claudecodex

pro-security

The Security phase. security-architect challenges a specific idea, plan, spec or diff before it ships: trust boundaries, unstated assumptions and the attack that breaks each, returned as a ## Security challenge section (/threat-model, plus a read-only security-architect subagent). security-audit is a read-only whole-repository audit covering secrets in git history, dependency supply chain, CI/CD, containers and IaC, webhooks, LLM/AI attack surface, agent-skill supply chain, OWASP Top 10 and STRIDE, with confidence-scored findings and the security-auditor subagent judging each one independently (/security-audit). One push gate hook holds a git push or gh pr create whose diff against its upstream touches security surface, once per distinct diff, so the architect reviews that diff and nothing else. A key-literal hook on Edit, Write and MultiEdit flags a live-looking key by kind and line number, never by value: warn by default, deny before the write only when mode.key-literal says enforce. Adapted from the cso skill in garrytan/gstack.

0 on GitHubby pro-dev-skillsetv0.4.0MITupdated 5 days agodevelopment
/

Plugin pro-security from marketplace pro-dev-skillset in jodybrewster/pro-dev-skillset. Commands read from the repo's manifest — 4 days ago.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (2)

  • security-architect

    Act as a security architect who challenges a specific idea, plan, design, spec or set of code changes before it ships. Use for "challenge / poke holes in / red-team / threat model my plan, idea, design or spec for security", "what am I missing security-wise", "is this design secure", and "review the

  • security-audit

    Run a read-only security audit over a repository - secrets in git history, dependency supply chain, CI/CD pipeline exposure, container and IaC misconfiguration, webhook and integration gaps, LLM/AI-specific attack surface, agent-skill supply chain, OWASP Top 10, and STRIDE threat modeling. Produces

Slash commands (2)

  • /pro-security:security-audit

    Run a read-only whole-repository security audit - secrets, supply chain, CI/CD, infrastructure, integrations, LLM surface, OWASP, and STRIDE - with confidence-scored findings and an exploit path for each.

  • /pro-security:threat-model

    Challenge an idea, plan, spec or design doc for security before any code exists - unstated assumptions, trust boundaries, abuse cases - and return a pasteable `## Security challenge` section.

Subagents (2)

  • security-architect

    Use for a fresh-context security challenge of a plan, idea, spec or design doc before code exists, or of a diff, branch or commit range before it is pushed. Hand it a plan path or plan text (challenge mode) or a diff spec (diff mode) and nothing else. Returns a `## Security challenge` section or a s

  • security-auditor

    Use to independently judge whether a candidate security finding is real, with fresh context and no access to the reasoning that produced it. Dispatch one per finding during a security audit, or whenever a vulnerability claim needs a skeptical second opinion before it reaches a report or a ticket. Re

Hooks (3)

  • PreToolUse

    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/push-gate.py"

  • PreToolUse

    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/key-literal.py"

  • PostToolUse

    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/key-literal.py"

View source on GitHub jodybrewster.dev

More from jodybrewster/pro-dev-skillset

All 21 plugins →

pro-design

claudecodex

Frontend design skills. Build: emil-design-eng (start here for components and screens), landing-page-design (single-CTA conversion landing page with a visual system), build-awwwards-quality-sites (immersive scroll-storytelling marketing sites), apple-design (Apple HIG principles). Motion: animate (add or refine animation on an already built site), animation-vocabulary (turn vague motion words into exact animation terms), motion (Framer Motion implementation + discipline), motion-system. Review and fix: screen-critique with the /critique-screen command (judge a rendered screen against seven critique lenses), interface-review (review UI changes in a PR, branch, or working tree with regression detection), better-interface (the holistic consolidation and verdict layer over the better-* family; uninstalled domains report as Not reviewed), better-layout (spacing, alignment, and grouping to the pixel), perception-laws (Gestalt laws, Von Restorff, visual hierarchy), accessibility-audit (WCAG 2.2 POUR). Systems: design tokens, typography scale, shadcn/ui composition, stitch-skill (create/update DESIGN.MD), taste-skill (targeted visual polish pass). Bridges (not vendored): impeccable-bridge for the full end-to-end UI/UX pass via /pro-dev install, taste-skills-bridge for the Leonxlnx anti-slop, visual-style, image-gen, and brand-kit library via /pro-dev install, plus web-design-engineer-bridge (reference-grounded HTML artifacts, style recipes, design scoring), tastemaker-bridge (extract tokens from a reference image's real pixels and lock the style across a project), and mengto-skills-bridge (scroll storytelling, WebGL and shader effects, video-to-superprompt) - all three installed with /pro-dev install. Install figma from claude-plugins-official via install-companions.sh. Bridges: react-patterns-bridge (Vercel composition and view-transition patterns). Lint: web-design-guidelines (file:line check of UI code against Vercel Web Interface Guidelines at a pinned commit). /pro-des

26 skills · 2 commands

0

pro-spdd

claudecodex

Structured Prompt-Driven Development workflow: story decomposition, analysis, REASONS Canvas, generation, prompt update, sync, API test, code review, and reverse engineering. Includes openspdd-ts CLI (bin/openspdd.mjs) for installing templates into any AI editor. Depends on pro-execution for disciplined implementation workflows. Adapted from gszhangwei/open-spdd.

