Security research and vulnerability discovery skills from GitHub Security Lab. First topic: fuzzing campaigns for C/C++, Java and JavaScript/TypeScript.
Plugin seclab-skills from marketplace seclab in GitHubSecurityLab/skills. Commands read from the repo's manifest — 5 days ago.
fuzz-c-cppC/C++ fuzzing reference for libFuzzer, AFL++ and FuzzTest: harness formats, builds, runs, coverage, triage and regression commands. Not a starting point: use fuzz-harness or fuzz-campaign.
fuzz-campaignRuns a fuzzing campaign on C/C++, Java or JS/TS code, from threat model to hand-off. Use for "fuzz this project", "what should I fuzz?", "run this fuzzer for 4 hours", "analyze the long runs", "upstream my harnesses", "add fuzzing to CI", or to resume. Not for one harness or given crashes (fuzz-harn
fuzz-coverageMeasures a fuzz harness's source coverage, explains why attack-surface code stays uncovered, and applies the most valuable fix: seeds, dictionary, targeted inputs, harness or build change; also corpus merges. Use for "why is coverage stuck?" or "improve this fuzzer's coverage". Not for writing a new
fuzz-harnessWrites or extends a fuzz harness (fuzz test) for one entry point in the project's test style, builds its variants, adds seeds and a dictionary, and checks it with the harness gate. Use for "write a fuzz test for X", "build this with ASan and libFuzzer", or to check on or stop a fuzzing run. Not for
fuzz-javaJava fuzzing reference for Jazzer: @FuzzTest harnesses, Maven, Gradle, runs, JaCoCo coverage, detectors, hooks, triage and regression tests. Not a starting point: use fuzz-harness or fuzz-campaign.
fuzz-jsJS/TS fuzzing reference for Jazzer.js: CLI targets and Jest tests, setup, runs, coverage, detectors, hooks, triage and regression tests. Not a starting point: use fuzz-harness or fuzz-campaign.
fuzz-triageTriages fuzzer crashes (reproduce, group, minimize, root cause, verdict), fixes real bugs with a regression test, and drafts reports or advisories. Use for "triage these crashes", a crash file or sanitizer report (also from OSS-Fuzz or CI), "fix this crash" or "write an advisory for this bug". Not f
security-threat-modelBuilds a code-level threat model of a repository: attacker and deployment context, entry points that take untrusted data (sources), dangerous operations (sinks) and the paths between them, in .seclab/threat-model.md. Use for "threat model this repo", "what is the attack surface", or before fuzzing o
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint
13 skills · 1 command · 1 agent · hooks
Install the "AAS Secure App Builder" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.