Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.
Plugin dependency-optimizer from marketplace xianix-plugins-official in xianix-team/plugins-official. Commands read from the repo's manifest — 10 days ago.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
audit-licensesRun a license compliance audit on all project dependencies. Flags copyleft, unknown, and policy-violating licenses. Usage: /audit-licenses
check-outdatedShow all outdated dependencies with current vs latest versions. Read-only report — no changes applied. Usage: /check-outdated
fix-vulnerabilitiesScan for known CVEs and security advisories only, and apply safe patches immediately. Usage: /fix-vulnerabilities
optimize-dependenciesRun a full dependency optimization — scans for CVEs, version drift, bloat, and license issues, then automatically creates a PR with safe fixes. Usage: /optimize-dependencies
scan-dependenciesRun a full dependency analysis and produce a report without applying any fixes or opening a PR. Usage: /scan-dependencies
update-versionsApply all safe (patch and minor) dependency version updates without running a full optimization. Usage: /update-versions
/dependency-optimizer:dependency-optimizerRun a full project dependency audit and optimization. Analyzes outdated packages, security vulnerabilities, license compliance, and bundle size impact. Usage: /dependency-optimizer
bloat-analyzerDetects unused dependencies (zero imports in source), duplicate transitive packages, and heavy packages with lighter alternatives. Estimates bundle size savings for frontend projects. Invoked by the orchestrator as a parallel sub-agent.
license-auditorAudits all dependency licenses for copyleft violations, unknown licenses, corporate policy conflicts, and license incompatibilities. Invoked by the orchestrator as a parallel sub-agent.
orchestratorDependency optimization orchestrator. Detects the package ecosystem, runs four parallel specialized analyses (vulnerability scan, version drift, bloat, license), compiles a structured report, and either opens a PR with automated fixes or produces a manual-intervention report.
version-updaterAnalyzes dependency version drift across all detected manifests. Classifies each outdated package as patch/minor/major, assesses breaking-change risk, and produces safe update commands. Invoked by the orchestrator as a parallel sub-agent.
vulnerability-scannerScans project dependencies for known CVEs, security advisories, deprecated packages, and supply-chain risks. Classifies findings by severity and recommends patched versions. Invoked by the orchestrator as a parallel sub-agent.
bash ${CLAUDE_PLUGIN_ROOT}/hooks/validate-prerequisites.sh
bash ${CLAUDE_PLUGIN_ROOT}/hooks/notify-push.sh
AI-native UX mob elaboration workflow for Greenfield and Brownfield projects. Runs structured, human-gated phase processes with artifact guardrails, approval gates, context isolation, and AI readiness checks before any brownfield work begins.
3 skills · 9 commands · 6 agents · hooks
Autonomous codebase archaeology agent. Triggered by a GitHub Issue or Azure DevOps Work Item tagged 'code-archaeology'. Segments the codebase, maps architecture in business language, extracts coding conventions, runs a due diligence audit for defects and structural problems, classifies all work into typed and prioritised items, and delivers a single structured archaeology report as comments on the originating issue or work item.
7 skills · 1 command · 7 agents · hooks
Automated impact analysis and risk-based test strategy generation for bug fixes, PBIs, and feature implementations. Gathers work item requirements, code changes across linked pull requests, comments, child items, and referenced documentation — then posts a business-readable Markdown comment series on the PR / issue / work item discussion that serves as the testing guide for QA engineers doing risk-based testing. No HTML files written to the repo.
6 skills · 1 command · 5 agents · hooks
Comprehensive PR review plugin with specialized agents for code quality, security, test coverage, and performance analysis. Works with GitHub, Azure DevOps, Bitbucket, and any git repository.
6 skills · 1 command · 4 agents · hooks
Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.
1 command · 9 agents · hooks
Unified impact analysis and risk-based test strategy plugin. Combines blast radius analysis, dependency tracing, feature mapping, and structured test case generation into a single HTML report. Works from a PR, GitHub issue, or Azure DevOps work item.
1 skill · 1 command · 7 agents · hooks
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.