AI-feature security for your builds: static checks for how an app feeds and trusts a model (a model key in browser code, caller input in the system prompt, secrets inside prompt text, model output reaching raw HTML, eval, a shell or string-built SQL, Markdown that can load attacker images, tools that fetch a URL the model chose), and a red-team probe that sends twelve prompt-injection probes to a LOCAL dev server and grades the replies by canary and markup, with no model in the grading. Requires secure-core.
Plugin secure-ai from marketplace sheahan-skills in maxsheahan/claude-skills. Commands read from the repo's manifest — 3 days ago.
ai-attack-surfaceStatic security check of an app's AI features: a model key in browser code, caller input placed in the system prompt, an environment secret inside prompt text, model output written as raw HTML, passed to eval, a shell or string-built SQL, Markdown rendered with attacker images and links left on, and
ai-redteamProbe your own AI feature for prompt injection on a LOCAL dev server: twelve fixed probes (repeat your instructions, ignore previous, developer role-play, translate or base64 the instructions, an instruction hidden in a document, a delimiter break, Markdown image and link exfiltration, script echo,
Session manager for a markdown vault: hooks that deliver rules, today's daily, open todos, newest lessons and the project hub into every session and re-deliver them after compaction, drift checks on every prompt, session wrap and daily logs, a per-session ledger, ruling capture, per-object decision records, agenda and weekly review, vault scaffolding, and vault health (audit, grooming, canon size budgets).
15 skills · 3 agents · hooks
Check whether a finished draft sounds like the person it is supposed to sound like: build a voice profile, score a draft against it, and get one verdict. The grader diagnoses and never edits.
4 skills · 4 agents
App-layer security for your builds: ASVS-lite checks (credentialed CORS, stack traces in responses, debug routes, sign-out that only clears the browser, object writes without an ownership reference), outbound-fetch guard against SSRF, abuse and spend (uncapped paid APIs, unset caps that mean unlimited, open proxies, per-client ceilings, caller-set LLM params), auth gates that open on their own (a guard skipped when a secret is unset, identity from a bare header, Access trusted only at the edge, open better-auth sign-up), AI route metering (a daily counter reserved before every paid call, with a drop-in guard template), authorization inside MCP tools (every tool-reachable query scoped to the signed-in identity, no identity from tool arguments, privileged tools gated), and tests proven by removing each protection. Requires secure-core.
7 skills
One adapter per supported platform, each stating what it checks and what it cannot see: Cloudflare Pages and Workers (headers on every path, no secrets in [vars], previews off production data, edge hardening), Next.js on OpenNext (server actions, NEXT_PUBLIC_ secrets, static-export headers), Fly and Supabase (RLS, service-role key, [env] secrets, exposed ports), Google Apps Script (web app access, scopes, keys in code), Railway (environment dumps, count-only variable reads), and the Cloudflare account itself through the API or a snapshot (zone SSL, TLS, HTTPS, HSTS, DNSSEC; dangling pages.dev CNAMEs; members without 2FA; preview secrets; orphan KV; data Workers exposed on workers.dev). Requires secure-core.
6 skills
The secure-launch front door: maps a repo's attack surface (routes, auth, outbound fetches, paid APIs and their spend caps, secrets by name, data stores, deploy targets), runs every applicable check in the suite, and writes one findings ledger where each check is PASS, FAIL or UNKNOWN. Required by every other secure-launch plugin.
3 skills · 1 command
Keep secret values out of repos and out of captured sessions: a gitleaks scan proven on planted keys, values never printed; a staged PreToolUse guard that blocks commands which print secrets; a capture-folder scanner; and a per-provider rotation runbook with a shape check that never displays the value. Requires secure-core.
3 skills
AI-powered codebase understanding — analyze, visualize, and explain any project
9 skills · 10 agents · hooks
Open-source AI job search that runs locally in your AI coding CLI: scan job portals, evaluate listings into a structured A-H report with a 1-5 score, tailor your CV, track applications
5 skills · hooks
Rewrite AI-sounding text so it reads like the writer without changing what it says.
1 skill
AI memory system — mine projects and conversations into a searchable palace. 47 MCP tools, auto-save hooks, guided setup.
3 skills · 6 commands · 1 MCP server · hooks
Perform AI code review on Git diffs — supports workspace changes, branch ranges, and single commits with concurrent per-file analysis, codebase search, and deep context-aware review.
2 commands
Eval-gated LLM fine-tuning lifecycle (LoRA/QLoRA, DPO, GRPO/RLVR, vision SFT, quantized export). Use when fine-tuning an open-weights model end-to-end: building the eval harness first, selecting method and model, preparing data, training with Unsloth or TRL, gating checkpoints, and exporting GGUF/FP8.
10 skills · 2 commands · 3 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.