claude

security-toolkit

Useful friction against obvious mistakes - a basic draft, not a security product (no sandbox; whatever doesn't match a pattern passes through). Threat-detection and dangerous-action-blocking hooks for Claude Code: prompt-injection detection (tiered, with allowlist; covers MCP tool outputs via the * matcher), block dangerous git operations (push to main, force push, reset --hard, --no-verify, etc.), and Desktop Commander input safeguards (block start_process and set_config_value). Also ships an optional, per-user PR-merge guard - block Claude from running `gh pr merge` so a human always merges - that is OFF by default and toggled with the `/pr-merge-guard` command (on/off/status); the `pr-merge-guard` skill explains it and flips it on request. New: the `windows-wsl-security-verification` skill - a guided "am I compromised?" IOC triage + attack-surface reduction for Windows + WSL2 dev boxes after a supply-chain scare (poisoned npm/PyPI package, trojaned extension), with the detection-reading discriminators that prevent false alarms. Windows/WSL-specific; verifies, does not harden; a clean result raises confidence, never proves. Also ships the `pii-gate` skill and installer - a drop-in PII/secret gate for a git repo (pre-commit + pre-push hooks + a CI workflow) that blocks personal names from reaching a remote and chains gitleaks for secrets. It fires on `git init`, adding a remote, or a first push, because pushed history is permanent and the gate only works if it exists before that first push. Everything fails closed, matching is case-insensitive and whole-word in every layer, the CI denylist secret lives in a GitHub Environment limited to the default branch so no branch run can read it, gitleaks in CI ignores inline allow comments and repo-root config, a matched term is never echoed, and the shipped denylist template is EMPTY by design - you fill in a gitignored copy, nothing personal ever lives in the repo.

2 on GitHubby bogheorghiuv0.7.1MITupdated 3 days ago
/

Plugin security-toolkit from marketplace ex-cog-dev in bogheorghiu/ex-cog-dev. Commands read from the repo's manifest — 3 days ago.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (3)

  • pii-gate

    Installs a PII/secret gate into a git repo — pre-commit + pre-push hooks and a CI workflow that block personal names and secrets from reaching a remote. Fires BEFORE a repo can leak: on `git init`, "new repo", "set up a repo", "add a remote", "push this to GitHub", "publish this", "make this repo pu

  • pr-merge-guard

    Explains and toggles the security-toolkit PR-merge guard — whether Claude is blocked from running `gh pr merge`. Fires in BOTH directions: when the user asks about it ("can you merge PRs?", "is there a setting that stops you merging?", "what's EXCOG_BLOCK_PR_MERGE?", "I forgot if merge-blocking is o

  • windows-wsl-security-verification

    Am I compromised? After supply-chain news — a poisoned npm/PyPI package, a malicious VS Code extension, a backdoored dep that ran as you — this runs a guided IOC triage of a Windows + WSL2 dev box, then trims the attack surface the next compromise would use. WSL side: known-bad package versions, ld.

Slash commands (1)

  • /security-toolkit:pr-merge-guard

    Show or change the PR-merge guard (whether Claude is blocked from running `gh pr merge`). Off by default. Usage: /pr-merge-guard [status|on|off]

Hooks (5)

  • SessionStart

    "${CLAUDE_PLUGIN_ROOT}/hooks/announce-pr-merge-guard.sh"

  • PreToolUse

    "${CLAUDE_PLUGIN_ROOT}/hooks/block-dc-execute.sh"

  • PreToolUse

    "${CLAUDE_PLUGIN_ROOT}/hooks/block-dc-config.sh"

  • PreToolUse

    "${CLAUDE_PLUGIN_ROOT}/hooks/block-dangerous-git.sh"

  • PostToolUse

    "${CLAUDE_PLUGIN_ROOT}/hooks/detect-prompt-injection.sh"

View source on GitHub

More from bogheorghiu/ex-cog-dev

All 4 plugins →

Even-handed investigation of loaded, contested topics. Research & investigation skills for thinking-with-AI - investigation protocols (deep-investigation, cui-bono / "follow the money", screening a dev job or employer for hidden military/defense ties), text & source deconstruction, frame rotation, and iterative verification that escalates to a recursive adversarial dialectic (generate a claim's exact opposite and test it). The skepticism is symmetric - turned on the consensus, the contrarian take, the model's own bias, and its own conclusions; it assumes no villain in advance (POSIWID: judge a method by what it does, not what it claims). Ships two deliberately basic MCP servers - thin data-access layers, not analysis engines; the skills do the analysis: financial-mcp (stock price, history, company info and standard technical indicators via yfinance, with a local ticker cache) and transparency-mcp (keyless public data - US Congress bills/members/votes via GovTrack, World Bank development indicators, and US nonprofit Form 990 filings via ProPublica).

22 skills · 2 commands · 4 agents · 2 MCP servers · hooks

2

A working proof of concept for catching the same structure in places that have nothing to do with each other - and in your own working process: notice such a regularity, capture it, and test each for a real shared mechanism, not surface resemblance. Today it's a growing, hand-kept list of specific observations that resurface when the shape shows up again, each accumulating a count of the times it has recurred. The self-organizing learner the system is built toward is the genuine direction, not yet the state - an early, already-useful step toward it. Memory for forms, not just facts; two local MCP servers (relational-memory + a usage-weighted knowledge graph, experimental). The term "vasana" is grounded in the plugin's axioms.

10 skills · 1 command · 1 agent · 2 MCP servers · hooks

2

Discipline for prompting and co-authoring with AI - nothing to configure, just skills. intrinsic-prompt-design: give the model the reason behind a rule, not just the rule; the reasons part clearly helps, even paired with plain imperatives, though so far only anecdotally (rigorous testing is still worth doing), and its bolder idea - deliberately leaving space for the model's own agency to fill - is the core experimental proposition. system-pilot: engineering discipline for deterministic systems, adapting the original Universal CLAUDE.md Protocol. skill-activation-testing: a two-tier A/B (cheap proxy + live firing test) for whether a description change actually fires, with the validity limit of each tier named, plus a stdlib scorer over claude plugin eval that adds case-level intervals, paired arm deltas and a pre-registered ship rule.

3 skills · 2 agents

2

Maintain security-toolkit?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins4 plugins