Settles whether suspected security findings tied to a code location are real: restates each claim, traces source to sink, proves or refutes attacker control and impact, writes PoCs outside the repo without running them, and passes six gates before a TRUE or FALSE POSITIVE verdict. Takes scanner output, review findings or a pasted GitHub code-scanning alert.
Plugin fp-check from marketplace devops in flyoverhead/devops-plugins. Commands read from the repo's manifest — today.
fp-checkDecides whether each security finding at a path:line — scanner output, a review finding or a pasted GitHub code-scanning alert JSON — holds up, tracing data flow, attacker control and impact through six gates to a per-finding TRUE or FALSE POSITIVE. Use when asked "is this real", "false positive?",
data-flow-analyzerPhase 1 worker for fp-check:fp-check on the deep path. Given one suspected bug and its alleged location, maps the sink, every source and its trust level, each validation hop, caller guarantees, API contracts, environment protections and history, and returns the Phase 1 report. Not for starting a tri
exploitability-verifierPhase 2 worker for fp-check:fp-check on the deep path. Takes one suspected bug plus its Phase 1 report and settles who the attacker is, how much of the input they control, whether the arithmetic or the race can actually happen, and whether an attack scenario holds together; returns the Phase 2 repor
poc-builderPhase 4 worker for fp-check:fp-check on the deep path. For one bug that survived phases 1 to 3, writes a pseudocode PoC, an executable PoC, a unit-test PoC and a negative PoC into the given $TMPDIR directory without running any of them, and returns the Phase 4 report with exact commands and expected
Go toolkit: version-aware idioms, concurrency fixes proven with the race detector, performance work backed by benchmarks and profiles, read-only code review, tests that match the repository, a GitHub-ready project scaffold and gopls LSP.
5 skills · 3 agents · hooks · LSP
Did a PR, commit or commit range break something that used to work? Pins the before and after states, hunts candidate regressions in the diff, then has three separate fresh agents reproduce, replay and adjudicate each one on live S0 and S1 builds. Sealed evidence, an attempt registry and an HTML/Markdown/JSON report stay in a campaign directory outside the repo; GitHub is only read.
7 skills
Ansible toolkit: role creator in the classic upstream layout (install/configure/service, meta/argument_specs.yml, sentence-case names, true/false, FQCN, ansible-lint production profile), role checker and molecule scaffolder, plus a guard on real ansible-playbook runs
3 skills · 1 agent · hooks
One reported bug, reproduced on the unchanged build, re-run blind by a second agent, fixed at its invariant with a failing-first regression test and a single signed-off local commit, then proven on baseline, patched and reverted worktrees by yet another agent. Records, receipts and hash manifests stay in $TMPDIR; nothing is pushed.
5 skills
Terraform toolkit: module-creator for YAML-driven modules with inheritance and validation layers (OpenStack, VMware, AWS, Azure, GCP, Proxmox), provider-creator for Plugin Framework providers with a GitHub Actions release, plus terraform-ls LSP and safety hooks
2 skills · 1 agent · hooks · LSP
API design and review: OpenAPI 3.1 specs, REST and GraphQL patterns, OWASP API Security Top 10 review with Spectral and Redocly linting
1 skill · 1 agent · hooks
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Secure App Builder" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
Production incident management, triage workflows, and automated incident resolution
4 skills · 2 commands · 6 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.