Authorized web-application penetration testing with whitebox source-code analysis. Combines OWASP Top 10 dynamic probes (DAST), static code analysis (SAST via semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first and drives targeted URL probing — including authenticated routes, real parameter names, and sink locations — instead of blind crawling. Includes a Playwright-driven probe path for SPA targets and DAST+SAST dual-confirmation. Requires explicit --authorized flag.
Plugin pentest-agent from marketplace xianix-plugins-official in xianix-team/plugins-official. Commands read from the repo's manifest — 10 days ago.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
/pentest-agent:pentestRun an authorized web-application penetration test against a target URL. Combines source-code reconnaissance (whitebox) with OWASP Top 10 dynamic probes, SAST (semgrep), web-ecosystem dependency CVE scanning, and secrets detection. Source-code recon runs first so URL probing is targeted at the appli
code-correlatorDual-confirmation specialist. Reads web-tester.json (DAST) and sast-scanner.json (static) and tags findings that appear in both as `confirmed_by: ["dast","sast"]`. The route inventory work moved to code-recon in Phase 1a; this agent now only does the high-signal DAST+SAST overlap pass. Runs in Phase
code-reconSource-code reconnaissance specialist. Runs before web-tester to extract declared routes, parameters, sinks, auth scheme, and CSRF posture from the codebase. The output (code-recon.json) drives targeted URL probing instead of blind crawling. Invoked by the orchestrator in Phase 1a.
dependency-scannerWeb-ecosystem dependency CVE specialist. Scoped to web application package ecosystems (npm, pip, maven, gem, composer, go.mod) — does NOT scan OS packages or container images (that's infra-scanner's job). Runs CVE scanners at MEDIUM+ severity and emits JSON findings. Invoked by the orchestrator duri
fix-writerTop-finding PR-proposer. Picks the single highest-priority mechanically-fixable finding from the consolidated report and opens a draft PR with the proposed change. Never edits the user's working tree; uses git worktree against origin/<default-branch> so the user's current branch and uncommitted work
orchestratorWeb-application penetration test orchestrator. Validates authorization, loads optional policy config, runs code-recon first (Phase 1a), then fans out four specialist scanners in parallel (web-tester, sast-scanner, dependency-scanner, secrets-scanner), runs code-correlator for DAST+SAST dual-confirma
report-writerPenetration test report compiler. Reads JSON findings from all scanner agents, applies suppression rules from .pentest-ignore, computes delta vs prior scan, and writes pentest-report.html, pentest-report.md, and pentest-report.json into this run's output folder (RUN_DIR), then mirrors them to LATEST
sast-scannerStatic Application Security Testing specialist. Runs semgrep (primary) and language-specific SAST tools to detect code-level vulnerabilities — injection sinks, XSS sinks, unsafe deserialization, path traversal, weak crypto, hardcoded auth bypass. Operates on the local repository, not the live target
secrets-scannerSecrets and credential exposure specialist. Scans the local repository for hardcoded API keys, tokens, and passwords using gitleaks or trufflehog, with an expanded file-extension set and optional git history mode. Never returns actual secret values — only type and location. Emits JSON findings. Invo
web-testerOWASP Top 10 web vulnerability specialist. When code-recon hints are available, probes the discovered routes, parameters, and sinks directly (whitebox mode). Falls back to homepage scraping + generic param defaults for URL-only black-box scans. Detects JS-rendered SPAs and switches to a Playwright-d
bash ${CLAUDE_PLUGIN_ROOT}/hooks/validate-prerequisites.sh
AI-native UX mob elaboration workflow for Greenfield and Brownfield projects. Runs structured, human-gated phase processes with artifact guardrails, approval gates, context isolation, and AI readiness checks before any brownfield work begins.
3 skills · 9 commands · 6 agents · hooks
Autonomous codebase archaeology agent. Triggered by a GitHub Issue or Azure DevOps Work Item tagged 'code-archaeology'. Segments the codebase, maps architecture in business language, extracts coding conventions, runs a due diligence audit for defects and structural problems, classifies all work into typed and prioritised items, and delivers a single structured archaeology report as comments on the originating issue or work item.
7 skills · 1 command · 7 agents · hooks
Automated dependency audit and optimization across all major ecosystems (npm, pip, Cargo, Go modules, Maven, .NET, Bundler). Runs four parallel specialized analyses — vulnerability scanning (CVE/CVSS), SemVer version drift, bundle bloat and unused package detection, and license compliance. Automatically creates a pull request with safe fixes applied; flags critical CVEs and major breaking upgrades for manual review. Works with GitHub, Azure DevOps, and any git repository.
6 skills · 1 command · 5 agents · hooks
Automated impact analysis and risk-based test strategy generation for bug fixes, PBIs, and feature implementations. Gathers work item requirements, code changes across linked pull requests, comments, child items, and referenced documentation — then posts a business-readable Markdown comment series on the PR / issue / work item discussion that serves as the testing guide for QA engineers doing risk-based testing. No HTML files written to the repo.
6 skills · 1 command · 5 agents · hooks
Comprehensive PR review plugin with specialized agents for code quality, security, test coverage, and performance analysis. Works with GitHub, Azure DevOps, Bitbucket, and any git repository.
6 skills · 1 command · 4 agents · hooks
Unified impact analysis and risk-based test strategy plugin. Combines blast radius analysis, dependency tracing, feature mapping, and structured test case generation into a single HTML report. Works from a PR, GitHub issue, or Azure DevOps work item.
1 skill · 1 command · 7 agents · hooks
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.