9 skills · 10 commands

0

pro-quality

claudecodex

Quality gate skills: requesting + receiving code review, verification-before-completion, user-validation. A Stop hook suggests /validate after repo changes; /validate writes a validation handoff (what changed, what was verified, what needs your eyes) to .pro-dev/validation/latest.md. Ships three documentation subagents (technical-writer, documentation-engineer, api-documenter) with /document and /api-docs, adapted from VoltAgent/awesome-codex-subagents. Nudges api-documenter when an OpenAPI/GraphQL/proto contract changes, and blocks plan saves outside the project directory. A floor guard warns on git push and gh pr create when a diff lowers the bar; /constraints writes a repo's CONSTRAINTS.md. A code-reviewer agent (Opus, read-only) reviews with fresh context from a four-field handoff.

5 skills · 6 commands · 6 agents · hooks

0

pro-ai-sdlc

claudecodex

The AI-native SDLC as one stack-agnostic plugin. Stage commands: /intent (interview an idea or bug into intent/<id>-<slug>/intent.md, or intent/<date>-<slug>/ in a repo with no shortcode), /spec, /plan, /execute (build an approved plan in its own worktree and open the PR, never merge), /adr (record a decision with no change behind it), /review (REVIEW.md's bug, security and compliance passes), /pr-babysit (loop a PR to green, never merge); repo setup for the loop moved to /pro-dev install in pro-core. The templates the commands read ship as files under templates/ (intent, spec, plan, adr, REVIEW) so other tools can read them. Subagents: researcher (haiku), verifier (sonnet), simplifier (sonnet) and reviewer (opus). Four hooks ship in warn mode behind the mode files: protect-tests (no test edits in fix mode), plan-sync (a Stop hook that flags code changed with no plan.md update), production-gate (flags push to main, deploys, publishes and merges) and change-id (flags a commit on a change-id branch whose subject does not start with the id). /execute pauses before steps that touch auth, migrations, payments, deploys or secrets unless the plan's Risks names them; every plan cites references/definition-of-done.md. A doubt-driven-development skill sends a hard-to-undo build step to a fresh-context reviewer before the next step, with an optional Codex second opinion.

1 skill · 9 commands · 4 agents · hooks

0

pro-pdd

claudecodex

Default Define + Plan skills: interview-me and idea-refine (Define-phase intent extraction and idea refinement, forked from agent-skills), brainstorming, written implementation plans, adhd — parallel divergent ideation under cognitive frames via /adhd (forked from UditAkhourii/adhd), and lavish — a bridge plus /lavish command for the kunchenguid/lavish-axi CLI that renders agent output (plans, tables, diagrams, diffs, reports) as reviewable HTML artifacts the user annotates in the browser (installed on demand via /pro-dev install). Depends on pro-execution for worktree and subagent execution handoff. /pro-pdd:install sets up its engines when pro-core is installed.

6 skills · 3 commands

0

pro-core

claudecodex

Universal base skills and guardrails: find-skills, using-pro-dev (the cross-lifecycle router that maps a task to the right phase and skill, including bridge skills like impeccable-bridge, qa-suite, and lavish), and dream (memory consolidation over Claude Code auto-memory: scans session transcripts for corrections, decisions, preferences, and patterns, merges the findings into the memory files, and rebuilds a lean MEMORY.md index under 200 lines). /gh universal GitHub workflow command (briefing, new, commit, push, pr, ship, sync, resolve). /dream runs a consolidation on demand, with dry-run and status modes. /kaizen raises the bar one notch per run from a planning repo: it judges each tracked project against its own profile and current practice, red-teams it, applies one reversible improvement, briefs the rest and writes a dated ledger and HTML report; /kaizen init scaffolds the planning repo. PreToolUse hook blocks dangerous Bash (force-push to main, rm -rf /, .env redirects, sudo, chmod 777, curl|bash) and reads each git push for the forms that block misses (a delete of a protected branch, refs/heads/main, a bare push on main, git -C, --all, the default branch or a declared one), which it flags under its own protected-push mode: warn by default, deny only when mode.protected-push says enforce. A second PreToolUse hook on Read, Grep and Bash flags a read of a dotenv file (not .env.example), a private SSH key, a .pem file, .npmrc, a credentials file or a service-account JSON under its own secret-read mode: warn by default, deny only when mode.secret-read says enforce. scripts/env-check.py says whether a key is set (present, empty or missing) and never prints its value. A second PreToolUse Bash hook flags rm, rmdir, unlink, find -delete, find -exec rm and git clean whose target resolves outside the project root, with the temp folders and the pro-dev state folder exempt, under its own delete-outside mode: warn by default, deny only when mode.delete-outside says enforce

3 skills · 4 commands · hooks

0

Similar plugins

superpowers

claudecodex

Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques

15 skills · hooks

obra/superpowers 316,836

context7

claudecodex

Up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your coding agent's context.

1 MCP server

upstash/context7 64,709

Build powerful, stateful CLI interfaces for any GUI application using the cli-anything harness methodology.

5 commands

HKUDS/CLI-Anything 58,665

Automates browser interactions for web testing, form filling, screenshots, and data extraction

12 skills

vercel-labs/agent-browser 50,373

Use Alibaba Open Code Review from local Codex.

2 skills

alibaba/open-code-review 50,068

slidev

claude

Claude Code skill for creating and presenting Slidev slidedecks

1 skill

slidevjs/slidev 49,452

Maintain pro-security?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins21 plugins