Security plugins

Deprecated: agentguard is now okgate. Install okgate@agentwares instead; this entry keeps the same skills under /agentguard:* until at least 2027-01-15.

4 skills

Skills auditoria-seguranca, auditoria-legal e auditoria-site, mais o subagente auditoria-executor pra parte braçal.

3 skills · 1 agent

The forgebench Claude Code plugin.

2 skills · 1 MCP server · hooks

Scan and triage, secure CI pipeline, STRIDE threat modeling, and a hands-on AppSec tutor.

4 skills

The secure-launch front door: maps a repo's attack surface (routes, auth, outbound fetches, paid APIs and their spend caps, secrets by name, data stores, deploy targets), runs every applicable check in the suite, and writes one findings ledger where each check is PASS, FAIL or UNKNOWN. Required by every other secure-launch plugin.

3 skills · 1 command

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

XSS prevention, CSRF protection, content security policies, mobile app security, and secure storage patterns

1 command · 3 agents

Settles whether suspected security findings tied to a code location are real: restates each claim, traces source to sink, proves or refutes attacker control and impact, writes PoCs outside the repo without running them, and passes six gates before a TRUE or FALSE POSITIVE verdict. Takes scanner output, review findings or a pasted GitHub code-scanning alert.

1 skill · 3 agents

Approval guard for remote/cloud commands with read/write classification and a /unguard session bypass.

2 commands · hooks

Data-readiness + posture on your vCISO Lite data, with risk-intelligence workflows layering on as they ship.

2 commands · 1 MCP server

Pins content hashes for installed plugins at lock time and flags silent drift before it runs.

1 skill · 1 command · hooks

Security-focused SKILL.md skills for AI coding agents — vet, implement, and audit before shipping

3 skills

Security scanner for Claude Code plugins - analyzes hooks, MCP servers, scripts, and prompts for potential risks

1 skill · 1 command · 1 agent

Scan JS/Node, Java and PHP/MySQL projects for security vulnerabilities. Generates structured reports and interactive fix plans.

3 commands

Lokale De-Identifizierung von TXT-, Markdown-, CSV-, DOCX-, XLSX- und PPTX-Geschäftsdokumenten, bevor Claude deren bereinigten Markdown-Text verarbeitet; PDF, Scan-PDF und Bilder bleiben im Cowork-Pilot gesperrt.

2 skills · 1 MCP server

Fail-closed Atbash safety judgments plus browser-approved local onboarding and agent management for Claude Code.

2 skills · hooks

Regulatory compliance auditing tools for code and documentation review

2 commands · 1 agent

AstraSync agent identity + Local Guard: PreToolUse policy hooks (PDLSS spend/scope/purpose limits) and the hosted AstraSync MCP connector for registration, verification, and agent commerce.

1 skill · 1 MCP server · hooks

Pause an agent at a sensitive step, push to the approver's phone for biometric approval, and return a PKI-signed attestation. Bundles the iVALT MCP server and the iv-auth skill.

1 skill · 1 command · 1 MCP server

Flags plaintext secrets in the files Claude writes and can hold back a git-sync checkpoint that carries one. Bring your own TypeSafe API key.

2 commands · hooks

Phoenix Purple security scanning and remediation guidance: /purple-scan (9 scan domains + per-finding fix guidance), /purple-graph-navigator (call graph, entry points, blast radius) and /purple-dev-flow (index-then-scan developer loop).

3 skills

Connect Claude Code to a DefectDojo Pro instance. Wires the built-in MCP server, stores API credentials once, provides the dd-api REST bridge used by every other DefectDojo skill, and diagnoses broken connections. Requires DefectDojo Pro.

1 skill · 1 MCP server · hooks

Blocks commits to protected branches, asks before irreversible deletes, flags prompt injection in content the model reads or writes, and can require a governing document be read before a directory is written. Enforced automatically in both Claude Code and Codex.

2 skills · hooks

ASK (Agent Security Framework) compliance reviewer, architecture designer, and threat analyst — ASK 2026.03. Three skills: ask-review (25-tenet compliance audit, cognitive model verification, trust spectrum assessment), ask-design (enforcement layer architecture, configuration generation for Mind/Gateway/Egress/Enforcer/Delegation/Audit), and ask-threats (threat model analysis, XPIA kill chain posture, attack surface assessment across traditional/novel/hybrid threat categories).

3 skills

Clover's security assistant for developers. Kick off a security/design review on the change you are working on, get security feedback on a design review (by its link), and read back the reviews you have access to — answered in natural language.

1 skill · 1 MCP server · hooks

Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.

3 skills

Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.

3 skills

Automatically guards supported Codex tool calls with Atbash safety judgments and provides secure local setup guidance.

2 skills · hooks

Connects Passport and turns on its guard for the shell commands your agent runs.

1 skill · 1 MCP server · hooks

Generate an executive Wiz Tenant Health Assessment deck (offline PDF) and metrics CSV from live tenant telemetry.

3 skills