One adapter per supported platform, each stating what it checks and what it cannot see: Cloudflare Pages and Workers (headers on every path, no secrets in [vars], previews off production data, edge hardening), Next.js on OpenNext (server actions, NEXT_PUBLIC_ secrets, static-export headers), Fly and Supabase (RLS, service-role key, [env] secrets, exposed ports), Google Apps Script (web app access, scopes, keys in code), Railway (environment dumps, count-only variable reads), and the Cloudflare account itself through the API or a snapshot (zone SSL, TLS, HTTPS, HSTS, DNSSEC; dangling pages.dev CNAMEs; members without 2FA; preview secrets; orphan KV; data Workers exposed on workers.dev). Requires secure-core.
Plugin secure-platform from marketplace sheahan-skills in maxsheahan/claude-skills. Commands read from the repo's manifest — 3 days ago.
cloudflare-accountAudit a Cloudflare ACCOUNT, not a repo: read every zone's SSL mode (Full strict), minimum TLS, Always Use HTTPS, HSTS and DNSSEC through the API, find CNAMEs pointing at Pages projects that no longer exist, account members without two-factor, Pages previews carrying production secrets, KV namespaces
cloudflare-pages-workersThe Cloudflare Pages and Workers adapter of secure-launch (formerly edge-hardening): check from the repo that framing, HSTS, nosniff and Referrer-Policy reach every path, that no secret sits in wrangler [vars], and that a preview environment does not write production data; then harden at the edge wi
fly-supabaseFly.io and Supabase adapter of secure-launch: no secret in fly.toml [env], only web ports public and over https, row level security enabled on every public table a migration creates, and the service-role key never referenced from browser code. States what it cannot see: secrets actually set on Fly,
google-apps-scriptGoogle Apps Script adapter of secure-launch (for example, a classroom toolkit): the web app's access level in appsscript.json (anonymous while executing as the deployer is critical), explicit OAuth scopes narrowed to what the code needs, and no API keys in Index.html or .gs files (PropertiesService
nextjs-opennextNext.js (16, on Cloudflare via OpenNext) adapter of secure-launch: every exported server action calls a session check (each is a public POST endpoint), no secret travels in a NEXT_PUBLIC_ variable, and a static export does not rely on next.config headers() (ignored there). States what it cannot see:
railwayRailway adapter of secure-launch (for example, a hosted MCP server): code never logs or returns the whole environment, the start command runs a production server, and the dashboard-only settings (service variables, public networking) are read with count-only commands, never plain `railway variables`
Session manager for a markdown vault: hooks that deliver rules, today's daily, open todos, newest lessons and the project hub into every session and re-deliver them after compaction, drift checks on every prompt, session wrap and daily logs, a per-session ledger, ruling capture, per-object decision records, agenda and weekly review, vault scaffolding, and vault health (audit, grooming, canon size budgets).
15 skills · 3 agents · hooks
Check whether a finished draft sounds like the person it is supposed to sound like: build a voice profile, score a draft against it, and get one verdict. The grader diagnoses and never edits.
4 skills · 4 agents
App-layer security for your builds: ASVS-lite checks (credentialed CORS, stack traces in responses, debug routes, sign-out that only clears the browser, object writes without an ownership reference), outbound-fetch guard against SSRF, abuse and spend (uncapped paid APIs, unset caps that mean unlimited, open proxies, per-client ceilings, caller-set LLM params), auth gates that open on their own (a guard skipped when a secret is unset, identity from a bare header, Access trusted only at the edge, open better-auth sign-up), AI route metering (a daily counter reserved before every paid call, with a drop-in guard template), authorization inside MCP tools (every tool-reachable query scoped to the signed-in identity, no identity from tool arguments, privileged tools gated), and tests proven by removing each protection. Requires secure-core.
7 skills
The secure-launch front door: maps a repo's attack surface (routes, auth, outbound fetches, paid APIs and their spend caps, secrets by name, data stores, deploy targets), runs every applicable check in the suite, and writes one findings ledger where each check is PASS, FAIL or UNKNOWN. Required by every other secure-launch plugin.
3 skills · 1 command
Keep secret values out of repos and out of captured sessions: a gitleaks scan proven on planted keys, values never printed; a staged PreToolUse guard that blocks commands which print secrets; a capture-folder scanner; and a per-provider rotation runbook with a shape check that never displays the value. Requires secure-core.
3 skills
Capture a writing voice from a corpus and reproduce it in drafts.
3 skills
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Official Next.js skills: adopt and optimize Cache Components, adopt Partial Prefetching, and verify runtime behavior against a running dev server.
6 skills
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Secure App Builder" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.