claude

sigil-security

Automated security auditing CLI for AI agent code. Scan repos, packages, and agent tooling for malicious patterns with quarantine-first workflow.

6 on GitHubby NOMARKv1.1.0Apache-2.0updated 1 month ago
/

Plugin sigil-security from marketplace sigil-marketplace in NOMARJ/sigil. Commands read from the repo's manifest — 1 month ago.

This plugin runs code on your machine — its hooks fire automatically on events like tool use and it starts local MCP servers. The exact commands are listed below; read them before installing.

What it installs

Skills (6)

  • fix-finding

    Analyze a Sigil scan finding and propose a code fix with explanation

  • generate-policy

    Generate a Sigil sandbox policy YAML from scan results for secure agent execution

  • review-quarantine

    Review items in Sigil quarantine and help decide whether to approve or reject them. Use when scan results are available or when managing quarantined code.

  • scan-file

    Scan a specific file or code selection for security threats using Sigil. Use when reviewing a single script, config, skill manifest, or MCP server file before running or installing it. Trigger phrases (English): 'is this safe to install', 'scan this skill', 'vet this MCP server', 'check this package

  • scan-package

    Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands. Trigger phrases (English): 'is this safe to install', 'check this package before instal

  • scan-repo

    Scan a repository or directory for security threats using Sigil. Use when auditing AI agent code, reviewing cloned repositories, checking dependencies, or analyzing suspicious packages. Auto-invoke when users clone repos or install packages from untrusted sources. Trigger phrases (English): 'is this

Subagents (2)

  • quarantine-manager

    Manages quarantine workflow, helps review findings, and coordinates approval/rejection decisions. Invokes when handling quarantined scan results or managing security findings.

  • security-auditor

    Specialized security auditor for analyzing Sigil scan results, identifying malicious patterns in AI agent code, and recommending remediation. Invokes when security analysis, code audit, or threat assessment is needed.

MCP servers (1)

  • sigil

    runs: sigil mcp

Hooks (4)

  • SessionStart

    ${CLAUDE_PLUGIN_ROOT}/hooks/session-setup.sh

  • PreToolUse

    ${CLAUDE_PLUGIN_ROOT}/hooks/sigil-guard.sh

  • UserPromptSubmit
  • UserPromptSubmit
View source on GitHub sigilsec.ai

Similar plugins

mattpocock-skills

claude

Matt Pocock's agent skills for real engineering (grilling, spec/ticket flows, TDD, code review, domain modelling and more).

39 skills

mattpocock/skills 323,108

claude-mem

claudecodex

Persistent memory for Claude Code: the next session starts where the last one left off.

29 skills · 1 MCP server · hooks

thedotmack/claude-mem 116,618

understand-anything

claude

AI-powered codebase understanding — analyze, visualize, and explain any project

9 skills · 10 agents · hooks

Egonex-AI/Understand-Anything 92,410

career-ops

claudecodex

Open-source AI job search that runs locally in your AI coding CLI: scan job portals, evaluate listings into a structured A-H report with a 1-5 score, tailor your CV, track applications

5 skills · hooks

career-ops-hq/career-ops 82,253

mem0

claudecodex

Cross-session memory and token savings for coding agents.

6 skills · 1 agent · 1 MCP server · hooks

mem0ai/mem0 68,893

humanizer

claude

Rewrite AI-sounding text so it reads like the writer without changing what it says.

1 skill

blader/humanizer 68,461

Maintain sigil-security?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex pluginslisted