security

Plugin security from marketplace metapowers in bromso/metapowers. Commands read from the repo's manifest — 18 days ago.

Skills (39)

• access-control

  Design identity and access management — RBAC or ABAC, roles and a permissions matrix, least privilege and just-in-time access, MFA, service accounts, access reviews and break-glass access. Use when the user asks who should access what in their systems, wants MFA or least privilege, or needs to cut e

• anomaly-detection

  Define behavioral baselines and anomaly rules — impossible travel, odd-hours access, failed-login spikes, bulk exports, lateral movement, DNS anomalies — with thresholds, signal correlation and automated responses by confidence. Use when the user wants to catch unusual user, API or network behavior

• api-security

  Audit the security of a project's APIs — inventory, authentication, object- and function-level authorization, rate limiting, input validation, error leakage, CORS and transport. Use when the user asks to review API security, harden endpoints, or check a REST or GraphQL API for broken authorization.

• asset-inventory

  Catalog every hardware, software, data store, API, cloud and SaaS asset with owner, location, criticality and data classification, dependencies and shadow IT. Use when the user has no complete list of their systems and tools, or suspects unmanaged services and unowned assets. Not for mapping what is

• attack-surface

  Map every entry point an attacker could reach — web apps, APIs, mobile, email, network, cloud, CI/CD, physical — rate each by exposure and protection, and plan how to shrink it. Use when the user asks what is exposed to the internet, worries about forgotten endpoints or open admin panels, or wants t

• backup-validation

  Plan backups and prove they restore — what is and is not backed up, frequency and backup types, 3-2-1 storage, a test restore schedule, backup monitoring and step-by-step restore procedures. Use when the user is unsure their backups work, asks how often to back up, or wants restore testing on a sche

• business-continuity

  Create a business continuity plan — critical functions and dependencies, RPO and RTO per function, continuity strategies, disruption scenarios, roles, communication and tabletop exercises. Use when the user asks how the business keeps serving customers while systems, suppliers or key people are unav

• compliance-gap

  Assess how far current controls are from security frameworks such as ISO 27001, NIST CSF, SOC 2 or CIS — status per control, a score and maturity per framework, and a remediation roadmap. Use when the user asks how compliant they are with a security framework or what is missing to meet it. Not for m

• compliance-map

  Map existing security controls to framework requirements — ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, HIPAA — showing which controls serve several frameworks and the gaps. Use when the user has controls in place and asks which requirements they meet or how to reuse a control across audits. Not for co

• container-security

  Secure the container lifecycle — base images, Dockerfile practice, image scanning, registry signing and promotion, runtime hardening, and Kubernetes RBAC, pod security and network policies. Use when the user runs Docker or Kubernetes and asks how to harden their images, clusters or workloads.

• containment-strategy

  Define containment and eradication procedures — network isolation, account lockout, service and data containment, patching, rebuilds and credential rotation — with criteria for when it is safe to restore and who may trade availability for security. Use when the user asks how to isolate a compromised

• data-classification

  Classify an organization's data as public, internal, confidential or restricted — criteria, a data inventory, handling rules for storage, transfer, access, retention and disposal, and regulated types such as PII, PHI and card data. Use when the user asks which of their data is sensitive and how each

• dependency-scan

  Audit a project's direct and transitive dependencies for known CVEs, risky or missing licenses and unmaintained packages, with patch, upgrade or replace advice and an update policy. Use when the user asks whether their npm, pip, Go or other packages have known vulnerabilities or license problems. No

• encryption-strategy

  Plan encryption at rest and in transit plus key management — algorithms per store, TLS and mTLS, KMS choice, key hierarchy and rotation, client- versus server-side encryption. Use when the user asks how their data should be encrypted, which TLS settings to require, or how to manage encryption keys.

• forensic-readiness

  Prepare for forensic investigation before an incident — evidence sources by volatility, a pre-positioned toolkit, hashing and preservation, chain of custody, legal hold and cloud-specific collection. Use when the user wants evidence from a future breach to hold up, or asks how to preserve logs, disk

• iac-security

  Scan infrastructure-as-code such as Terraform, CloudFormation or Helm for misconfigurations — public storage, open security groups, wildcard IAM, missing encryption — and add policy checks to CI. Use when the user asks whether their Terraform or cloud templates are secure, or wants IaC scanning in C

• incident-communication

  Draft incident communication templates — internal alerts, executive briefings, customer notices, regulator notifications, media statements and post-incident summaries — with an approval chain for each. Use when the user needs ready-to-send wording for telling staff, customers, regulators or the pres

• incident-response

  Create a technical incident response plan — P1 to P4 severities, playbooks for breach, ransomware, DDoS, insider and supply chain attacks, roles, communication, escalation and decision trees. Use when the user has no plan for a security incident or asks what their team should do when an attack is de

• lessons-learned

  Conduct a blameless review of one security incident — timeline with detection and response times, 5 Whys root cause, contributing factors, owned corrective actions at three levels, playbook updates. Use when an incident is resolved and the user wants to know why it happened and what to change. Not f

