Dependency risk without auto-bumps: production npm audit with per-advisory reachability triage recorded in the repo, lockfile presence, GitHub Actions pinned to SHAs with secrets scoped per step, wrangler pinned, and a check that the BUILT code resolves and loads under plain Node (vitest resolves differently). Requires secure-core.
Plugin secure-supply-chain from marketplace sheahan-skills in maxsheahan/claude-skills. Commands read from the repo's manifest — 3 days ago.
built-code-load-checkBefore trusting a dependency bump, prove the BUILT output resolves and loads under plain Node, not the test runner: every bare import and require in dist/ resolved with Node's own resolver (nothing executed), then each declared side-effect-free module imported in a child Node with an empty environme
dependency-auditAudit a repo's supply chain without changing it: production npm audit with a reachable-or-not verdict per advisory recorded in security/advisory-triage.json, lockfile presence per package folder, GitHub Actions pinned to commit SHAs, secrets scoped to the one workflow step that uses them, and wrangl
Session manager for a markdown vault: hooks that deliver rules, today's daily, open todos, newest lessons and the project hub into every session and re-deliver them after compaction, drift checks on every prompt, session wrap and daily logs, a per-session ledger, ruling capture, per-object decision records, agenda and weekly review, vault scaffolding, and vault health (audit, grooming, canon size budgets).
15 skills · 3 agents · hooks
Check whether a finished draft sounds like the person it is supposed to sound like: build a voice profile, score a draft against it, and get one verdict. The grader diagnoses and never edits.
4 skills · 4 agents
App-layer security for your builds: ASVS-lite checks (credentialed CORS, stack traces in responses, debug routes, sign-out that only clears the browser, object writes without an ownership reference), outbound-fetch guard against SSRF, abuse and spend (uncapped paid APIs, unset caps that mean unlimited, open proxies, per-client ceilings, caller-set LLM params), auth gates that open on their own (a guard skipped when a secret is unset, identity from a bare header, Access trusted only at the edge, open better-auth sign-up), AI route metering (a daily counter reserved before every paid call, with a drop-in guard template), authorization inside MCP tools (every tool-reachable query scoped to the signed-in identity, no identity from tool arguments, privileged tools gated), and tests proven by removing each protection. Requires secure-core.
7 skills
One adapter per supported platform, each stating what it checks and what it cannot see: Cloudflare Pages and Workers (headers on every path, no secrets in [vars], previews off production data, edge hardening), Next.js on OpenNext (server actions, NEXT_PUBLIC_ secrets, static-export headers), Fly and Supabase (RLS, service-role key, [env] secrets, exposed ports), Google Apps Script (web app access, scopes, keys in code), Railway (environment dumps, count-only variable reads), and the Cloudflare account itself through the API or a snapshot (zone SSL, TLS, HTTPS, HSTS, DNSSEC; dangling pages.dev CNAMEs; members without 2FA; preview secrets; orphan KV; data Workers exposed on workers.dev). Requires secure-core.
6 skills
The secure-launch front door: maps a repo's attack surface (routes, auth, outbound fetches, paid APIs and their spend caps, secrets by name, data stores, deploy targets), runs every applicable check in the suite, and writes one findings ledger where each check is PASS, FAIL or UNKNOWN. Required by every other secure-launch plugin.
3 skills · 1 command
Keep secret values out of repos and out of captured sessions: a gitleaks scan proven on planted keys, values never printed; a staged PreToolUse guard that blocks commands which print secrets; a capture-folder scanner; and a per-provider rotation runbook with a shape check that never displays the value. Requires secure-core.
3 skills
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.