Security plugins

Run Claude Code unattended: capped spend, sandboxed execution, signed receipt, enforced from outside the agent's process.

1 command · 1 MCP server · hooks

Security audit patterns (OWASP, CWE, CVSS) with 80+ checkpoints — by Netresearch

1 skill · hooks

Runtime security hooks: CLAUDE.md injection scanner (SessionStart) + Bash prompt injection detector (PreToolUse)

1 command · hooks

Use credentials from coding agents without reading their values into context.

1 skill · hooks

The behavior gate for AI edits — proves each edit lost no auth guard, dropped no route, grew no blast radius. Deterministic, <2s, offline, zero API key.

hooks

Security reminder hook that warns about potential security issues when editing files, including command injection, XSS, and unsafe code patterns

hooks

Review Entur codebases for evidence-backed security weaknesses, privacy-control gaps, misleading security claims, and AI-assisted implementation drift, with scoped STRIDE/LINDDUN output.

Core skills library for superhackers: pentesting, exploit dev, security patterns, and proven techniques. Covers webapp, API, infrastructure, Android security assessment.

22 skills · 3 commands · 1 agent · hooks

Agent governance for the terminal: your team's written practices decide every permission prompt, unsafe calls are rewritten rather than blocked, and every decision lands in an audit trail that names the clause it applied.

3 skills · 7 commands · hooks

Security assessment and compliance expertise for application security, threat modeling, security documentation, and compliance management.

4 skills · 2 agents

Audit, fix, and review mobile app security with advice scaled to your app's risk.

1 skill · 4 commands · 1 agent

Skills for interacting with 1Password through the op CLI

4 skills

In-process integrity verification for every tool call: injection and exfiltration scanning, MCP-aware sensitive-tool gating, and a verifiable per-session decision chain.

1 command · hooks

Retrieve CVEs and index them locally as an MCP server + skill. Offline, reproducible, token-budgeted.

1 skill · 1 MCP server

Pre-launch security audit for web apps. Runs OWASP checks via shell scripts, then AI analyzes findings.

1 skill

A single Claude Code command for Linux server security auditing: log analysis, intrusion detection, malware scanning, and rootkit detection. Not an MCP server, despite the name.

1 command

Blocks WebFetch attempts on GitHub URLs and redirects to gh CLI for authenticated access

hooks

YOLO mode safety net - PreToolUse guardrails that block destructive commands (rm -rf, disk formatting, data exfiltration), gate risky-but-maybe-intentional actions with host-aware behavior, and nudge the agent toward safer alternatives. Configurable credential file protection. Because shipping fast shouldn't mean losing your home directory.

hooks

Scan container images, filesystems, and repositories for vulnerabilities using Trivy. Use for CVE detection, security analysis, vulnerability comparison across image versions, and batch scanning.

1 skill

CISO orchestrator: enterprise security strategy, risk governance, and board reporting.

1 skill

VP Compliance: SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act frameworks.

1 skill

Audit evidence collection, control testing, SOC 2 readiness, and GRC management.

1 skill

Blocks prompts that contain an API key, stops the agent from reading .env files and printing secrets, and scrubs the transcript when the session ends.

hooks

Security hooks: block destructive shell commands (rm -rf /, force push, curl | sh, DROP TABLE) and block any edit that would write a cloud key, API token or private key to disk. Needs jq

Generate, enrich and validate SPDX 3 SBOMs/AIBOMs with Pitloom for Python projects, wheels (PEP 770 embedding), Git and PyPI URLs and AI models, and complete NTIA, FSCT, CISA 2026, G7 SBOM for AI and BSI TR-03183-2 minimum elements.

3 skills

Advanced security scanner for Claude Code plugins with 91 specialized pattern detection agents. Performs static code analysis using IntelligentOrchestrator with consensus voting, AccuracyCache shared learning, and MITRE ATT&CK/ATLAS framework mapping. Detects vulnerabilities, code obfuscation, hardcoded credentials, and security anti-patterns. Successfully scanned 987 real-world plugins with 100% accuracy. Includes adaptive routing, auto-evolving rules, and comprehensive reporting.

1 skill · 1 agent

Comprehensive GDPR compliance auditing plugin that analyzes static code files, database schemas, and configurations for EU data protection regulation compliance. Includes 8 reference documents, 5 automated scanning tools, and generates detailed compliance audit reports.

1 skill · 1 agent

Professional cybersecurity policy document generator using 51 industry-standard templates from SANS and CIS Controls. Creates complete, framework-compliant policy documents (Markdown, Word, HTML, PDF) customized for your organization. Covers 15 security categories with mappings to ISO 27001, SOC 2, NIST CSF, CIS Controls v8, and GDPR.

1 skill · 1 agent

Produces a STRIDE threat model, flagging the risks teams commonly miss.

1 skill · 1 MCP server

Intent-based security enforcement for OpenAI Codex: declared plans, policy rules, intent-drift blocking, optional CSRG cryptographic proofs, and audit logging.

1 MCP server · hooks