Security plugins

Blocks known-malicious and typosquatted package installs before Claude runs them, and warns on known advisories for an exact pinned version.

hooks

Security — Writing secure code, auditing it, and protecting the supply chain around it.

137 skills

AI-powered smart contract security auditor for Claude Code — vuln detection, exploit PoCs, mainnet-fork sims, audit cards, on-chain certificates.

52 skills · 45 commands · 23 agents · 13 MCP servers · hooks

Security vulnerability detection and remediation: OWASP Top 10 2025, SAST scanning, CVE research (NVD, OSV.dev), dependency audit, secrets detection, security headers, auth patterns audit

6 skills · 1 command · 1 agent · hooks

Permission enforcement for Claude Code tool usage with policy-based rules, hierarchical settings, and optional kernel-enforced sandboxing via Landlock/seccomp (Linux) and Seatbelt (macOS)

hooks

Security vulnerability detection and remediation: OWASP Top 10 2025, SAST scanning, CVE research (NVD, OSV.dev), dependency audit, secrets detection, security headers, auth patterns audit

5 skills · 1 command · 1 agent · hooks

Read-only scan of a git repository (working tree and full history) for session links, home paths, e-mail addresses and internal names before it goes public. Python standard library and git only.

1 skill

Supply-chain security plugin for research software. 2 agents (lead expert + incident responder), 5 commands (audit, incident, lockfile-check, pin-actions, harden-workflow), 6 skills covering hardened CI/CD, dependency security, threat awareness, SBOM/provenance, incident response, and ecosystem-specific quirks (npm, PyPI, conda/pixi, cargo, Go). Covers 2025-2026 campaigns: Shai-Hulud, TeamPCP, axios, LiteLLM .pth persistence.

6 skills · 5 commands · 2 agents

Auto-approves safe commands, blocks dangerous ones, prompts for the rest

1 skill · 2 commands · hooks

Audit de sécurité — secret scanning, CVE deps, contrôle d'anonymisation, analyse de patterns.

Security guardrails - credential protection, destructive command blocking, write scope enforcement, supply chain control, browser restrictions

2 skills · hooks

Host-side gauntlet for fetching, scanning, and sanitizing untrusted repositories before any agent, editor, or toolchain opens them.

1 skill

Codex Security workflows for security scans, analysis, and investigation.

10 skills · 1 MCP server · app connector

Solidity static analysis with security skills for auditing and secure development

9 skills · 1 MCP server

Security guardrails for Claude Code — intercepts every tool call and enforces passport-based policies before execution.

3 skills · hooks

Senior security engineer instincts for AI coding agents. Find vulnerabilities. Ship secure.

2 skills · 1 agent

Sixteen toggleable guards. Blocks: secret writes, machine paths, git hook bypass, force-push, reset --hard, open-review merges, cross-domain paths, PR-fix requests, drive-root /tmp writes, exported MSYS_NO_PATHCONV, cd && git, root/out-of-tree recursive deletes, shell-expanded commit -m, off-convention commit/PR titles; off by default, credential reads. Warns: Workflow fan-out, direct gh pr create. Git hooks check commit subjects, secrets, paths, CLI flags, skill refs and removed paths.

1 skill · hooks

Assess security and compliance posture, query audit logs, and manage CloudTrail for Volcengine accounts and resources.

2 skills

Replay a verdict bundle with the pinned agent-evidence-verify after any tool names one, and block on tamper or a decision you did not allow.

1 command · hooks

183+ pentesting and OSINT tools (nmap, nuclei, amass, subfinder, httpx, sherlock, maigret, trufflehog, sqlmap, impacket, and more) wired into Claude Code. Runs locally on any OS via native Bash, WSL, or purpose-built Docker images — Claude picks the right backend and image automatically.

1 skill

Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.

1 MCP server · hooks

Four-agent application security pipeline for Spectra Assure. rl-appsec-assessor scans dependencies and writes a remediation plan; rl-appsec-triager verifies findings against NVD, OSV.dev, and GitHub Advisory; rl-appsec-investigator analyses malware exposure; rl-appsec-remediator implements fixes with a re-scan gate and runs tests. Includes the Claude Code report bridge (MCP server) so finding actions in the HTML report reach a live Claude session.

4 agents · 1 MCP server

Single-command supply chain security audit skill. Runs the full rl-appsec pipeline — assessor, triager, investigator, remediator — in sequence with phase gates and full transparency, then optionally opens the interactive report (rl-protect-run-report) for click-to-triage review. Requires rl-appsec-agent.

1 skill

Connects rl-protect to a Spectra Assure Community or Enterprise Portal account. Use when setting up rl-protect, adding or updating a server connection, or providing an API token.

1 skill

Puts a fast calibrated classifier at the harness boundaries: hands Claude a note about a risky tool call, denies the two block-grade cases once with a reason Claude can answer, flags tool results that read like prompt injection, and catches a turn that stops short of the work it was asked to do. Advisory to the agent and fail-open; a command that matches a hard rule (rm -rf ~, a force push to main, turning the plugin off) asks you instead.

1 skill · 6 commands · 1 MCP server · hooks

Checklist-driven security analysis: quick scans, full framework assessments, and single-check deep dives against 845 checks across 39 DeFi verticals, derived from 4,500+ real Solodit audit findings. Provides /krait:scan, /krait:assess and /krait:check.

3 skills

Security companion, full-project audit, and context-aware triage. Finds the smallest diff that breaks the attack chain; applies nothing.

5 skills · 1 agent

Offline AI/LLM security scanner as a skill plus MCP server.

38 skills · 1 MCP server

Pentest AI agents: 23 hunt-agent skills, a 4-arm detection engine, a 24-gate validation lab, and the FP + Negative-Result gates that stop false findings in both directions. Field-validated against AgentDojo, DVMCP, DVLA, InjecAgent and a live CTF.

24 skills · 5 commands

Assess security and compliance posture, query audit logs, and manage CloudTrail for Volcengine accounts and resources.

2 skills