• logging-architecture

  Plan centralized logging — log sources, a structured format with correlation IDs, the aggregation platform, retention by log type, tamper-proof audit trails and access to log data. Use when the user asks how to centralize their logs, how long to keep them, or needs an audit trail that auditors will

• monitoring-strategy

  Design security monitoring — which events to watch, alert severities and thresholds, on-call rotation and escalation, the monitoring stack, runbooks per alert, and detection and response SLOs. Use when the user asks what security events to alert on, who gets paged, or how fast they should detect and

• pentest-plan

  Plan one penetration test — black, grey or white box, in- and out-of-scope systems, methodology, rules of engagement, stop conditions, reporting, remediation timelines and tester qualifications. Use when the user is commissioning or preparing a pen test and needs its scope and rules of engagement wr

• recovery-plan

  Design disaster recovery for IT systems — restore priorities and dependencies, restoration steps for databases, applications and infrastructure, RTO and RPO per system, and verification. Use when the user asks how to restore their systems after an outage, attack or region failure, and in what order.

• resilience-improvement

  Aggregate findings from incidents, DR tests, pen tests, tabletop exercises and audits into recurring patterns, prioritize improvements by risk reduction and effort, and track them on a roadmap with metrics. Use when the user has several incident reviews or test reports and asks which recurring weakn

• risk-appetite

  Set how much security risk the organization will accept — tolerance thresholds per risk category, who may accept each level, time limits and an acceptance workflow. Use when the user must decide who can sign off on a known risk, or leadership asks how much risk the company is willing to carry. Not f

• risk-assessment

  Score security risks by likelihood and impact into a risk register with a 5x5 matrix, treatment, owner and review date, drawing on threat and vulnerability findings. Use when the user asks which security threats matter most or what to mitigate, transfer or accept. Not for legal exposure or delivery

• secrets-management

  Design how secrets are stored and rotated — inventory API keys, credentials, tokens and certificates, find hardcoded or leaked ones, pick a vault, set rotation and secure CI/CD use. Use when the user has credentials in code, env files or CI, asks how to rotate API keys and passwords, or is choosing

• secure-coding

  Review an application's code against the OWASP Top 10 — input validation, output encoding, auth and sessions, error handling, security headers — with a prioritized fix plan. Use when the user wants their application's code reviewed for security flaws or asks whether it follows secure coding practice

• security-checklist

  Generate a security checklist for one situation — new service, API launch, migration, release, vendor onboarding — scoring auth, data, logging, dependency, secrets and infrastructure items, with go-live blockers. Use when the user is about to launch, deploy or migrate something and wants a quick go/

• security-culture

  Design a security culture program — awareness maturity, a security champions program, gamification and incentives, and behavior metrics such as phishing click and reporting rates. Use when security is seen as a blocker, staff rarely report problems, or the user wants security champions in teams. Not

• security-policy

  Draft an organization's core security policies — information security, acceptable use, data protection, access, incident response, continuity — with owners, NIST CSF mapping and review dates. Use when the user needs written security policies or is starting a security program with nothing on paper. N

• security-roles

  Define who owns security work — roles such as CISO, engineers, champions and responders, a RACI matrix, staffing gaps and a proposed team structure. Use when the user asks who should be responsible for security, is building a security team, or has security tasks nobody clearly owns. Not for user per

• security-testing

  Plan a security testing program — SAST, DAST, SCA, IAST and pen test cadence, tool selection, CI/CD integration points, triage SLAs and false-positive handling. Use when the user wants security testing built into their pipeline or asks which scanners to run and when. Not for scoping a single penetra

• security-training

  Design a security awareness and training program by audience — all staff, developers, operations, security team, leadership — with modules, cadence, completion tracking, quizzes and phishing simulations. Use when the user needs to train employees on security, run phishing tests, or show training rec

• siem-setup

  Design a SIEM deployment — platform such as Splunk, Sentinel or Elastic, ingestion, correlation rules mapped to MITRE ATT&CK, dashboards, storage tiers and SOAR integration. Use when the user is choosing or rolling out a SIEM and needs detection rules and dashboards for it. Not for log formats, corr

• supply-chain-security

  Assess the security of the vendors a business relies on — SaaS, cloud, contractors, open-source suppliers — rating each by criticality, data access and evidence such as SOC 2 into risk tiers. Use when the user asks which vendors could expose them or wants each supplier's security rated. Not for revi

• threat-intel

  Research current threat intelligence for a technology, industry or threat actor — recent CVEs and exploits, attacker TTPs, MITRE ATT&CK mapping, relevance to the organization and defensive actions. Use when the user asks what threats, exploits or attacker groups are currently targeting a technology

• threat-model

  Model threats to a system with STRIDE — scope, actors, a text data flow diagram with trust boundaries, threats rated by likelihood and impact, and mitigations. Use when the user is designing or changing a system or feature and asks what could go wrong or how an attacker might abuse it. Not for curre

• vulnerability-assessment

  Identify vulnerabilities across systems, code and configuration — OWASP Top 10, CVEs, dependencies, misconfigurations — ranked by CVSS and asset criticality. Use when the user asks which known vulnerabilities their systems and infrastructure have and what to patch first. Not for a package-only scan

Hooks (1)

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}"/hooks/phase-gate.sh

Similar plugins