Security plugins

GoCortexIO skill bundles for the Palo Alto Networks Cortex Platform.

2 skills

Exhaustive code review and security audit checklist for any language: root-cause facets from real vulnerabilities, 46 general dimensions, 78 specialties by target type, 33 language and format tables including configuration, regex and GPU programs, execution environment checks, threat model and report format. Markdown only, read-only by default.

1 skill

Secure coding and review: OWASP Top 10, input validation, authn/authz, secrets, and dependency safety.

1 skill

argue with yourself before the internet does. — red-team a prompt across jailbreak, injection, derailment, extraction, and ambiguity.

1 skill

pat it down before it ships. — scan text headed to the model for secrets and PII (API keys, tokens, private keys, emails) and redact or flag them.

1 skill

find the plant. — sniff out prompt-injection and planted instructions hiding in untrusted input before it reaches the model.

1 skill

Certora formal verification with CVL — write mathematical proofs for smart contract correctness. Rules, invariants, ghost variables, hooks, parametric rules, multi-contract verification, and counter-example debugging.

1 skill

Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits methodology.

1 skill

Echidna property-based fuzzer for Solidity — property mode, assertion mode, optimization mode, invariant writing, corpus management, config tuning, and Foundry integration. Catch bugs that static analysis misses with stateful fuzzing.

1 skill

ช่วยลดความเสี่ยงในการส่งข้อมูลส่วนบุคคลให้ Claude: ปกปิดเลขประจำตัวประชาชน เบอร์โทร อีเมล บัญชีธนาคาร ฯลฯ ที่ตรวจพบก่อนส่ง และพรางบนหน้าจอ ตรวจจับภายในเครื่องและมอดไม่เรียกเครือข่ายเอง แต่บทสนทนาที่ปกปิดแล้วยังถูกส่งไปยังผู้ให้บริการโมเดลที่ตั้งค่าไว้ (โดยค่าเริ่มต้นคือ Anthropic) ตามปกติ ไม่รับประกันผล ไม่ใช่คำแนะนำทางกฎหมาย

Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).

77 skills

Security plugin: all 16 security skills (OWASP-category and common practices) + 2 commands. MCP server: GitHub. For the same skills without commands or MCP, install the security entry.

16 skills · 2 commands · 1 MCP server

Operational skills for Splunk Enterprise Security, security portfolio products, and WideField integrations.

18 skills

Skills for OWASP Top 10 risk areas (organized by the 2017 list, each mapped to its 2025 category): injection, authentication, access control, XSS, misconfiguration, and more. 10 skills.

10 skills

Per-Bash-call sandbox via binpash/try with post-hoc commit/discard review.

7 commands · hooks

Common security practices: API security, secrets detection, secure code review, CSRF, security headers, JWT. 6 skills.

6 skills

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

1 skill · 3 commands · 1 agent

Hard-blocks dependency additions until a version check is recorded.

1 skill · 2 commands · 1 agent · hooks

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

Adversarial security review using a paranoid finder and a critical validator over a PR, local diff, or file list, with full-coverage accounting, finder/validator context isolation, and a code-traced attack-example gate

1 skill · 2 agents

Blindfolds the LLM from your secrets. Stores API keys, tokens, and passwords in your OS keychain with kernel-level sandbox enforcement.

1 skill · hooks

Secure-coding gates for AI-written code: 70 numbered gates mapped to OWASP Top 10 and CWE, plus a pre-write guard that stops the write when it can prove the failure.

1 skill · hooks

Stop being scared to share your .env with your team. Your AI agent manages it with the whisper-secrets CLI — end-to-end encrypted, synced through git, and it never sees a value.

1 skill · hooks

Teaches Claude the full TLCTC v2.7 framework — 10 axioms, 10 threat clusters, 17 R-* classification rules incl. R-SCOPE and R-SPECIFIC, attack-path notation (Δt velocity, ||...||, ⇒, |...|, ?/…), and worked examples — so any session can classify incidents, CVEs, and threat intel through a causal, axiomatic lens.

1 skill · 1 command

SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation

1 command · 1 agent

Detect Codex agent-composition drift and emit signed Agent Manifest and TRACE session records.

1 skill · hooks

Safely operate Cisco Security Cloud Control Firewall Manager through its CLI and Ansible collection.

2 skills

31 security checks across 14 categories for apps built with AI/low-code tools.

1 skill

Finds supply-chain droppers committed directly into a repository — the kind npm audit cannot see because there is no malicious dependency. Scans a clone or every repo you can reach, removes the payload including from history, and helps warn collaborators.

1 skill

Orchestrates test-driven fixes for Mattermost security tickets: failing secure-behavior tests first, then implementation, then edge-case hardening, then a review-ready PR with a vague public description

1 skill