claude

security

Threat modeling, security architecture review, incident response, vulnerability management, and access and identity. Reviewer-class: blocking findings are not overrulable by the department under review.

0 on GitHubby MoxyWolf LLCv0.1.1MITupdated today
/

Plugin security from marketplace moxywolf-plugins in MoxyWolfLLC/moxywolf-plugins. Commands read from the repo's manifest — today.

What it installs

Skills (8)

  • access-and-identity

    Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and ma

  • chief-information-security-officer

    Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work that creates unacceptable exposure. Use this for a security strategy or program decision, when a technical choice creates security risk that needs a verdi

  • data-protection-and-encryption

    Protects data itself rather than the systems around it — classifying what you hold, encrypting in transit and at rest and understanding what each actually defends against, managing keys and their rotation, handling secrets in applications and pipelines, minimizing and de-identifying, and deleting on

  • detection-and-monitoring

    Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens

  • incident-response

    Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or

  • security-architecture-review

    Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST

  • threat-modeling

    Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handlin

  • vulnerability-management

    Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclo

Subagents (1)

  • security

    Security department agent. Delegate security work here: threat modeling, security architecture review, incident response, vulnerability management, and access and identity. Reviewer-class: blocking findings are not overrulable by the department under review. It starts from the department head's skil

View source on GitHub

More from MoxyWolfLLC/moxywolf-plugins

All 52 plugins →

Frontier Founder SMB (FFSMB) — pre-built small-business workflows on a modern indie-founder stack: Clarify AI CRM, Stripe payments, QuickBooks accounting, DocuSign, Gmail/Google, and claude.ai/design. Cash flow, month-end close, invoice chasing, weekly briefs, CRM upkeep, customer pulse, contract review, hiring, growth campaigns — with an approval gate on anything touching money or customers. A MoxyWolf public fork of Anthropic's Small Business plugin, re-homed off PayPal/HubSpot/Square/Canva. Companion to the Apollo plugin for B2B prospecting. v0.3.1: installable — all 31 skills migrated, design lane rewritten for claude.ai/design, connector manifest in place. Team-beta; a dogfood pass over the transformed money/CRM skills is recommended before public release.

31 skills · 8 MCP servers

0

Bundle of 25 standalone skills used across MoxyWolf work — voice, brand, content ecosystems, plus the Anthropic-shipped reference skills, packaged as one installable plugin. (daily-ops moved out of the bundle in v1.1.0 — install the standalone plugin instead.)

26 skills

0

Operationalizes the 4D AI Fluency Framework (Delegation, Description, Discernment, Diligence) for content production. The single front door for every MoxyWolf blog property: a targets/ registry (FrontierFounder and OpenControls wired; STIGViewer, moxywolf-website, prfaq register-only) drives canonical URL, JSON-LD, frontmatter, and hero per destination, and every post picks a publishing target + a pillar (new or existing) before drafting — the hub-and-spoke methodology, with /blog-pillar to manage pillars and their linking maps. /blog-init is writer-friendly: two folder picks, author name, hero vibe, optional live URL. /blog-voice runs a self-contained 8-question voice interview and writes a per-writer voice profile; multi-voice supported. /blog-start mounts the two directories and surfaces in-progress and unpublished pieces. /blog-pipeline runs the 4-phase pipeline: 30-day discourse sweep across reddit/X/HN/Substack/Facebook/Quora/podcasts/academic with a /council:deliberate synthesis pass, verified bibliography via bibtex-builder, draft in the writer's voice via research-pipeline/content-writer, two-tier anti-AI-slop pass, then a nonce-bound Release Owner Gate (100-point rubric). On sign-off, the pipeline ends — social derivatives are opt-in. /blog-social derives any subset of: LinkedIn Post + first-comment (feed Post 1,300-2,500 chars sweet spot, 2,900 hard cap under LinkedIn's 3,000-char ceiling, zero body links; companion first-comment file with the fixed "If you want to do your own research…" opener, the blog URL, and the 2-3 sources the Post quotes inline), LinkedIn Article (optional long-form, separate selection), Twitter/X (5-10 post thread with ≤280-char per-post hard cap, script-enforced), Facebook (single 300-500 char post with body-inline link). One voice profile, per-platform register shifts (Twitter compressed; Facebook warmer; LinkedIn professional; first-comment voice-off and utilitarian). /blog-publish ships a signed post — the writer never types a

9 skills · 15 commands · hooks

0

The MoxyWolf coding loop. Design doc first, build against it, cross-tool peer review at a checkpoint, human merge. Carries the verification discipline: a check reports what it examined, a pass over zero input is a failure, and every claim of 'it works' names what was and was not verified.

1 skill · 19 commands · 2 agents · hooks

0

Daily LinkedIn go-to-market operations through the GTM API MCP server with one human approval gate a day: health check, signal sweep, drafts in Dorian's voice, ONE approval batch signed by the named Release Owner, then approved items only, run one at a time through preview then confirm, stopping on any rate limit, block or checkpoint. Publishing with golden-hour replies, inbox triage, digest, weekly KPIs and a CRM touch export. Ships a client that refuses outward tools without a recorded decision.

10 skills · 11 commands

0

End-to-end academic content pipeline: BibTeX theme mapping, perspective and voice capture, Academia.edu formatting, structure planning, iterative drafting, bibliography generation, and a 10-phase professor critique. Voice-first — voice and formatting are fixed before drafting, not retrofitted.

12 skills · 7 commands

0

Similar plugins

ecc

claudecodex

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

affaan-m/ECC 302,088

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

anthropics/claude-code 155,476

MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint

13 skills · 1 command · 1 agent · hooks

ruvnet/ruflo 81,589

Install the "AAS Secure App Builder" workflow plugin from Agentic Awesome Skills.

12 skills

sickn33/agentic-awesome-skills 49,620

duende-skills

claudecodex

Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture

24 skills · 2 agents

anthropics/claude-plugins-official 47,076

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents

wshobson/agents 42,461

Maintain security?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins52 plugins