits/skills | Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented… |
| fuzzing-dictionary 84/100 · B | trailofbits/skills | Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens… |
| fuzzing-obstacles 84/100 · B | trailofbits/skills | Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other… |
| genotoxic 87/100 · B | trailofbits/skills | Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants… |
| google-cloud-scc-query 87/100 · B | google/skills | Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from… |
| google-cloud-scc-remediation 87/100 · B | google/skills | Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and… |
| harness-writing 76/100 · C | trailofbits/skills | Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding… |
| libafl 76/100 · C | trailofbits/skills | Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into… |
| libfuzzer 76/100 · C | trailofbits/skills | Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure… |
| ossfuzz 84/100 · B | trailofbits/skills | Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and… |
| pentesting-with-aws-security-agent 77/100 · C | aws/agent-toolkit-for-aws | Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied… |
| post-patch-validation 91/100 · A | trailofbits/skills | Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior… |
| remediating-with-aws-security-agent 78/100 · C | aws/agent-toolkit-for-aws | Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent… |
| ruzzy 84/100 · B | trailofbits/skills | Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure… |
| sarif-parsing 89/100 · B | trailofbits/skills | Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results"… |
| scanning-with-aws-security-agent 77/100 · C | aws/agent-toolkit-for-aws | Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked… |
| secret-scanning 80/100 · B | github/awesome-copilot | Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret… |
| secure-code-guardian 84/100 · B | jeffallan/claude-skills | Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security… |
| security-review 81/100 · B | github/awesome-copilot | AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions… |
| security-reviewer 86/100 · B | jeffallan/claude-skills | Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use… |
| semgrep-rule-creator 89/100 · B | trailofbits/skills | Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building… |
| semgrep-rule-variant-creator 89/100 · B | trailofbits/skills | Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and… |
| solana-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar… |
| substrate-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks… |
| ton-vulnerability-scanner 84/100 · B | trailofbits/skills | Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward… |
| trailmark-variant-neighborhood 81/100 · B | trailofbits/skills | Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared… |
| vulnerability-triage-brocards 90/100 · A | trailofbits/skills | This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a… |
How to choose vulnerability scanning skills
Match the technique to the code. Static analysis fits most application code; fuzzing fits parsers, decoders and native libraries; dependency scanning fits every project.
Scanners and fuzzers run tools locally or in CI. Install the toolchain each skill names, and run fuzzing in a container or CI job rather than on a workstation.
Use a triage skill (SARIF parsing, false-positive checks, finding triage) on scanner output before filing issues, so the backlog holds confirmed problems.
Ranked vulnerability scanning shortlists
Related topics
Security Auditing and Review 108Smart Contracts and Blockchain 22Test Automation 134Code Review 50AWS 151Google Cloud 146CI/CD and DevOps 39Dependency Management 23
Find your next useful skill
Explore Rising Skills with quality scores and source reports, or search from inside your agent.
Get Rising Skills by email · Read Rising Skills · Install the finder · State of Agent Skills