Security plugins

Prompt before foreground polling/watching (gh run watch, tail -f, sleep-loops) and before known-slow commands run with an inadequate timeout.

1 skill · 1 command · hooks

Agent skills that add deception, detection and auditing to your own application, in its own code, reporting through OpenTelemetry.

3 skills

Block mutating kubectl/helm/terraform/gcloud/aws/az/docker commands aimed at production; prompt when they rely on clobber-prone ambient context.

1 command · hooks

The official GitGuardian plugin for AI coding agents. Detects 700+ hardcoded secret types across files, git history, Docker images, and PyPI packages via the ggshield CLI; plants AWS honeytoken tripwires for the leaks scanning can't catch; and surfaces live incidents in your editor via the bundled GitGuardian Developer MCP server.

6 skills · 1 MCP server

Skills that drive the ZIRAN CLI and explain its findings: audit-agents, triage-findings, set-up-scan, threat-model-agent.

4 skills

Find and patch vulnerable PHP, Node.js and self-managed GitLab runtimes across your repos. Read-only inventory first, explicit approval before edits, regression tests before and after, one focused PR per repo.

3 skills

Arnica security skills: API reference and code-finding triage. Use when calling the Arnica API or reviewing, triaging, fixing, or dismissing Arnica security findings.

2 skills

Jailbreak regression benchmark for LLM endpoints with repeatable known-pattern attacks and deterministic scoring

1 skill

Vets Claude Code skills, plugins and AI tools before you install them, and finds the ones that suit your work.

1 skill

Security hardening skills — GitHub Actions pipeline hardening and CI security.

1 skill

Security hardening skills — GitHub Actions pipeline hardening and CI security.

1 skill

PII mask/unmask proxy control plane for Claude Code: launches the local masking reverse-proxy, wires routing, and adds /sordino:enable, :disable, and :privacy.

11 commands · hooks

Finds supply-chain droppers committed directly into a repository — the kind npm audit cannot see because there is no malicious dependency. Scans a clone or every repo you can reach, removes the payload including from history, and helps warn collaborators.

1 skill · hooks

Hybrid security scanner: deterministic SAST tools (Semgrep, Gitleaks, Trivy) for detection, LLM for triage. Includes baselining, project profiles, suppressions, focused remediation, provenance-labeled findings, and zero-dependency fallback mode.

14 skills · 1 agent · hooks

Varsel CNA point-of-contact skills: file and verify CVEs as Varsel cases through the Varsel MCP.

7 skills

Scan all dependencies for outdated versions and known vulnerabilities. Uses npm audit, pip-audit, cargo audit, and bundler-audit with grep-based fallbacks. Read-only report.

1 skill

Scan a codebase for OWASP Top-10 vulnerabilities, hardcoded secrets, insecure dependencies, and unsafe patterns. Read-only report ranked by severity.

1 skill

Auto-allows low-risk bash commands in Claude Code using bash-classify

hooks

Protect secrets and credentials: block writes to .env files, detect API keys in commands, prevent hardcoded tokens, guard service account files.

hooks

Run borderlint before adding any AI SDK, endpoint, or model id — residency, sovereignty, and provenance checked in the conversation, before commit.

1 skill

Security auditing and best practices enforcement for Genkit applications including input validation, prompt injection detection, and secure deployment

Secure API key and secrets management for Genkit - Google Secret Manager, AWS Secrets, HashiCorp Vault integration

Authentication and authorization for Genkit flows - Firebase Auth, OAuth, JWT, and API key management

Analyze authorized IPA, .app, Mach-O, framework, dylib, and dSYM artifacts and optionally enrich Mach-O analysis with IDA Pro MCP.

DStack workflows for security review, vulnerability triage, and defensive implementation.

16 skills

AI Agent Security Analysis - scan, fix, analyze, and report on AI agent vulnerabilities using OWASP LLM Top 10

9 commands · 1 MCP server

Red-team your AI agents with automated adversarial campaigns — jailbreaks, prompt injection, data extraction, social engineering, compliance reports

7 skills · 1 MCP server

Trent, an AI security engineer. Review code, plans and configs for security problems, run threat models over a repo or website, and track remediation without leaving the editor.

4 skills · 2 MCP servers

DStack workflows for fuzz harnesses, fuzzer setup, sanitizers, and coverage analysis.

4 skills

Audit hub — personal overrides for upstream audit skills + stack-specific code patterns (security for TS/NestJS, PHP planned). Loads in parallel with netresearch/security-audit.

2 skills · 1 command