claude

SECURE — Security & Privacy Gate

The pre-release security gate for any repository. Catches PII, secrets/credentials, and supply-chain risk before they ship. Runs parallel, multi-agent audits across data files, git history, source, and frontend, and consolidates them into a single severity-ranked report with a PASS / REVIEW / BLOCK verdict. Stands alone, or serves as deliver's SECURE gate when both are installed.

0 on GitHubby whatbirdisthatv1.3.0MIT OR Apache-2.0updated 2 months agosecurity
/

Plugin secure from marketplace idea-to-production in agentic-underground/idea-to-production. Commands read from the repo's manifest — 1 month ago.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (6)

  • check

    Verify SECURITY's scanners (SCA — npm/pip/cargo-audit + osv-scanner; secrets — gitleaks) are installed and reachable — a ✓/✗ table by tier. Trigger with /secure:check (or "check security prerequisites", "which scanners are installed?"). Advisory: a missing scanner narrows a lens, never a false PASS;

  • scan-all

    The consolidated pre-release security gate — runs SECURITY's three audits in parallel (PII, secrets, dependencies) into one SECURITY-REPORT.md with a PASS / REVIEW / BLOCK verdict. Trigger with /scan-all [scope]. Guard: SECURE only; deliver composes it as its SECURE station before DELIVERY. Degrades

  • scan-dependencies

    Supply-chain audit of third-party dependencies — parses manifests/lockfiles across ecosystems (npm, pip/uv, Go, Cargo, RubyGems, Maven/Gradle) and flags known-vulnerable versions, unpinned ranges, abandoned packages, and typosquat names. Trigger with /scan-dependencies [path]. Guard: SECURE only. →

  • scan-for-pii

    Audit a codebase for PII (personal data — names, emails, phones) and secrets across data files, git history, source, and frontend. Trigger with /scan-for-pii [scope: full|data|git|code|spa|path]. Guard: SECURE only. → PII-REPORT.md with findings, risk assessments, and recommendations. phase: [SECURE

  • scan-for-secrets

    Detect committed credentials and secrets — API keys, tokens, private keys, connection strings, high-entropy blobs — across the working tree, git history, and build artefacts (the CREDENTIAL lens, complementing scan-for-pii's PERSONAL-data lens). Trigger with /scan-for-secrets [scope: full|tree|histo

  • self-improve

    Improve SECURITY itself — fold detection feedback into its patterns, precision boundaries, and gates, or self-cleave an over-broad element. Trigger with /secure:self-improve (or "the scan missed a vuln — fix it", "this rule is too noisy", "fold this finding in"). Applies on a branch → adversarial re

Slash commands (6)

  • /secure:check

    Verify SECURITY's security scanners (SCA, secrets) are installed and reachable — a ✓/✗ table by tier (advisory; --strict to fail on a missing required tool).

  • /secure:inspect

    Inspect the SECURE plugin itself — audit skills, agents, and knowledge for drift, gaps, and duplication; produce a severity-ranked report.

  • /secure:scan-all

    Run the full pre-release security gate — PII + secrets + dependency audits → SECURITY-REPORT.md with a PASS/REVIEW/BLOCK verdict.

  • /secure:scan-dependencies

    Audit third-party dependencies for known vulnerabilities, unpinned versions, missing lockfiles, abandoned packages, and typosquats.

  • /secure:scan-for-pii

    Audit a codebase for PII and secrets across data, git history, source, and frontend — produces PII-REPORT.md.

  • /secure:scan-for-secrets

    Scan for committed credentials and secrets (API keys, tokens, private keys, connection strings) across the tree, git history, and build artefacts.

Subagents (1)

  • inspector

    SECURITY INSPECTOR — on-demand agent that audits the SECURE plugin it ships in (skills, agents, knowledge, commands under ${CLAUDE_PLUGIN_ROOT}). Triggered by user command only ("inspect SECURITY" / "/secure:inspect"). Builds a fresh critical-analysis persona, reads every file, and produces SECURITY

Hooks (1)

  • SessionStart

    bash ${CLAUDE_PLUGIN_ROOT}/hooks/inject-kaizen.sh 2>/dev/null || true

View source on GitHub

More from agentic-underground/idea-to-production

All 8 plugins →

An opinionated, disciplined, quality-first software production system. A conveyor that carries value from IDEA to PRODUCTION across role-tuned agents and value-stations (IDEA ▶ ROADMAP ▶ PLAN ▶ EARS ▶ FEATURE ▶ TEST ▶ IMPLEMENT ▶ STORY ▶ SHIP), governed by three pillars — knowledge parity, quality-first with a performance-delta gate, and waste elimination (muda·mura·muri) — under an overarching token-efficiency constraint. Emits markdown; uses the secure and publish companions automatically when present.

19 skills · 13 commands · 32 agents · 1 MCP server · hooks

0

Turns project artefacts and markdown into publication-grade output: narrative articles mined from git history and docs, standalone diagrams (Graphviz + a Mermaid-native specialist covering the full diagram taxonomy, theming, and ELK), and print-quality PDFs with embedded, A4-legible figures — all held to standard by an adversarial design-reviewer (typography + data-viz canon) that critiques the rendered artefact in a convergent loop. The PUBLISHING companion deliver hands off to when richer-than-markdown output is wanted — or use it directly on any project.

