Security plugins

Security scanning, auditing, and compliance validation with 4 specialized agents, plus fail-closed hooks: PII/secrets guard, HMAC-chained tamper-evident audit (CloudWatch dual-write), token-budget circuit breaker

2 commands · 4 agents

Tamper-evident journal for agent decisions and session transcripts: hash chain, Ed25519 signatures, RFC 3161 / OpenTimestamps anchoring, third-party-verifiable attestations.

1 skill · 3 commands · 1 MCP server · hooks

LLM command safety validator. Blocks dangerous bash commands and Claude advertising spam.

1 skill · 2 commands · hooks

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

Application, LLM, and blockchain security personas plus credential tooling.

4 skills

Two-skill toolkit for smart contract audit response: (1) reviewing-audit-reports validates findings with PoC tests and grades audit quality, (2) resolving-audit-findings converts confirmed PoCs into regression tests and implements fixes using TDD.

3 skills

Check every Claude Code tool call with provio before it runs (your provio.yaml, or the built-in disaster floor) and record it in a tamper-evident ledger. Needs `pip install provio`.

2 commands · hooks

Anonymise what your agent reads and restore what it writes. Installs the two Oboro hooks and the skill that explains their placeholders. Needs the `oboro` binary on PATH: without it every matching tool call is withheld or refused rather than left unprotected.

1 skill · hooks

Prompt-injection and jailbreak detection for tool results via on-device ML classifier.

1 skill · hooks

Salesforce-authored. Shield Platform Encryption and Salesforce Archive: encrypted field configuration, key management, archive search and restore, retention analysis. Complements the vibe-force skills sf-security-model and sf-org-security-audit.

2 skills

Lets Claude reach HTTP Basic Auth (htaccess) sites through Password Filler and 1Password — in Chrome, Playwright and scripts — without the credentials appearing in the conversation.

1 skill · 1 MCP server

A local cryptographic inventory for developers and AI agents that carries verifiable coverage and its own limits inside the CBOM.

1 skill · 1 MCP server

Full security and enterprise architecture advisory for CISOs, CTOs, CPOs, Security Architects, Security Engineers, Enterprise Architects, Secure Developers, and Penetration Testers. 8 roles, 8 frameworks, 8 templates, 5 checklists. Threat modelling, compliance mapping, code review, maturity assessments, and tabletop simulations.

1 skill

Multi-agent security audit that reads and understands code, adversarially verifies every finding, and scores honest CVSS 3.1.

1 skill

MintMCP Claude Code Monitor (macOS/Linux). This plugin adds hooks for observability and governance for Claude Code agents.

hooks

MintMCP Claude Code Monitor (Windows). This plugin adds hooks for observability and governance for Claude Code agents on Windows using PowerShell.

hooks

Co-build and deploy custom MintMCP gateway middleware. Walks through discovering tool inputs, drafting QuickJS rules, testing via test_gateway_middleware, and saving via create_gateway_middleware.

1 skill

Skill voor de Baseline Informatiebeveiliging Overheid 2 (BIO2): verplichte beveiligingsmaatregelen voor alle Nederlandse overheidsorganisaties, gebaseerd op ISO/IEC 27001/27002 en NIS2

1 skill

Use personal access tokens stored by the patman CLI to authenticate API requests, without the token value ever entering the transcript

1 skill

Analyze Dockerfiles and provide recommendations for creating secure containers following best practices.

1 skill

Vet an MCP server before you install it, using reachscan's static reachability analysis.

1 skill

Blocks Bash commands that run scripts from the network, reviews the script, pins the exact bytes, and asks you before they run.

hooks

Answers permission prompts for you: allows routine tool calls, asks you on risky ones

1 skill

Structured, evidence-based security reviews: SAST, SCA, authorization, XSS, supply-chain and AI/LLM tracks, with exact files, lines, impact and remediation. Read-only by default.

1 skill

Sweep many projects, servers and images for known vulnerabilities with OSV verification, reachability and P0-P3 prioritization.

1 skill

Elixir/Phoenix security audit & fix skill (Sobelow, mix_audit, hex.audit, OSV, Semgrep).

1 skill

Run disciplined SOC and DFIR investigations from evidence to disposition.

1 skill

Check the machine Claude is running on against CISA-exploited CVEs, looked up through Lattice. Prints evidence for a person to read.

1 skill

Curated portable hooks (curated-hooks.txt): policy gates, drift checks, and session guards that ship to installers.

봇이 도구 결과를 읽기 전에 API 키·토큰을 가리고, 권한 없는 요청자·외부 워크스페이스·가림모드면 전화번호·이메일까지 가리는 mod