Security plugins

All seven governance-first AI compliance skills in one install: EU AI Act classification, NIST AI RMF checkpoints, ISO 42001 audit prep, HITL gating, PII exposure checks, incident response logging, and AI transparency writing.

7 skills

Threat model a service, review changes against it, audit secrets, gate a release. Read-only by design.

6 skills · hooks

Investigation playbooks for the WhisperGraph MCP connector: indicator triage that reads coverage before it reports a verdict, bulk triage over a SIEM export, Cypher that passes the server's validator, and brand-protection sweeps. Requires the WhisperGraph connector — add it once and sign in, or run /whisper-setup.

4 skills · 1 command · 1 agent

Security & compliance auditor with HIPAA/GDPR/PCI DSS/PIPEDA/CCPA/SOC 2 scanning

6 skills

Gemara compliance pipeline and policy generation via MCP server

6 skills

Dtwo MCP gateway management — bundles the Dtwo MCP server and skills for managing gateway configs, deploys, and policies

5 skills · 1 MCP server

Checkmarx-powered security scanning and fixing inside your coding loop. Checks the code you write and the code AI generates for vulnerabilities and risky dependencies, then returns precise, engine-backed fixes. Best invoked after writing or changing code, before commits, and around security-sensitive logic. Applies fixes inline so you can accept them without leaving your editor.

4 skills · 1 MCP server · hooks

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

1 skill · 3 commands · 1 agent

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

Catch API security issues during development: audit, scan, remediate, validate with AI guardrails in Claude Code.

5 skills

仅清理 Claude Code 本地账号相关性敏感信息与遥测痕迹，默认保留会话历史和项目用量字段；先盘点、干跑、确认，再由用户在退出所有 Claude Code 后从普通终端执行，可选剥离用量、退出登录、关闭云会话与遥测。

5 skills

Automated threat modeling for Claude Code. Runs security assessments via subagents when you approve implementation plans.

3 skills · hooks

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

Claude Code security skills with MCP servers — web technology fingerprinting via WhatWeb and OSINT domain intelligence via theHarvester (Model Context Protocol)

2 skills · 2 MCP servers

See what this machine's agents have installed, check it against a lock, and read Small Print's record. The check sends nothing anywhere.

3 skills · 1 MCP server

Skills auditoria-seguranca, auditoria-legal e auditoria-site, mais o subagente auditoria-executor pra parte braçal.

3 skills · 1 agent

Dependency security — intercepts package install commands to enforce latest versions and block vulnerable packages. Supports npm, yarn, pnpm, bun, pip, and composer.

1 skill · 2 commands · hooks

Memory poisoning guardrails for agent memory, retrieval, tool results, and gateway traffic.

1 skill · 2 commands

Install WebDecoy into your app and ask about your sites' bot traffic and protection, through WebDecoy's hosted MCP server.

1 skill · 1 command · 1 MCP server

Clover's security assistant for developers. Kick off a security/design review on the change you are working on, get security feedback on a design review (by its link), and read back the reviews you have access to — answered in natural language.

1 skill · 1 MCP server · hooks

Intercept and securely store secrets pasted in chat, auto-redact from session logs

1 skill · 1 command · hooks

Безопасность по OWASP Top 10 2025 при реализации + защитный Mythos-style security review через /ry-sec-review slash command.

2 skills · 1 command

Record and gate every tool call Claude Code makes, with signed receipts anyone can verify.

1 skill · 1 MCP server · hooks

Operate servers from Claude Code without giving it a shell: the opsgate MCP server (typed, policy-checked, audited tools), a server-ops skill, and a read-only /opsgate:health-check command.

1 skill · 1 command · 1 MCP server

Marrow's approval hooks, MCP server and skill, pinned to @getmarrow/mcp 3.9.109, with the free keyless seatbelt. No account or key is needed to install.

1 skill · 1 MCP server · hooks

Validates a plugin against marketplace-patterns rules using Socratic dialogue. Spawns a scanner, asks targeted questions, writes a structured TODO file and inline summary.

1 skill · 1 command · 1 agent

Paste a credential into a system popup, store it in macOS Keychain, then reference it by name from any command. The value never enters Claude's context window.

1 skill · hooks

Risky-shell interceptor (PreToolUse hook) and step-up MFA audit MCP server

1 skill · 1 MCP server

Security audit for apps built with AI — the app you ship and the pipeline that built it — plus vibe-lint, the handoff pass on the same generated code.

2 skills

Run Sighthound, a fast tree-sitter SAST scanner with pattern matching and taint-flow analysis

2 skills