Security plugins

Deterministic guardrails, active immediately after install: a compound-command deny list, sensitive-file protection, and prompt-injection screening.

hooks

Mint, present, verify and revoke VAIDs. Four verbs over the published vaid-mint SDK: verification is offline, needs only a public key, and reports authenticity, expiry, delegation and issuer identity separately — and always reports that revocation was NOT checked, because there is no published revocation list.

1 skill

Type secret keys into a pane beside the chat; they go to .env files and Claude only ever sees [hidden].

24 defensive cybersecurity Agent Skills and the hosted read-only Aegis MCP server.

24 skills · 1 MCP server

Policy enforcement, PII detection, and audit trails for Claude Code. Automatically evaluates governed tool inputs against 80+ governance policies, scans outputs for sensitive data, and records every decision in a compliance-grade audit trail. Self-hosted via Docker — all data stays on your infrastructure.

7 skills · 10 commands · 1 MCP server · hooks

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents

Prod-safe AI coding agents for infra teams: a pre-execution hook that judges each shell command by where it points and what it will change, then runs it, asks a human, or blocks it.

1 skill · 6 commands · 1 MCP server · hooks

Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security

4 skills · 3 agents

12-lens engine-verified audit (loop + memory modes), x-ray-grade pre-audit recon, native and Echidna/Medusa stateful fuzzing, dependency-supply-chain review, key hygiene, and on-chain incident response for EVM · Solana · Move · Soroban. Findings map to CWE, SWC, OWASP Smart Contract Top 10 and DASP.

6 skills

Security scanning, auditing, and compliance validation with 4 specialized agents, plus fail-closed hooks: PII/secrets guard, HMAC-chained tamper-evident audit (CloudWatch dual-write), token-budget circuit breaker

2 commands · 4 agents

Launch audit (score + GO/NO-GO), deploy preflight, guided fixes, secret guard hook, and an unstuck protocol for AI fix loops.

4 skills · hooks

Scans project dependencies for known vulnerabilities using OSV Scanner and the OSV database.

1 skill · 2 commands · 1 MCP server

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

Adversarial security and architectural code review. Finds the most plausible security failure in your code.

1 skill · 1 command · 1 agent

KeePass database management via keepassxc-cli — search, add, edit, merge duplicates, OS secret store auth

1 skill · 2 commands

Register an autonomous agent's identity, check a runtime policy decision before it acts, and log a hash-chained attestation of what it did. Backed by A2Z SOC's live Agent Registry, Policy Firewall, and Attestation Ledger.

2 skills

Block destructive commands and secret access in Coding CLI.

1 skill · hooks

本地加密密钥/密码管理 — AES-256-GCM 加密，AI 能注入但看不到明文

2 skills

Use when setting up or reviewing policy-as-code enforcement — writing Kyverno or OPA policies, configuring branch protection, generating SLSA provenance, or planning a phased SDLC hardening rollout.

1 skill

Use when hardening GitHub Actions workflows, managing secrets or self-hosted runners, configuring OIDC or Workload Identity Federation, securing a GKE cluster, or assessing supply-chain risk.

1 skill

Vaultwarden/Bitwarden in your agent harness — credential reads via rbw, org member admin via bw

1 skill

Spend governance for Claude Code: a spend hold on every tool call, settled at the real usage from Claude Code's transcripts. Watch-only by default: nothing is blocked unless you opt in to enforcement.

hooks

Keeps secrets, email addresses and IP addresses out of the session transcript, and puts the real value back on the way into a tool call

Security auditing, recon, web testing, reporting, and assessment skills for authorized security work.

公式の固定 commit からローカル生成する、Python の入口を uv run に統一した Claude Security

NIST CSF 2.0 cybersecurity framework — govern, identify, protect, detect, respond, recover with 39 skills

39 skills · hooks

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents

Static analysis for potential HIPAA-related issues — PHI detection, risk scoring, and audit reports. Informational only; not legal advice, compliance certification, or a guarantee of compliance.

6 skills · 1 agent · 1 MCP server

This skill should be used when identifying, analyzing, and mitigating security risks in Artificial Intelligence systems using the CoSAI (Coalition for Secure AI) Risk Map framework. Use when users ask to "assess AI security risks", "analyze AI system threats", "map risks to controls", "run a risk assessment", "check compliance with MITRE ATLAS", "generate a CoSAI report", or "profile persona risks". Supports LLM applications, ML pipelines, model training/serving infrastructure, and compliance reporting aligned with MITRE ATLAS, NIST AI RMF, OWASP Top 10 for LLM, STRIDE, and ISO 22989 frameworks.

1 skill · 7 commands

Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security

4 skills · 3 agents