Static, read-only audit for insecure defaults: secrets with literal fallbacks, shipped credentials, fail-open switches, weak crypto, over-broad access and debug exposure in Go, Python, Bash, TypeScript, Terraform, Ansible and GitHub Actions, each candidate traced to the code that enforces it before it is reported.
Plugin insecure-defaults from marketplace devops in flyoverhead/devops-plugins. Commands read from the repo's manifest — today.
auditHunts insecure defaults in Go, Python, Bash, TypeScript, Terraform, Ansible and GitHub Actions — fallback secrets, shipped passwords, fail-open checks, weak crypto, wide access, debug left on — keeping a hit only once traced to a security sink. Use when asked what runs if a setting is missing, or fo
default-verifierWorker for insecure-defaults:audit when a target yields more than 16 candidates. Takes up to 16 hits of a single category from neighbouring directories, tries to disprove each against the code and the deploy manifests, and answers with one verdict row per hit. Not for starting an audit on its own.
Go toolkit: version-aware idioms, concurrency fixes proven with the race detector, performance work backed by benchmarks and profiles, read-only code review, tests that match the repository, a GitHub-ready project scaffold and gopls LSP.
5 skills · 3 agents · hooks · LSP
Did a PR, commit or commit range break something that used to work? Pins the before and after states, hunts candidate regressions in the diff, then has three separate fresh agents reproduce, replay and adjudicate each one on live S0 and S1 builds. Sealed evidence, an attempt registry and an HTML/Markdown/JSON report stay in a campaign directory outside the repo; GitHub is only read.
7 skills
Ansible toolkit: role creator in the classic upstream layout (install/configure/service, meta/argument_specs.yml, sentence-case names, true/false, FQCN, ansible-lint production profile), role checker and molecule scaffolder, plus a guard on real ansible-playbook runs
3 skills · 1 agent · hooks
One reported bug, reproduced on the unchanged build, re-run blind by a second agent, fixed at its invariant with a failing-first regression test and a single signed-off local commit, then proven on baseline, patched and reverted worktrees by yet another agent. Records, receipts and hash manifests stay in $TMPDIR; nothing is pushed.
5 skills
Terraform toolkit: module-creator for YAML-driven modules with inheritance and validation layers (OpenStack, VMware, AWS, Azure, GCP, Proxmox), provider-creator for Plugin Framework providers with a GitHub Actions release, plus terraform-ls LSP and safety hooks
2 skills · 1 agent · hooks · LSP
Settles whether suspected security findings tied to a code location are real: restates each claim, traces source to sink, proves or refutes attacker control and impact, writes PoCs outside the repo without running them, and passes six gates before a TRUE or FALSE POSITIVE verdict. Takes scanner output, review findings or a pasted GitHub code-scanning alert.
1 skill · 3 agents
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Design fluency for frontend development. 1 skill with 24 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.
1 skill · 4 agents · hooks
AgentDB (external: maintained in ruvnet/agentdb, pinned to commit 27678c3, plugin 3.6.0): agentdb's own standalone MCP server pinned to [email protected] (vector memory with get/list/update/delete for records, patterns and skills, hybrid keyword + vector episode search and an opt-in local cross-encoder, an opt-in aidefence injection guard on memory writes, reflexion, skills, outcome feedback, capabilities report), a memory-specialist agent, 3 skills, /agentdb-status, and the agentdb mod guard that keeps secrets out of memory and refuses delete/reset unless allowed. Complements ruflo-agentdb, which reaches AgentDB through ruflo's server
3 skills · 1 command · 1 agent · 1 MCP server
5 skills + 35 modes + Material Passport pipeline. Includes v3.6.7 cross-model audit gate and v3.6.8 generator-evaluator contract.
5 skills · 16 commands · 4 agents · hooks
Cloud architecture design for AWS/Azure/GCP/OCI, Kubernetes cluster configuration, Terraform infrastructure-as-code, hybrid cloud networking, and multi-cloud cost optimization
8 skills · 7 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.