secrets

Think a feature through with /dev:design, then plan, build, verify and land code changes through one pipeline — /dev:fix, /dev:task, /dev:feature, /dev:build and /dev:deliver — with approval gates, sequential implementers, a subtractive prune pass and stacked PRs. On request, /dev:review fixes what nobody would argue with and posts the rest that survived a refutation pass as inline PR findings, /dev:fix-pr-comments acts on the unresolved PR threads and asks in chat where a fix needs a choice, /dev:review-and-fix loops the two until review calls the branch finished, /dev:explain-pr explains a PR or a whole stacked chain in plain language, and /dev:update-packages updates every dependency in verified batches and flags the deprecated or abandoned ones. Project-specific checks and git flow come from the project's own verify and git-workflow skills, which /dev:setup and /git:setup write

14 skills

Git operations agents get wrong in ways that silently lose work — resolving merge, rebase and cherry-pick conflicts by both sides' intent, a hook that blocks unnamed stashes, pops by no ref or by position, plain force-pushes and, where a project opts in, pushes to its protected branches, and /git:setup, which writes the project's git-workflow skill and .claude/git.json

2 skills · hooks

One-way Telegram notifications: let the agent reach your phone when you are away from the terminal

2 skills · 1 MCP server

Multi-account Google Drive for agents: browse, read Docs as Markdown, download, upload, edit and trash files — each permission switched per project, several Google Cloud apps at once, never deletes permanently

1 skill · 1 MCP server

Multi-account Gmail for agents: search, read as Markdown, drafts with attachments, label rules — configured per project, several Google Cloud apps at once, never sends

1 skill · 1 MCP server

Protocol for effective web research: engine selection, query hygiene, graded negative verdicts and primary-source verification

1 skill · 1 MCP server

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

AgentDB (external: maintained in ruvnet/agentdb, pinned to commit 27678c3, plugin 3.6.0): agentdb's own standalone MCP server pinned to [email protected] (vector memory with get/list/update/delete for records, patterns and skills, hybrid keyword + vector episode search and an opt-in local cross-encoder, an opt-in aidefence injection guard on memory writes, reflexion, skills, outcome feedback, capabilities report), a memory-specialist agent, 3 skills, /agentdb-status, and the agentdb mod guard that keeps secrets out of memory and refuses delete/reset unless allowed. Complements ruflo-agentdb, which reaches AgentDB through ruflo's server

3 skills · 1 command · 1 agent · 1 MCP server

Install the "AAS Secure App Builder" editorial skill bundle for Claude Code.

12 skills

Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture

24 skills · 2 agents

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents