Security plugins

Arsenal Security Engagement Harness Plugin for Oh My Pi

200 skills · 9 commands · 6 agents · 6 MCP servers

A cybersecurity skill collection for investigations, detection engineering, cloud security, forensics, threat intelligence, and security testing.

200 skills

Pre-launch security gate: secrets scan, attack-surface mapping, data-flow tracing, vuln scanning, guided fixes, launch triage, plus an appsec agent and footgun guides for Next.js/Vercel, Supabase, Stripe, Node/Express. Defensive review only.

5 skills · 10 commands · 1 agent · hooks

Methodology-and-tradecraft OSINT investigation toolkit with evidence discipline, confidence grading, and an authorization gate. Passive by default; active collection requires recorded authorization.

8 skills · 6 commands · 2 agents · hooks

Full Art. 39 EUDPR DPIA workflow voiced by five specialist roles: DPO, IT architect, legal officer, IT security, EDPS reviewer. For data protection officers and IT project managers.

16 skills

Run eco-guardian dependency vulnerability scans from Claude Code.

2 skills · 8 commands · 2 agents · hooks

Proof-carrying defensive security reviews for AI-assisted software, with deterministic policy, portable evidence, and human review required.

11 skills · 1 MCP server

Red team penetration testing suite for WebSpec-compliant implementations. 10 specialized agents simulating vulnerability classes from the MoltBook case study.

1 skill · 1 command · 10 agents

Security-focused code review toolkit using grepai semantic search

7 skills · 3 commands · 1 agent

End-to-end OpenAPI security testing pipeline covering all OWASP API Top 10 2023 categories. Generates and runs Gherkin or Hurl test suites from any OpenAPI/Swagger spec.

10 skills

Apiiro security plugin: skills and commands (prevention hooks are opt-in)

9 skills

Authorized, defensive security audit engine: scans a live URL or a source-code repo for known (CVE/dependency) and unknown (logic/code) vulnerabilities and produces a prioritized, remediation-focused report. Safe by default; active testing requires authorization.

3 skills · 4 commands · 1 agent · hooks

Tells Claude when the JavaScript it wrote is unsafe or slow, so it fixes it in the same turn.

3 skills · 4 commands · hooks

Wire PermDock into a TypeScript app, audit a setup or pull request, and work on agents, approvals, tenancy, data and credentials.

8 skills

Security vulnerability detection and remediation: OWASP Top 10, SAST scanning, CVE research, dependency audit, secrets detection

6 skills · 1 command · hooks

AI governance framework for Claude Code — self-protecting hooks, drift tracking, and workflow enforcement

7 skills

Security vulnerability detection and remediation: OWASP Top 10, SAST scanning, CVE research, dependency audit, secrets detection

5 skills · 1 command · hooks

Interactive wizards for creating Gemara threat catalogs, control catalogs, policies, and risk catalogs with schema validation

4 skills · 2 MCP servers

SecID — universal security identifier lookup, resolution, and registry research. Resolve CVEs, CWEs, ATT&CK techniques, NIST controls, and 700+ security knowledge sources. Local MCP server calls the SecID REST API with optional --base-url for internal resolvers.

3 commands · 1 agent · 1 MCP server

Sigma detection rule writing, validation, and conversion for SOC analysts and threat-intel teams. LLM-assisted draft + pySigma validation + multi-backend conversion (Splunk, Elastic, OpenSearch; Wazuh through the Elastic Lucene backend) with logsource-aware processing pipelines. Ships a 294-rule published corpus spanning 16 categories (every MITRE ATT&CK Enterprise tactic plus code review), covering ransomware and threat-actor activity as well as vulnerabilities disclosed in AI/LLM applications and MCP servers.

3 skills · 1 MCP server

Severity level classification and prompt improvement for marketplace plugins. Assigns severity ratings (S1-Critical through S4-Low) and enhances plugin prompts for clarity, safety, and effectiveness.

1 skill · 2 commands · 1 agent

Android Reverse Engineering Suite | 专注于 Android 生态全流程逆向的纯技能套件。涵盖 Frida 动态插桩、加固内存 DEX 脱壳、Unity 手游 IL2CPP 符号还原与网络协议签名逆向

4 skills

PC Binary Reverse Engineering Suite | 专注于 Windows PE 与 Linux ELF 桌面二进制逆向的纯技能套件。涵盖复杂 C/C++ 结构体反推还原、导入导出表与 API Hashing 符号审计、Unicorn 微代码轻量仿真与反调试对抗分析

4 skills

Runtime authorization for AI agents. Sign in with Vulnify, and check risky tool calls before they run. finalDecision is ALLOW, REVIEW, or BLOCK.

2 skills · 1 MCP server · hooks

Rogue Security AIDR — real-time AI agent detection and response for Claude Code

2 skills · hooks

Automated penetration testing for web applications with OWASP Top 10 coverage

1 skill · 2 commands

Agent-native Reverse Engineering Suite | Windows PE/ELF 逆向分析、Android APK/DEX/Frida 脱壳插桩、CTF 题解与 197+ 篇逆向知识库 SOP

3 skills

Claude Code용 보안 슬래시 명령어 3종 — /security-review (PR 차분 정적 분석), /full-scan (릴리스 전 전체 파일 + 의존성 CVE), /security-scan (스테이징 런타임·HTTP 검증). 출력은 hooks/security-filter.sh로 Critical/High만 8KB 캡. 모델 자동 발동 차단, 프로덕션 URL 거부, 스테이징 전용 강제. 40개 픽스처 테스트 하니스 동봉.

3 commands

AI-driven source-code vulnerability audit: a 5-stage methodology (recon, investigate, validate, disclose, learn) with adversarial false-positive filtering and conservative, cooperative disclosure. Static-only; hands off to the defending-code harness for runtime-verified findings.

2 skills

Audit access control implementations

1 skill · 1 command