Stats
Actions
Tags
From security
Indexes vulnerability detection patterns and routes to core universal skills for secrets, injections, configs plus language-specific for JavaScript/TypeScript, Python, Go, Java, Ruby, PHP.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security:vulnerability-patternsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill is an index to modular detection pattern skills. Use the specialized skills for focused scanning.
This skill is an index to modular detection pattern skills. Use the specialized skills for focused scanning.
vuln-patterns-coreCovers: Universal patterns, configuration files, quick scan scripts Languages: All (cross-language patterns) Use when: Scanning any codebase, config audits, hook integration
Includes:
vuln-patterns-languagesCovers: Language-specific vulnerability patterns Languages: JavaScript/TypeScript, Python, Go, Java, Ruby, PHP Use when: Targeting specific tech stacks, code review
Includes:
| What You're Looking For | Skill to Use |
|---|---|
| Hardcoded secrets | vuln-patterns-core |
| SQL injection (any language) | vuln-patterns-core |
| Command injection (any) | vuln-patterns-core |
| Path traversal | vuln-patterns-core |
| Docker/config issues | vuln-patterns-core |
| JavaScript XSS | vuln-patterns-languages |
| Python pickle/yaml | vuln-patterns-languages |
| Java deserialization | vuln-patterns-languages |
| Go TLS issues | vuln-patterns-languages |
| Ruby Rails patterns | vuln-patterns-languages |
| PHP include/require | vuln-patterns-languages |
| OWASP 2021 | Skill | Key Patterns |
|---|---|---|
| A01 Access Control | Core + Languages | Path traversal, authorization |
| A02 Crypto Failures | Languages | MD5, SHA1, weak random |
| A03 Injection | Core | SQL, command, XSS |
| A05 Security Misconfig | Core | Debug mode, headers |
| A07 Auth Failures | Core | Hardcoded credentials |
| A08 Data Integrity | Languages | Deserialization |
For live security hooks, use vuln-patterns-core which includes:
asvs-requirements - Full ASVS requirement detailsremediation-library - Index to fix patternsremediation-injection - Injection fixesremediation-crypto - Cryptography fixesnpx claudepluginhub zate/cc-plugins --plugin securityIdentifies common web vulnerability patterns like SQL injection, command injection, XSS, and OWASP Top 10 during whitebox pentesting and code reviews.
SAST for code vulnerability analysis across multiple languages and frameworks. Integrates Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, Brakeman, gosec, and cargo-clippy. Detects SQL injection, XSS, hardcoded secrets, path traversal, and more.
Performs systematic security code review for vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues. Reports only high-confidence exploitable findings after tracing data flow and checking framework protections.