analyst
claudeResearch and business intelligence agents — web research with source attribution, and company/market analysis from public sources
15 skills · 3 agents
0
claude
security-engineer
Security engineer — threat modelling, security audits, compliance, vulnerability management
/
Plugin security-engineer from marketplace turtlestack in hpsgd/turtlestack. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (7)
bootstrapBootstrap the security documentation structure for a project. Creates docs/security/, generates initial templates and root SECURITY.md, and writes the security-engineer fragment of the security domain doc (the coordinator assembles docs/security/CLAUDE.md). Idempotent — merges missing sections into
dependency-auditAudit project dependencies for known vulnerabilities, outdated packages, and license issues.
reconPassive reconnaissance on a target domain or organisation using open-source intelligence. Maps the attack surface from publicly available sources only. Use at the start of a penetration test or security assessment to understand what's exposed before active testing begins.
security-reviewReview code or configuration for security vulnerabilities — OWASP Top 10, secrets, auth, injection.
supply-chain-auditAudit the software supply chain for integrity risks — source, build, dependencies, and artifact provenance. Produces a SLSA-aligned assessment with findings and hardening recommendations. Use when assessing supply chain posture or after a dependency incident.
threat-modelCreate a threat model using STRIDE — identify threats, attack surfaces, and mitigations for a system or feature.
web-assessmentStructured web application security assessment following OWASP methodology. Covers authentication, authorisation, input validation, session management, API security, and security headers. Use during penetration testing or security reviews of web applications.
Subagents (2)
prompt-injection-testerPrompt injection specialist — adversarial testing of LLM-powered applications for prompt injection, jailbreaks, data extraction, and indirect injection. Use when security-testing AI integrations, evaluating guardrail robustness, or assessing LLM attack surface in production systems.
security-engineerSecurity engineer — threat modelling, security audits, compliance, vulnerability management. Use for security reviews, threat models, compliance documentation, or dependency vulnerability triage.
More from hpsgd/turtlestack
All 50 plugins →thinking
claudeStructured thinking and reasoning skills — first principles, ISC, algorithm, council, red team, and more
16 skills · hooks
0
agile-coach
claudeAgile coach — Scrum and Kanban coaching, ceremony facilitation, retrospective design, team health, flow management, and working agreements. Ongoing per-team presence for engineering, product, discovery, and design teams
13 skills · 1 agent
0
product-manager
claudeProduct manager — owns the why and the what for a product slice: problem validation, continuous discovery, JTBD, roadmap, PRDs, RICE prioritisation, and strategy input to the CPO
13 skills · 1 agent
0
delivery-manager
claudeDelivery manager — RAID logs, dependency tracking, weekly status reporting, release-readiness coordination, organisational impediment removal, multi-team coordination, and GDS service-assessment readiness
11 skills · 1 agent
0
gtm
claudeGo-to-market specialist — positioning, launch strategy, content marketing, competitive analysis
11 skills · 1 agent
0
Similar plugins
mattpocock-skills
claudeMatt Pocock's agent skills for real engineering (grilling, spec/ticket flows, TDD, code review, domain modelling and more).
39 skills
mattpocock/skills 323,108
security-scanning
claudecodexSAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
wshobson/agents 42,461
openviking-memory
claudecodexLong-term semantic memory for Claude Code, powered by OpenViking
5 skills · 1 command · 1 MCP server · hooks
volcengine/OpenViking 42,126
prowler
claudeConnect Claude to Prowler Cloud through the Prowler MCP server. Reads providers, scans, findings, compliance results and resources for AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub and the other providers listed at https://registry.prowler.com, and returns remediation guidance for failed checks. Writes are limited to Prowler Cloud itself: triggering scans, finding triage, mute rules and the mutelist, providers and integrations. Your cloud resources are not changed by the connector.
1 skill · 1 MCP server
prowler-cloud/prowler 15,234
loop-engineering
claudeTriage, budget, constraints, and verifier skills. Pair with npx @cobusgreyling/loop init . --tool claude
14 skills
cobusgreyling/loop-engineering 11,762
improve
claudePoint it at a codebase and it figures out what's worth doing — bugs, perf, tech debt, what to build next — then writes plans any agent can execute. It can hand the work to a cheaper model and review the result. It never edits your code.
1 skill
shadcn/improve 11,576
Maintain security-engineer?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins50 plugins