Security plugins

Production-readiness skill suite — 58 commands for security auditing, cleanup, feature analysis, and remediation across 24 security categories

1 skill

Audit whether a product feels trustworthy or unsafe — covering permissions, privacy, billing, file mutation, and silent-failure surfaces.

Red-team a product's onboarding and first-run experience to find where new users get confused, think it's broken, or abandon setup.

5 essential development safety hooks preventing common mistakes and enforcing best practices

5 security enforcement hooks for vulnerability scanning and compliance

Agent Skills for Cisco cloud security products and services.

Blocks edits and writes that would commit API keys, tokens or private keys.

Protects .env files, SSH keys and credential stores from being read or modified.

Blocks catastrophic shell commands like rm -rf /, mkfs, dd to disks and chmod -R 777.

35 hunt-director specialist/recon/report agents + 138 security-testing skills (recon, injection, auth, cloud, client-side, exploit-chaining). Proxy-agnostic (Caido/none), ccurl-optional. Local-first: optional ax-fleet recon, Discord, PoC hosting.

143 skills · hooks

AI codes fast. Raven enforces Discipline — Strategic Thinking, Scalable Structure, Security at Source. A plan attacked from three angles before any edit, approved by you; every prompt routed to the right one of 61 specialists, never silently; and local guards that block secrets, vulnerable libraries, and edits until the thinking happened — at the source, not after the damage. All local. Zero telemetry. MIT.

63 skills · 12 commands · 10 agents · 1 MCP server · hooks

81 cybersecurity skills + 13 cs-* agents. Bundles 7 slash commands and 6 user-invocable orchestrator skills (Alex, CISO, DevSecOps, IR, Program Manager, Red Team). Every skill emits a typed 11-field JSON output contract mapped to MITRE ATT&CK and NIST CSF 2.0. Apache 2.0, runs in any LLM.

64 skills · 7 commands · hooks

GWT integration hooks, managed skills, and GitHub management for Claude Code

20 skills · 17 commands

25-skill pentest pack: ROE/authorization + scope gate first, then header/TLS/CORS/secret/dependency/code scans, OWASP Top 10 mapping and exec-readable reporting (upstream: jeremylongshore/claude-code-plugins-plus-skills, MIT; pinned, not copied)

26 skills · 2 commands

Agent skills for Cerbos authorization: author and test policies, distribute them through Cerbos Hub, and enforce them in applications, gateways and AI agents

20 skills

OS keychain secrets for AI coding agents, over MCP — manage secrets, scan for leaks, rotate keys, and enforce policy directly from Claude Code.

6 skills · 8 commands · 2 agents · 1 MCP server · hooks

Physical Security, Self-Defense, Firearms, and the ATF Substances -- people and buildings, force and law, and how alcohol, tobacco, cannabis and firearms actually intersect with medicine and self-defense -- with the source's limits carried into every skill: not legal advice, not medical advice, no dosing, and no substitute for hands-on training. Evidence-graded throughout (STRONG, MODERATE, WEAK, CONTESTED) and law-dated (LAW-2026: the legal state as of September 2026, to be verified). Threat modeling and what realistic risk looks like -- most violence comes from people you know, most burglaries are opportunistic, most gun deaths are suicides; the security mindset translated from information security, the fail-safe vs fail-secure egress tension, layered defense with time as the currency, and CPTED with the CCTV and lighting evidence. Home hardening in cost-effectiveness tiers from life safety first, organizations, access-control realities and authorized testing, and targeted violence with BTAM and Run-Hide-Fight. Personal security, domestic-violence and stalking safety planning, the self-defense hierarchy and de-escalation, the empowerment self-defense trial, less-lethal tools, and Stop the Bleed. Firearms treated conceptually and for safety, exactly as the source does -- the four safety rules, storage and the honest risk ledger with the contested defensive-gun-use numbers against the suicide evidence, training, carrying and the aftermath of an incident; federal law through United States v. Hemani and South Carolina's permitless-carry and self-defense statutes. Alcohol, tobacco and cannabis on mechanism, evidence-graded medical uses, harms, law and why intoxication and weapons do not mix; the self-medication problem; a personal security plan, spending priorities and the contested questions on both sides; and crisis lines, training resources, the glossary and the sources. Source defects, internal tensions and untagged legal statements are flagged in place with labell

