Security plugins

General-purpose reverse engineering toolkit. Decompiles, disassembles, and maps binaries, scripts, and applications across all languages.

1 skill · 1 agent

SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation

1 command · 1 agent

Audit and harden any Flutter app from source code or built APK. Security scoring, secret protection, SSL pinning, obfuscation verification, tamper detection, and auto-fix mode.

1 skill · 1 command

Безопасная реализация и defensive review. EN: OWASP and security review skills.

2 skills

Check a website's HTTP security headers with the OpenComply CLI: grade A+ to F, platform-aware fixes and the path to a higher grade.

1 skill · hooks

Advisory Marrow: the Marrow MCP server (pinned @getmarrow/mcp 3.9.107) and a short skill, with no hooks. Marrow sees an action only when the agent calls a marrow_* tool, so nothing is held or enforced.

1 skill · 1 MCP server

Fast, free, first-pass security smell test. Point a tiny local LLM (antares-1b, a ~2GB Granite-4.0 fine-tune) at a folder to get cheap vulnerability leads across a codebase in seconds — before a deeper audit. A triage aid, NOT a substitute for Semgrep, CodeQL, or Bandit.

2 skills

AI Agent harness for MITRE EMB3D Threat Modeling framework.

1 MCP server

Thirteen PreToolUse hooks that block the specific things a coding agent gets wrong in a real codebase.

hooks

Real-time policy enforcement and tamper-evident audit for tool calls (MCP and built-in) in a Claude Code session. Forwards every tool call to a local Aegis app for cloud-managed deny rules and persistent audit logging. Fails open if the local app is unreachable.

hooks

Encrypt secrets inline in config and env files with ENC[...] markers (local NaCl keypair or GCP/AWS/Azure KMS). Bundles a setup skill for coding agents.

1 skill

Query Corgea scans, security issues, SCA and IaC findings, dependencies, and blocking rules over MCP

1 skill

Scan code with Corgea's AI-powered BLAST scanner and apply the AI-generated fixes

1 skill

Scans repositories for secrets, code quality issues, missing documentation, and compliance problems before making them public

1 skill

Automated penetration testing for web applications. Identifies OWASP Top 10 vulnerabilities and suggests remediation.

1 skill

Draft EU AI Act Article 13 transparency disclosures, user-facing AI notices, and model cards.

1 skill

Classify an AI system's risk tier under the EU AI Act and surface the legal obligations that apply.

1 skill

Scan staged changes or commits for sensitive data before pushing to remote.

1 skill

Audits project dependencies for unpinned versions, deprecated packages, missing lockfiles, and known CVEs.

1 skill

Structured security audit covering injection, auth, secrets, input validation, dependencies, and cryptography. Produces severity-graded findings.

1 skill

On-device guardrails for Claude Code: PreToolUse, PostToolUse and UserPromptSubmit hooks that scan for secrets, PII, prompt injection and exfiltration.

hooks

Local stdio MCP server for pre-action decision verification. Hero tools verify_before_action / verify_decision: mandate + proposed action → ALLOW/BLOCK/UNCERTAIN; execute only on ALLOW. Fail-closed on missing key, timeout, or non-ALLOW. Catalog score is not next-action authorization.

1 MCP server

Protect secrets and credentials: block writes to .env files, detect API keys in commands, prevent hardcoded tokens, guard service account files.

hooks

Recommend and install an approval-gated Codex hook that blocks Git verification and signing bypasses.

1 skill

Ask AgathOS before you trust something: check text and files for hidden instructions, orders to copy an AI and install traps, and ask whether a step is safe. Only reads and asks.

1 skill

Audit a Supabase project's row level security with one read-only SQL file. Every check is tested against a real PostgreSQL.

1 skill

Read-only repository audit: severity-ranked findings report for a local checkout.

1 skill

Hides secrets before the model sees them in Claude Code.

1 command

SSH — key management, port forwarding, tunneling, file transfers, config best practices

SSL/TLS certificates — Let's Encrypt, certbot, auto-renewal, wildcard, Cloudflare SSL