Claude Code 플러그인
공개 Claude Code 마켓플레이스의 플러그인 11개입니다. 각 플러그인은 함께 설치되는 스킬, 슬래시 명령, 에이전트, 훅 또는 MCP 서버를 묶습니다.
필터와 일치하는 11개의 플러그인을 표시합니다. 필터 초기화
All structured thinking skills in one install: root-cause analysis, trade-offs, pre-mortems, prioritization, estimation, creative and critical thinking, plus a selector that picks the right method.
Validates security patches against the reported bug, root-cause variants, and surrounding behavior. Returns reproducible failures to repair and validation gaps, with pinned inputs and saved evidence. Bundles a validate-patch dynamic workflow for Claude Code.
Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).
security
Review a code change for correctness, security, maintainability, and test adequacy, and reach a defensible verdict. Use when reviewing a pull request, diff, patch, or AI-generated change; when scoping an oversized review into reviewable units; when writing or triaging review comments; when assigning reviewers or setting review policy; or when investigating why a defect escaped review. Covers change sizing and attention budgets, risk-tiered checklists, severity-labeled comments, verdict and residual-risk records, review metrics that resist gaming, and the measured limits of checklists and AI reviewers. Do not use for implementing the requested change, root-cause debugging of a failing test or incident (use systematic-debugging), security assessment of a whole system (use security-audit-methodology), designing new code securely (use secure-software-engineering), architecture review across systems (use software-architecture), or reverse-engineering an unfamiliar codebase (use software-arc
Analyze gaps by comparing a defined current state with a justified target state, characterizing causes and uncertainty, prioritizing actionable interventions, and producing traceable matrices, roadmaps, and decision records. Use for capability, process, compliance, readiness, maturity, operating-model, or research-evidence gaps. Do not use for a vague list of problems, a standalone root-cause analysis, a generic SWOT, or legal or audit certification advice without a governing standard and qualified owner.
Compare intended product outcomes against observed results to close the launch-to-learning loop: collect post-launch evidence, distinguish expected from observed from uncertain from inferred claims, update assumptions, assess feature health, and choose among continue/improve/harvest/pivot/pause/retire — including retirement lifecycles with deprecation, migration, customer treatment, and retained reusable learning. Do not use for incident postmortems or root-cause analysis (routes to incident-learning or site-reliability-engineering); do not use for analytics instrumentation or metric dashboard design (routes to product-analytics-and-measurement); do not use arbitrary thresholds as universal retirement rules — decisions require human judgment and context.
Design and apply QA methodology for software teams: test strategy, regression testing, CI failure triage, test automation, quality gates and metrics, risk-based testing, exploratory testing, test design techniques, AI code quality gates (independent verification, artifact provenance, spec-first oracles, AI-review-comment triage, acceptance-criteria testability for Spec-Driven Development), mutation-guided test hardening and review evidence (surviving mutants, weak assertions, diff-aware mutation testing), agentic eval design (dataset test design, judge-as-system-under-test, flaky-eval discipline), QA career levels (Senior/Staff/Principal), and SDET engineering (test infrastructure, gTAA, CI/CD integration). Do not use for root-cause debugging of production incidents, security implementation or threat modeling, or evaluation framework governance and statistical analysis — route those to systematic-debugging, secure-software-engineering, and agent-evals-and-observability respectively.
Design, automate, and operate end-to-end software releases: release process models and pipelines (trunk-based development, CD stages, release trains), progressive delivery and feature flags, versioning and artifact management (SemVer, conventional commits, changelogs, SBOM/provenance), readiness and quality gates, rollback and recovery planning, change-management and audit compliance (SOC 2, SOX, PCI), DORA metrics, and multi-team release coordination. Do not use for application feature implementation (backend-engineering/frontend-engineering), production incident root-cause debugging or on-call/SLO operations (systematic-debugging / site-reliability-engineering), security implementation or threat modeling (secure-software-engineering), or internal developer platform construction (platform-engineering).
Stop AI agents from patching symptoms. Forces structural root-cause fixes over symptom patching in any language or stack.
Root-cause digging across any domain: reproduce, falsifiable hypotheses, single-variable evidence, fix only after the cause accounts for the symptom, delivered as issue.md
Goal-first engineering ownership — investigate, root-cause, design, plan, then delegate implementation unit-by-unit to implementation-loop, with honest artifact-level verification. Requires the implementation-loop plugin plus an authenticated backend CLI.