App-layer security for your builds: ASVS-lite checks (credentialed CORS, stack traces in responses, debug routes, sign-out that only clears the browser, object writes without an ownership reference), outbound-fetch guard against SSRF, abuse and spend (uncapped paid APIs, unset caps that mean unlimited, open proxies, per-client ceilings, caller-set LLM params), auth gates that open on their own (a guard skipped when a secret is unset, identity from a bare header, Access trusted only at the edge, open better-auth sign-up), AI route metering (a daily counter reserved before every paid call, with a drop-in guard template), authorization inside MCP tools (every tool-reachable query scoped to the signed-in identity, no identity from tool arguments, privileged tools gated), and tests proven by removing each protection. Requires secure-core.
Plugin secure-app from marketplace sheahan-skills in maxsheahan/claude-skills. Commands read from the repo's manifest — 3 days ago.
abuse-and-spendFind every way a stranger can make one of your apps spend money or forward traffic, and what stops them: paid APIs (Anthropic, ElevenLabs, Deepgram, Google Maps and Routes, OpenAI) with no spend cap near the call, caps that mean unlimited when unset, routes that forward request input to a third part
ai-route-meteringMeter every route that reaches a paid model API (Anthropic, OpenAI, Gemini, Vertex, ElevenLabs, Deepgram, Replicate, fal, Perplexity, OpenRouter) in one of your Workers: a shared KV or D1 daily counter reserved BEFORE the call as the hard cap, keyed on the day (never on a caller-supplied id), plus a
asvs-liteA short OWASP ASVS 5.0 pass for one of your web apps, built from the 2026-10-07 audit of a production map app: automated checks for credentialed wildcard CORS, stack traces in responses, unguarded debug or seed routes, a sign-out that only clears the browser, and object write routes with no ownershi
auth-gate-checkFind auth gates that open on their own in one of your Workers or apps: a guard that skips itself when an env secret is missing (`if (!env.X) return next()`, `enabled: !!env.X`, a verification that only runs `if (env.X)`), an identity taken from a request header (cf-access-authenticated-user-email, x
mcp-tool-scopeCheck authorization inside an MCP server's tools, the layer route checks cannot see once /mcp sits behind OAuth (OWASP MCP07, MCP10, MCP06): every SQL read or write a non-owner tool can reach carries a predicate on the signed-in identity, follow-up lookups included; reads filter at the finest grain
mutation-proven-testsProve that tests catch the removal of each security protection, and that they run before every deploy: write a regression test per protection (ownership, sign-in, bounds, limits, signature checks), remove the protection in a throwaway worktree with scripts/mutation_check.py, require DETECTED, show t
outbound-fetch-guardStop server-side request forgery: make every fetch of a URL that came from data (feeds, articles, images, webhooks, user links) go to public internet addresses only, checked at URL, DNS, connect and every redirect, with a size cap, and prove it with a local trap server. Use when the user says 'SSRF'
Session manager for a markdown vault: hooks that deliver rules, today's daily, open todos, newest lessons and the project hub into every session and re-deliver them after compaction, drift checks on every prompt, session wrap and daily logs, a per-session ledger, ruling capture, per-object decision records, agenda and weekly review, vault scaffolding, and vault health (audit, grooming, canon size budgets).
15 skills · 3 agents · hooks
Check whether a finished draft sounds like the person it is supposed to sound like: build a voice profile, score a draft against it, and get one verdict. The grader diagnoses and never edits.
4 skills · 4 agents
One adapter per supported platform, each stating what it checks and what it cannot see: Cloudflare Pages and Workers (headers on every path, no secrets in [vars], previews off production data, edge hardening), Next.js on OpenNext (server actions, NEXT_PUBLIC_ secrets, static-export headers), Fly and Supabase (RLS, service-role key, [env] secrets, exposed ports), Google Apps Script (web app access, scopes, keys in code), Railway (environment dumps, count-only variable reads), and the Cloudflare account itself through the API or a snapshot (zone SSL, TLS, HTTPS, HSTS, DNSSEC; dangling pages.dev CNAMEs; members without 2FA; preview secrets; orphan KV; data Workers exposed on workers.dev). Requires secure-core.
6 skills
The secure-launch front door: maps a repo's attack surface (routes, auth, outbound fetches, paid APIs and their spend caps, secrets by name, data stores, deploy targets), runs every applicable check in the suite, and writes one findings ledger where each check is PASS, FAIL or UNKNOWN. Required by every other secure-launch plugin.
3 skills · 1 command
Keep secret values out of repos and out of captured sessions: a gitleaks scan proven on planted keys, values never printed; a staged PreToolUse guard that blocks commands which print secrets; a capture-folder scanner; and a per-provider rotation runbook with a shape check that never displays the value. Requires secure-core.
3 skills
Capture a writing voice from a corpus and reproduce it in drafts.
3 skills
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.