Vulnerability intelligence for coding agents. A dependency guard that stays silent until an install breaks your policy, a change guard that catches a credential before it is committed, and session context that tells the agent what this repository's last scan found. Plus 18 skills for the work that needs the working tree: choosing a dependency, tracing a CVE into this codebase, applying and verifying a fix.
Plugin vulnetix from marketplace vulnetix-plugins in Vulnetix/pix-ai-coding-assistant. Commands read from the repo's manifest — yesterday.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
bulk-triageParallel CWSS scoring across many vulnerabilities — each analysed independently, single consolidated `.vulnetix/memory.yaml` write at the end, output grouped by P1–P4 priority tiers. Use when handed a list of CVE IDs from a security report, processing a Dependabot batch, scoring the full backlog of
compliance-bundlerEnd-to-end compliance bundle agent — CycloneDX SBOM + SPDX licenses + SARIF findings + OpenVEX/CycloneDX VEX, optional cosign signing, optional Vulnetix upload, manifest.json with SHA-256 sums, Markdown index. Use when assembling an audit deliverable, building a customer-facing security disclosure,
dep-upgrade-orchestratorEnd-to-end dependency upgrade across all manifests — detect capabilities, scan for vulnerable deps, plan fixes ranked by patch-vs-major bump risk, apply per-manifest, run package-manager install, verify each fix, loop on conflicts via dep-resolve. Use when running a quarterly upgrade pass, modernisi
incident-responderFull SOC playbook agent for an actively exploited CVE — parallel sightings + KEV + IOCs + ATT&CK + fixes + remediation pull, capability-aware detection-rule deployment, optional patch path with verify-fix, VEX attestation publication. Use when a CVE goes hot, a vendor advisory names your dependency,
pr-security-reviewerComprehensive pre-merge security agent — parallel SAST + SCA + secrets + container + IaC + license against the PR diff, dep-add-guard for new direct deps, optional `gh pr review` posting. Use when reviewing a high-stakes PR, gating release branches, producing a unified review comment, or replacing s
vulnetix agent hook
vulnetix agent hook
vulnetix agent hook
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Open-source AI job search that runs locally in your AI coding CLI: scan job portals, evaluate listings into a structured A-H report with a 1-5 score, tailor your CV, track applications
5 skills · hooks
MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint
13 skills · 1 command · 1 agent · hooks
Install the "AAS Security Engineer" editorial skill bundle for Claude Code.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.