Claude Code and Codex plugins their authors filed under "security". All categories.
Conduct systematic security threat model assessments by analyzing code against countermeasurement requirements and generating compliance documentation with optional JIRA integration
1 command
Stops secrets from leaking before they are written, printed or committed to git.
Lets Claude write files that contain secrets: the write holds, you paste each value into a masked prompt, and the values never enter the chat.
754 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 5 frameworks.
200 skills
57 skills covering Harness CI/CD, Traceable API security, and Harness SAST and SCA.
57 skills
Recon-to-report offensive security: 11 skills, 13 commands, 7 agents, deterministic scope safety, and hunt memory.
12 skills · 13 commands · 7 agents · hooks
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
Inject and audit 1Password secrets via the op CLI: op:// references with op run/op inject, an always-ask permission gate, and an opt-in deny-capable PreToolUse audit hook. Use for API keys, tokens, credentials, .env secrets, OP_SERVICE_ACCOUNT_TOKEN, or 1Password.
24 skills
Pull and analyse Bitsight Security Ratings inside Claude — board packs, vendor briefs, remediation roadmaps, CVE sweeps, framework evidence and regulatory incident notifications for India, the US and the EU.
20 skills · 1 MCP server
Threat intelligence workflows powered by mlab.sh: IOC triage, SBOM vulnerability audits, threat actor profiling and phishing/smishing analysis. Includes local supply-chain skills built on postmortem and a static code audit skill built on inkdex.
19 skills · 1 MCP server
Install, verify and drive the REACHABLE local runtime from Claude Code. Adds the reachable MCP server and the reachable: setup / doctor / status skills.
15 skills · 1 MCP server · hooks
Control, audit, and cost-optimize every Claude Code tool call. Governance hook + bundled ACP MCP (cost X-ray, run traces, policy checks) + /cost-xray pre-ship report.
4 skills · 12 commands · hooks
Arcjet is the runtime security platform that ships in your AI code. Detect prompt injection, authorize agent tool calls, redact sensitive data, and block bots and abuse. Real-time security building blocks you call inside your app, before an action happens.
14 skills · 1 agent · 1 MCP server
Engineering standards as fourteen on-demand skills: auth, API, browser and LLM security; encryption; cloud infrastructure and cost; stack selection; observability; document artifacts; breach response; verification methods; engagement close-out; public release; feature flags. Plus devagent-guard hooks enforcing the toolchain rules (deny or ask).
14 skills · hooks
Ask Clover about your application's security posture from inside your coding agent. Run security reviews, surface threats and required controls, and design securely, answered in natural language.
12 skills · 1 MCP server · hooks
CyberRiskGuardian Core (Community Edition, free) - scenario-driven cybersecurity risk assessment, steps 1-11 of the 19-step CRG method: context and evidence intake, risk appetite, scenario generation (at least twenty candidates, typically 25-40), screening and selection, validated CRG quantification with CVSS v4.0, a quick scan and a management summary, with the label check for the three standard markers (book v2.51b).
6 skills · 6 commands · 2 agents
Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.
6 skills · 1 command · 5 agents · hooks
Ship secure code at agent speed. Clover silently reviews every plan, surfaces missing security requirements, and folds them into the work before a single line is written — no questions, no detours.
13 skills
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.
11 skills · hooks
Security and code-quality guardrails for any stack. Three skills, seven commands, two read-only review agents.
3 skills · 7 commands · 2 agents
Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.
1 command · 9 agents · hooks
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.
10 skills · hooks
Dregs fraud and abuse detection integration. Investigate scored identities and their linked accounts, review and triage escalations, and tune badge and escalation rules against your own data. Connects over OAuth: run /mcp after installing.
10 skills · 1 MCP server
Context-aware Guard integration for Claude Code sessions in pnpm and GitHub repositories.
6 skills · 3 agents · hooks
Eight skills that check, build and watch your app and run on their own: readiness audit, monitoring and alerts, API security, Zero Trust, skeleton loading, motion sites, build-flow map, session journal. Includes autopilot hooks.
9 skills · hooks
Connect Claude to Intelligo for risk intelligence — background checks, credit checks, and adverse-media and social screening across your projects, profiles, and reports.
8 skills · 1 MCP server
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
1 skill · 7 agents · hooks
Authorized infrastructure security scanning plugin. Runs Infrastructure-as-Code misconfiguration detection (Dockerfile, Terraform, Kubernetes, GitHub Actions), CycloneDX SBOM generation, and optional network port + TLS scanning. Optional --fix opens a draft PR for the single top mechanically-fixable finding (Terraform/Kubernetes config flags, GitHub Action SHA-pinning) without ever modifying your working tree. Companion to pentest-agent for users who want infra coverage alongside web-application pentesting. Requires explicit --authorized flag.
1 command · 6 agents · hooks
Security research and vulnerability discovery skills from GitHub Security Lab. First topic: fuzzing campaigns for C/C++, Java and JavaScript/TypeScript.
8 skills