Security plugins

Evidence-required skill, independent fact-checking agent, hook against invented packages (npm, PyPI, crates.io) and Stop hook against unverified success claims.

1 skill · 1 agent · hooks

Security-focused SKILL.md skills for AI coding agents — vet, implement, and audit before shipping

3 skills

Beta: ISO 27001 audit-prep reviewer that has ISMS Copilot challenge its findings and returns a verified change list.

1 skill · 1 agent · 1 MCP server

Bloqueia segredos em prompts e arquivos e lê Notion, planilhas e documentos com os dados trocados por marcadores.

1 skill · 1 MCP server · hooks

Checks prompts, tool calls and git pushes in Claude Code against your organization's Paradigm Networks security policy, and blocks risky actions like destructive commands or unsafe code. Requires a Paradigm Networks account.

2 skills · hooks

AI-powered security analysis — threat modeling, implementation assessment, and PR security review

2 skills · 1 MCP server

Security toolkit: vet plugins/skills before install (vet-plugin) and audit code for race conditions and concurrency bugs (race-cond). Use before installing third-party agent extensions or when reviewing concurrent code.

2 skills

Security, governance, and analytics for Claude Code — powered by Unbound AI.

1 skill · hooks

Gibson for Claude Code: the session is a live mission. Memory, knowledge, findings, tools, delegation. Your Claude subscription pays for the model.

1 MCP server · hooks

Strips AI-assistant attribution from commits and PRs, and blocks configurable sensitive terms from leaking. Auto-activates everywhere except your trusted private remotes.

1 command · hooks

Interactive NIST CSF 2.0 self-assessment producing a scored report with radar chart, mitigations, and where to get help (WaTech, WA CIRT, MS-ISAC).

1 skill · 1 command

Scan npm, PyPI, and Maven packages for supply-chain risk and known vulnerabilities before you install them, via the live PackageSafe scanning service.

1 skill · 1 MCP server

Screen a repository's agent-facing instructions before connecting an agent, installing its MCP server, or following its setup steps.

1 skill · 1 MCP server

Production-safety audits for AI-generated code, with a fix for every finding. Connects the nittim MCP server and adds the free nittim-loop self-review skill. Auto mode users: see "Using Claude Code's auto mode?" in the README.

1 skill · 1 MCP server

Retrieve secrets (API keys, DB passwords, tokens) through Stillvault — human-approved and vendor-blind — instead of hardcoding, pasting, or reading them from plaintext.

2 skills

ソースコード診断（OWASP ASVS 5.0 基準の SAST）と、OWASP ZAP・ブラウザ操作によるグレーボックス DAST の2つの Skill を提供する Claude Code プラグイン。

2 skills

Keeps plaintext credentials out of transcripts, out of files, and out of GitHub.

1 command · hooks

Zero-dependency MCP server + PreToolUse hook that lets an agent read and edit .env files through a length-preserving, blurred view — secrets never leave the file. Blocks raw .env access via Read/Edit/Write/Grep/Glob/Bash.

1 MCP server · hooks

Decompile Android APK/JAR/AAR with jadx, trace call flows through libraries, and document extracted APIs.

1 skill · 1 command

Analyze repositories for NIST 800-53 Rev5 compliance controls and push structured findings to RF-O

1 skill · 1 MCP server

Modular email OTP extraction plugin: fetches one-time passwords from email inboxes via IMAP with pluggable providers (Gmail, iCloud, Outlook) and service-specific templates (Bitwarden, GitHub, Google, AWS, etc.)

1 skill · 1 command

Detects LLM safety triggers and pinpoints minimal refusal text.

1 MCP server · hooks

Ask questions about DefectDojo findings, products, and security posture in plain language, then work the triage queue: close, verify, mark false positive, risk accept, tag, and annotate findings with a confirmation step before any write. Requires DefectDojo Pro.

2 skills

Import scanner output and SBOMs into DefectDojo Pro with automatic product and engagement creation, correct import versus reimport handling, and background-import polling. Also wires scan upload into CI pipelines. Requires DefectDojo Pro.

2 skills

Reach 1Password secrets behind a Touch ID gate on every use, and keep secret values out of the model transcript.

1 skill · hooks

Remote 1Password secret access with Telegram approval for AI agents

1 skill · 1 MCP server

Audit an AI-agent skill/plugin for supply-chain attacks before it runs (PASS/REVIEW/BLOCK), via the in-repo skillsentry CLI. Detection stays in the deterministic CLI, never the agent context.

1 skill · 1 command

Three defense-in-depth hooks: credential value scrub (PostToolUse), admission keyword reminder (UserPromptSubmit), bash command guard (PreToolUse). Built after repeated credential leak incidents — structural fix when behavioral rules in CLAUDE.md keep failing.

1 skill · hooks

Android APK / XAPK / JAR / AAR decompilation with jadx and Fernflower/Vineflower. Extract HTTP API endpoints (Retrofit, OkHttp, Volley), trace call flows from UI to network, locate compile-time feature gates. Optional Androguard integration for programmatic call-graph and cross-reference analysis. Adopted from SimoneAvogadro/android-reverse-engineering-skill under Apache 2.0.

1 skill · 1 command

Comprehensive security audit against OWASP Top 10, CWE, NIST 800-53, CIS Benchmarks, SOC 2, ISO 27001

1 command · 1 agent