8 skills

Tor and Onion Networks: what Tor promises and what it deliberately does not, the history from NRL onion routing to Arti, cells and channels and the telescoping circuit handshake, ntor and ntor-v3, the tor1 to CGO cell-cryptography migration, SENDME flow control, congestion control and Conflux, relays and flags and the nine directory authorities, the hourly consensus and bandwidth weights, guard pinning and path restrictions and happy families, v3 onion services end to end, blinded descriptor keys, introduction and rendezvous points, client authorization, vanguards and proof-of-work and Onionbalance, bridges and pluggable transports, obfs4 and Snowflake and WebTunnel and Conjure, the 2026 DTLS fingerprinting campaign, the attack literature from end-to-end confirmation through website fingerprinting to client-side compromise, the 2026 software ecosystem, Tor against I2P and mixnets and VPNs, governance and funding, and an operations handbook covering SOCKS integration, the control port, ephemeral and long-lived onion services, relays and bridges and exits, transparent-proxy gateways, hardware builds, verification and abuse handling.

8 skills

Security assessment agents for vulnerability scanning, compliance validation, code auditing, and remediation guidance

2 skills · 2 commands · 1 agent · hooks

Cryptography and Encryption: what cryptography does and doesn't solve, threat models, randomness, hash functions, MACs, symmetric encryption, AEAD, public key cryptography, key exchange and forward secrecy, digital signatures, password storage and KDFs, TLS, PKI and certificates, end-to-end encrypted messaging, disk and file encryption, other protocols, implementation failure modes, key management, crypto agility, advanced constructions, blockchain cryptography, and law and policy.

6 skills

Manage GPG-encrypted environment secrets using the dotsecenv CLI

5 skills

Security review toolkit: OWASP-aligned code review, dependency and secret auditing skills, a security-auditor agent, and a full-codebase /security-audit command.

3 skills · 1 command · 1 agent

Artemis Recon — walks Claude Code through authorized red-team reconnaissance of AI assets (chatbots, agents, LLM-powered features).

1 skill · 2 commands · 1 MCP server

Dependency auditing -- vulnerability scanning, outdated package detection, unused dependency identification, and safe update strategies. Agent: dependency-auditor.

1 skill · 1 command · 1 agent

Two complementary JavaScript/TypeScript web and Electron security skills: web-security-review traces data flow and reports only proven vulnerabilities; web-security-hardening performs applicability-aware OWASP ASVS 5.0.0 and Electron Security Checklist gap assessments across browser, desktop-runtime, identity, storage, packaging, update, and deployment controls.

2 skills · 1 agent

Two Keycloak skills, split by what the work targets. `keycloak` routes realm-administration requests to the right guidance: passwordless login by magic link, email OTP, passkey-only WebAuthn, or a combined passkey-or-magic-link "0 password required" flow, corporate/enterprise SSO by email domain, social login and enterprise identity-provider federation (Entra ID, Okta, Auth0, and more), organization-membership login restriction for both local and federated logins, credential enrollment for existing users (passkey/TOTP via required actions or an emailed link), and Phase Two cluster/deployment provisioning. `securing-apps` covers the other direction — wiring Keycloak login into your own React, Angular, Vue, Next.js, mobile or backend application, validating its bearer tokens, and registering the OIDC client it needs.

2 skills · 1 MCP server

Security-focused review of diffs and PRs (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill · 1 command · 1 agent

Semgrep/CodeQL-driven static analysis (needs semgrep installed) (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

3 skills

Enforce authorization before each tool call using Denied.dev

hooks

Pattern-based hooks for sensitive git staging, generated file paths, and large Write content or added patch text. Supports Claude Code, Grok Build, and native Codex tool payloads. Requires jq; see README for limits.

hooks