Security plugins

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Security review for Claude-generated code: pattern-based warnings on edits, LLM-powered diff review on stop, and an agentic commit reviewer catching injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

損害控制安全系統 - 透過 PreToolUse 鉤子封鎖危險指令並保護敏感檔案

1 skill

Security guidance hooks for safer coding practices

hooks

Security audit and vulnerability scanner for AI agent skills. Scans for malicious code, prompt injection, data exfiltration, supply chain risks, and privilege escalation before installation. Zero dependencies, PASS/WARN/FAIL verdicts with remediation guidance.

1 skill

Whitebox/static security workflows for source code, JavaScript, TypeScript, Next.js, Node.js, Fastify, config, dependencies, supply-chain risk, containers, IaC, threat modeling, scanner-output review, finding normalization, and hardening gates.

1 skill

Blackbox/dynamic security workflows for authorized runtime targets, JavaScript web apps, Next.js, Node.js, active surface scans, API and web probing, TLS checks, fuzzing, pentest reports, finding normalization, and hardening gates.

1 skill

Web application security testing via the OWASP Web Security Testing Guide (WSTG) — 12 categories, ~109 test cases. Four modes: guide a pentest, self-review your app, build/score a coverage checklist, review a diff against WSTG. Mode 2 carries a systematic whole-codebase audit protocol. Methodology from OWASP/wstg. Authorized/defensive use only.

1 skill

High-confidence security review of a diff, layered on wstg-security-testing. Confidence gate, false-positive precedents, WSTG-ID mapping, and a dependency audit. Reports only concretely exploitable findings.

1 skill

Secure coding applied pragmatically, prevention first: the secure-by-design mindset (Saltzer and Schroeder), the OWASP Proactive Controls 2024 as the what-to-do-while-coding checklist, the OWASP Top 10:2025 as the risk catalogue to recognise and prevent, ASVS 5.0.0 as the verification standard, and concrete practices for access control, authentication, input handling and injection, cryptography and secrets, configuration, dependencies and the supply chain, exceptional conditions, logging, and SSRF, with TypeScript specifics. Composable with your own conventions.

1 skill

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Essential Auth0 skills including quickstarts, migration from other providers, and Multi-Factor Authentication (MFA).

1 skill

Essential Auth0 skills including quickstarts, migration from other providers, and Multi-Factor Authentication (MFA).

1 skill

Security reminder hook that warns about potential security issues when editing files, including command injection, XSS, and unsafe code patterns

hooks

Audit AI tool usage against Databricks security policies (go/llmpolicy, go/entaitools, AUP). Scans Claude and Cursor sessions for policy violations, checks settings, processes, and generates compliance reports.

1 skill

Security reminder hook that warns about potential security issues when editing files, including command injection, XSS, and unsafe code patterns

hooks

Security reviewer for AI-generated and vibe-coded apps — hunts the hardcoded secrets, broken row-level security, and prompt-injection sinks that coding assistants ship by default, then drives a scan, fix, and rescan loop with honest, CWE-mapped findings.

1 agent

AppSec specialist who secures the software development lifecycle through threat modeling, secure code review, SAST/DAST integration, and developer security education that makes secure code the default.

1 agent

Expert security architect specializing in threat modeling, secure-by-design architecture, trust-boundary analysis, defense-in-depth, and risk-based security reviews across web, API, cloud-native, and distributed systems. Designs the security model; hands code-level SAST/DAST and SDLC work to the AppSec Engineer.

1 agent

A consent-based static audit helper for local AI tool integrations on Windows.

1 skill

Security review for PHP, Laravel and Symfony code.

1 skill

Collect API keys and tokens through a masked dialog the agent cannot read, and hand them to scripts without exposing them — no secret ever pasted into the chat

1 skill

Multi-phase security analysis with exploit PoCs and remediation plans

1 skill

Analyze domains, hunt lookalikes and search certificate transparency; triage your organization's detections and alerts, and manage its domains, rules and takedowns.

1 MCP server

Give coding agents your databases, APIs, and env vars without the values landing in the transcript. The agent loads a credential into the environment of the command it runs, and never sees the value.

1 skill

Write and review GitHub Actions workflows, reusable workflows and composite actions so that text, code and artifacts from forks, issues and comments cannot reach the token and the secrets. Covers expression injection, privileged triggers such as pull_request_target and workflow_run, least-privilege permissions, actions pinned to a commit SHA, secrets and OIDC, caches, self-hosted runners and language-model steps. Includes a review mode mapped to the OWASP Top 10 CI/CD Security Risks.

1 skill

Write and review application code in Java, Kotlin, C#, Python and TypeScript with rules for the risks in the OWASP Top 10, the OWASP API Security Top 10 and the OWASP Top 10 for LLM Applications: access checks per object and tenant, safe queries and paths, no type names from input, no secrets or fødselsnummer in logs, Maskinporten and ID-porten tokens, and language-model features. Keeps answers in proportion: no new dependencies or invented helpers, minimal fixes, tests that fail without the control, and no findings for safe code.

1 skill

Write and review Dockerfiles, Helm charts and Kubernetes or OpenShift manifests with rules for the risks in the OWASP Top 10 and the OWASP Kubernetes Top 10: images that run as a user that is not root and with a random user ID, pinned base images, no secrets in layers, a restricted security context, no host access, secrets from Secret objects, least-privilege RBAC, and oc and kubectl commands that do not show secrets or change the cluster. Keeps answers in proportion: minimal fixes, no invented tags, paths or user IDs, and no findings for safe settings.

1 skill

Refuse git commands that carry credentials in a URL, and remind the agent that every pull request needs its review panel at the exact head.

hooks

Get secrets from a human through a one-time link over Tailscale, so the value never enters the chat.

1 skill