Security plugins

Daily vulnerability intelligence and local project exposure scanner.

2 skills

Nothing is ever destroyed: deletion redirected to a reversible archive, pre-image snapshots on every write, checkout/publish workflow for Office documents, placeholder/stub protection in cloud-synced folders, and policy-driven command and content blocking.

1 skill · hooks

Secure database and cloud access through Akeyless Agentic Runtime Authority — credentials never enter the model context.

1 skill · 1 MCP server

Flags hidden prompt injection in tool results and in the skills, rules and CLAUDE.md files a session loads.

1 skill · hooks

Keep .env and secret files encrypted in git, synced across machines via age — requires the crypt-sync CLI (npm install -g crypt-sync)

1 skill · hooks

Claude Code security monitoring plugin — emits OTLP spans for hook events and fail-closes on missing Pinta identity.

hooks

AI commons umbrella plugin for the Sui community — currently the sui-move-auditor zero-trust security auditor for Sui Move smart contracts.

1 agent

Scans tool calls and user prompts for leaked API keys, credentials, private keys, and HIPAA/PII data. Blocks dangerous actions before they execute.

hooks

Finds the security holes in a change while they are still cheap to fix, then verifies the implementation actually closed them.

1 skill

Apiiro prevention hooks (opt-in): prompt security enrichment, commit scanning, and auto-login

hooks

Python supply chain security scanner for detecting malicious packages, typosquatting, and persistence mechanisms through static analysis and system inspection

1 skill

MCP security scanner and protected branch hooks for Claude Code

hooks

Handles web pages, files, tool output, and inter-agent messages as data rather than instructions, with injection triage and a bounded escalation path.

1 skill

Security checklist for GitHub Actions workflows — SHA pinning, least-privilege permissions, zizmor linting, and repo hardening

1 skill

Security review of branch changes: an Anthropic-derived reviewer and deterministic scanners (gitleaks, brakeman, zizmor, bundle-audit, npm audit) run as isolated agents, then an independent verifier tries to disprove every candidate before it is reported

1 skill

AI-Powered Security Testing Toolkit - Comprehensive penetration testing tools for authorized security assessments. Use when conducting professional security testing, vulnerability assessments, or penetration testing on systems you own or have explicit authorization to test.

1 skill

Review HTML/CSS and React/TypeScript code for WCAG 2.2 Level AA accessibility compliance

1 skill

Security-inspect an AI agent skill with the skillspector CLI, then render a plain-English verdict report in chat: SAFE / CAUTION / DO_NOT_INSTALL, a threat breakdown, the top findings to check first, and file hotspots. Deep mode adds LLM intent classification; the verdict is capability-clustered and intent-weighted, with confirmed source-to-sink exfiltration chains as the categorical do-not-install trigger. Bundles the render script and flags degraded (static-only) scans so an unreliable verdict is never mistaken for a trustworthy one.

1 skill

Large-N analysis of the CVE corpus: growth attribution, CNA behaviour profiling, record completeness, and CWE assignment quality. Answers whether CVE growth is real, whether CVE data is improving, and why each CNA participates — with the corpus pitfalls that produce confidently wrong answers.

1 skill

Multi-agent OWASP Top 10 security audit with technical and stakeholder reports

1 command

Multi-agent NCSC ICT-beveiligingsrichtlijnen audit met technische en stakeholder rapporten

1 command

Instruction-aware binary patching, diffs and rollback through a uv-managed Capstone CLI and focused workflows.

1 skill

Debug, instrument, reverse engineer, and patch running programs with Frida, primarily on Windows.

1 skill

Default native reverse engineering and dump analysis toolkit, routing Ghidra/IDA-style workflows through portable Rizin.

1 skill

Core security guards (git, install, security) and SOLID enforcement hooks for Codex CLI

hooks

Confidentiality toolkit: smart routing across cryptoid (Hugo encryption), pagevault (HTML/file encryption), and gpg (file encryption/signing)

1 skill

A security audit role for the plugin family. /security-workflows:scan runs Anthropic's Claude Security plugin on the branch a PRD or Epic was implemented on, before it merges, or on a whole repository, and records what it finds in the specs repository: a findings register per code repository, matched across scans by Claude Security's own finding ID, with every finding triaged in one batch — fix, decide later, false positive with its evidence, or an accepted risk with an owner and a review-by date. A Dev's decisions take effect at once and a Security Engineer reviews them afterwards. A fix goes to /dev-workflows:implement as a follow-up carrying Claude Security's verified patch, and is closed only once a later covering scan no longer reports it. Installs workflows-core and Claude Security with it.

1 command

Core security guards (git, install, security) and SOLID enforcement hooks for Codex CLI

hooks

Pre-adoption security audit of a repository, package, MCP server or script: nine adaptive phases, a terminal verdict and a full report with file:line evidence. Vendored unchanged from Millon15/cc-millz.

1 command

Upstream: Cloudflare (cloudflare/security-audit-skill). Multi-phase security audits with independently verified findings.

1 skill