10 skills · 5 commands · 8 agents · hooks

0

The FRONT DOOR, ARRIVAL layer, and meta-layer of the marketplace — the marketplace-level surface the specialist plugins never had. /i2p:help browses the powers you have now, grouped by the DISCOVER ▸ IDEATE ▸ BUILD ▸ DESIGN ▸ SECURE ▸ PUBLISH value flow (listing only what is installed); /i2p:review fans out EVERY installed reviewer — code (deliver), design (design), rendered docs (publish), security (secure) — into ONE adversarial verdict in I2P_REVIEW.md; /i2p:check consolidates every plugin's readiness into one table; /i2p:flow maps where each plugin sits and the next command to run; /i2p:focus declares the active lifecycle phase for context routing so out-of-phase skills stay dormant ('focus, don't uninstall'), broadcast by a SessionStart hook so it survives /clear. It also GREETS whoever opens a repo: a SessionStart hook renders a maintainer-authored .claude/welcome.md (/i2p:define-welcome authors it), and /i2p:statusline turns on the rich two-line idea-to-production status line (context & rate-limit gauges, the product-lifecycle phase, a ⚔ reviewer-catch tally), offered once on first activation. Introduces itself on session start and surfaces occasional ≤25-word tips. A thin orchestrator that delegates to the specialists by capability and never re-implements them. Carries the KAIZEN self-improvement covenant.

10 skills · 10 commands · 1 agent · hooks

0

The OPERATE phase owner — what runs a mission AFTER launch. OPERATE keeps the live product alive and improving: it verifies operational readiness at go-live, instruments and watches the four golden signals (observability), runs incident response (severity, incident-command roles, mitigate-first, runbooks, blameless postmortems), keeps a maintenance cadence (dependency upkeep + CVE patching + tech-debt), and closes the build-measure-learn loop by turning production signals into a new opportunity that re-enters DISCOVER (the cyclic re-entry). /operate-gate is the front door — an operational-readiness check at go-live and the steady-state health view with a READY / WATCH / NOT-READY verdict. Grounded in named canon (SRE SLIs/SLOs/error budgets + golden signals, the Incident Command System, build-measure-learn, ITIL-lite). Stands alone on any live project, or advances the idea-to-production lifecycle OPERATE → DISCOVER (↻) when i2p is installed. Composes the secure plugin's scan-dependencies and hands new opportunities to discover/ideate by capability. Carries the KAIZEN self-improvement covenant: every incident becomes a runbook, every alert gap becomes an SLO.

9 skills · 9 commands · 1 agent · hooks

0

The DISCOVERY front door of the marketplace — upstream of any code. Set a standing discovery /discovery-goal, then run /market-scan: an adversarially-challenged dialogue over a market parameter taxonomy (problem severity, demand evidence, market size, willingness-to-pay, pricing power, competition, reachability, stack-fit) that proposes, scores, validates, and NARROWS candidate opportunities, killing weak ideas early. Loop it over your goal until one candidate earns a keep verdict — the spark. Hands a validated OPPORTUNITY to the ideate plugin when installed, or emits a structured markdown opportunity brief standalone. Self-improving: downstream feedback sharpens the parameters and scoring over time.

4 skills · 4 commands · 2 agents · 1 MCP server · hooks

0

The REFINEMENT phase of the marketplace. Takes a validated opportunity (from discover) or a raw idea you already have and refines it to knowledge-parity through an adversarially-challenged dialogue, producing the IDEA PACKAGE: precise AGENT-FACING handoff documents (idea brief, subject-matter-understanding seed, first vertical slice, and a handoff contract that satisfies DELIVER's discovery exit criteria) plus rich, illustrated USER-FACING documents (opportunity narrative, parameter scorecard, market/pricing/competition charts, a user-flow, and a mockup screen) rendered by capability — charts via publish, user-flows/mockups via design (design-reviewed) — when installed; degrades to markdown otherwise. Iterated with the user before hand-off, then carried to PRODUCTION by DELIVER. Supersedes DELIVER's inline ideate, which remains as a graceful-degradation fallback. Also runs /ideate:name — a marketing-grade naming studio: a deep discovery interview (audience, brand archetype, name-type appetite, power-adjacency, humour, risk), wide-net generation across the full name-type taxonomy + affix hooks + phonosemantic tuning, a deterministic token-free checker (registries + neighbour/typo-squat proximity + domain/RDAP + cross-language connotation), and a scored challenge (Neumeier 7 / SMILE-SCRATCH / archetype-fit). Self-improving: ambiguities a downstream builder hits flow back to sharpen the question-bank and the package contract.

4 skills · 4 commands · 2 agents · 1 MCP server · hooks

0

Similar plugins

ecc

claudecodex

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

affaan-m/ECC 302,088

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

anthropics/claude-code 155,476

agentdb

claude

AgentDB (external: maintained in ruvnet/agentdb, pinned to commit 27678c3, plugin 3.6.0): agentdb's own standalone MCP server pinned to [email protected] (vector memory with get/list/update/delete for records, patterns and skills, hybrid keyword + vector episode search and an opt-in local cross-encoder, an opt-in aidefence injection guard on memory writes, reflexion, skills, outcome feedback, capabilities report), a memory-specialist agent, 3 skills, /agentdb-status, and the agentdb mod guard that keeps secrets out of memory and refuses delete/reset unless allowed. Complements ruflo-agentdb, which reaches AgentDB through ruflo's server

3 skills · 1 command · 1 agent · 1 MCP server

ruvnet/ruflo 81,589

duende-skills

claudecodex

Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture

24 skills · 2 agents

anthropics/claude-plugins-official 47,076

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents

wshobson/agents 42,461

Maintain SECURE — Security & Privacy Gate?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins8 plugins