Authorized infrastructure security scanning plugin. Runs Infrastructure-as-Code misconfiguration detection (Dockerfile, Terraform, Kubernetes, GitHub Actions), CycloneDX SBOM generation, and optional network port + TLS scanning. Optional --fix opens a draft PR for the single top mechanically-fixable finding (Terraform/Kubernetes config flags, GitHub Action SHA-pinning) without ever modifying your working tree. Companion to pentest-agent for users who want infra coverage alongside web-application pentesting. Requires explicit --authorized flag.
Plugin infra-scanner from marketplace xianix-plugins-official in xianix-team/plugins-official. Commands read from the repo's manifest — 10 days ago.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
/infra-scanner:infra-scanRun an authorized infrastructure security scan. Covers Infrastructure-as-Code misconfigurations (Dockerfile, Terraform, Kubernetes, GitHub Actions), SBOM generation, and optional network port + TLS scanning when a target URL is supplied. Produces infra-report.html, infra-report.md, and infra-report.
fix-writerTop-finding PR-proposer for infrastructure misconfigurations. Picks the single highest-priority mechanically-fixable finding from the consolidated infra report and opens a draft PR with the proposed change. Never edits the user's working tree; uses git worktree against origin/<default-branch> so the
iac-scannerInfrastructure-as-Code security specialist. Scans Dockerfiles, docker-compose, Kubernetes manifests, Terraform, and GitHub Actions workflows for misconfigurations and supply-chain risks. Emits JSON findings. Invoked by the orchestrator during Phase 1.
network-scannerNetwork port and service fingerprinting specialist. Extracts the hostname from the target URL and runs a non-aggressive nmap scan to identify open ports and running services. Checks TLS certificate validity. Emits JSON findings. Invoked by the orchestrator during Phase 1.
orchestratorInfrastructure scan orchestrator. Validates authorization, loads optional policy config, coordinates iac-scanner, sbom-generator, and network-scanner in parallel, dispatches report-writer, and optionally runs fix-writer (Phase 3) to open a draft PR for the single top mechanically-fixable finding whe
report-writerInfrastructure scan report compiler. Reads JSON findings from iac-scanner, sbom-generator, and network-scanner, applies suppression rules from .infra-ignore, computes delta vs prior scan, and writes infra-report.html, infra-report.md, and infra-report.json. Invoked by the orchestrator after Phase 1
sbom-generatorSoftware Bill of Materials generator. Uses trivy or syft to produce a CycloneDX SBOM for the local repository and emits a summary JSON. The SBOM is written to infra-sbom.json in the working directory. Invoked by the orchestrator during Phase 1.
bash ${CLAUDE_PLUGIN_ROOT}/hooks/validate-prerequisites.sh
AI-native UX mob elaboration workflow for Greenfield and Brownfield projects. Runs structured, human-gated phase processes with artifact guardrails, approval gates, context isolation, and AI readiness checks before any brownfield work begins.
3 skills · 9 commands · 6 agents · hooks
Autonomous codebase archaeology agent. Triggered by a GitHub Issue or Azure DevOps Work Item tagged 'code-archaeology'. Segments the codebase, maps architecture in business language, extracts coding conventions, runs a due diligence audit for defects and structural problems, classifies all work into typed and prioritised items, and delivers a single structured archaeology report as comments on the originating issue or work item.
7 skills · 1 command · 7 agents · hooks
Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.
6 skills · 1 command · 5 agents · hooks
Automated impact analysis and risk-based test strategy generation for bug fixes, PBIs, and feature implementations. Gathers work item requirements, code changes across linked pull requests, comments, child items, and referenced documentation — then posts a business-readable Markdown comment series on the PR / issue / work item discussion that serves as the testing guide for QA engineers doing risk-based testing. No HTML files written to the repo.
6 skills · 1 command · 5 agents · hooks
Comprehensive PR review plugin with specialized agents for code quality, security, test coverage, and performance analysis. Works with GitHub, Azure DevOps, Bitbucket, and any git repository.
6 skills · 1 command · 4 agents · hooks
Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.
1 command · 9 agents · hooks
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Transform Claude into an Azure expert. This plugin integrates the Azure MCP server and specialized Azure skills to move beyond generic advice. It enables Claude to perform real-world tasks: listing resources, validating deployments, diagnosing infrastructure issues, and optimizing costs across 50+ Azure services.
44 skills · 1 MCP server
Cloud architecture design for AWS/Azure/GCP/OCI, Kubernetes cluster configuration, Terraform infrastructure-as-code, hybrid cloud networking, and multi-cloud cost optimization
8 skills · 7 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.