Read the threat models a repository keeps in the Open Threat Model format, decide with the user what each threat means here, and land them in Noru's risk register linked to the organization's own controls — flagging the components other pieces found that the model leaves out.
Plugin threat-model from marketplace noru-grc-engineering in noru-tech/noru-grc-engineering. Commands read from the repo's manifest — 6 days ago.
threat-modelRead a repository's committed threat model (Open Threat Model JSON), decide with the user what each threat means in their environment, and land the threats in Noru's risk register linked to the organization's own controls — reporting the components other pieces found that the model leaves out. Use w
/threat-model:diffShow exactly which risks would be created in Noru, which would change, which would be resolved, and which control links would be added. Reads only; writes nothing.
/threat-model:pushFile the reviewed threats in Noru's risk register, link them to the organization's controls, and resolve the ones the model no longer names. Writes to the customer's system of record — requires explicit confirmation.
/threat-model:scanAsk Noru what this piece already filed and which controls exist, read the repository's Open Threat Model files, and write a reviewable .noru/threat-model.yml. Writes nothing to Noru.
noruconnects to: https://api.noru.tech/v1/mcp
Run consolidated branch reviews across independently installed GRC pieces, summarize live Noru work requiring attention with read scopes only, and check shared connection and repository context.
1 skill · 5 commands · 1 MCP server
Install, plan, apply, and verify enforceable GitHub merge gates for the GRC Engineering workflow without granting the Noru hub administration rights.
1 skill · 6 commands
Scan a repository for the AI systems, model providers and oversight points it actually contains, review the manifest in a PR, and land it in Noru as assets, vendors and evidence.
1 skill · 3 commands · 1 MCP server
Assemble the evidence bundle, sampling and workpapers an auditor asks for — for one framework over one audit window — from Noru's graph plus the local files an integration cannot reach, and land the tested conclusion for each control back in Noru.
1 skill · 3 commands · 1 MCP server
Who wrote each change, who approved it, who merged it and who deployed it, for one window — with every separation that did not hold owned by a named person, and the forge configuration that was supposed to keep them apart.
1 skill · 3 commands · 1 MCP server
Inventory the coding agents, MCP servers and plugins a repository's development process depends on, decide with the user which organization stands behind each one, and land them in Noru as vendors plus one evidence record for the window — never anything per person.
1 skill · 3 commands · 1 MCP server
MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint
13 skills · 1 command · 1 agent · hooks
Install the "AAS Privacy & Compliance Engineering" workflow plugin from Agentic Awesome Skills.
6 skills
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
5 skills
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
Twilio Skills provide procedural knowledge for AI coding agents — which APIs to use, in what order, and what to avoid. Covers SMS, Voice, WhatsApp, Verify, SendGrid, Compliance, and 30+ products.
57 skills · 1 MCP server
14 regulatory affairs & quality management skills for HealthTech/MedTech: ISO 13485 QMS, MDR 2017/745, FDA 510(k)/PMA, GDPR/DSGVO, ISO 27001 ISMS, CAPA management, risk management, clinical evaluation, SOC 2 compliance.
21 skills
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.