15 plugins from public Claude Code marketplaces. Each one bundles skills, slash commands, agents, hooks or MCP servers that install together.
Showing 15 plugins that match these filters.
unboundcomputeUnboundCompute/security-agent-skills1
volcengine-skillsvolcengine/volcengine-agent-toolkit1Submit the repo with .claude-plugin/marketplace.json and we list every plugin.
Submit marketplaceMulti-agent application-security review. An offensive-security pipeline: map a codebase with Graft, hunt vulnerabilities with a per-class knowledge base, chain findings for escalation, verify real impact, and report (README/JSON/SARIF/doc/PDF).
securityIntercepts detected secrets and PII before they reach the cloud model: deterministic detection, a local vault with TTL, placeholders resolved only where the real call happens. Free and open source, by mcpgate.de.
securitySecurity find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).
securityProduce threat models for open-source projects: the security contract between a project and its users, structured for downstream integrators and vulnerability triagers.
securityWhite-box bug hunting, AI-agent and LLM red-teaming, cloud identity and CI/CD trust, client-app trust surfaces across browser and editor extensions and Electron, wire-protocol and token trust across gRPC, WebSocket, and JWT, enterprise identity lifecycle across SCIM and JIT provisioning, directory sync, MFA and key lifecycle, and Kerberos delegation, infrastructure-as-code and container hardening, mobile app security, smart-contract and DeFi review across EVM and Move, skill and MCP supply-chain vetting, API and object-authorization depth, host privilege escalation, network-service and transport trust, firmware and embedded-software trust, web trust boundaries, authentication and session depth, rate-limiting and multi-tenant isolation, injection and resource-exhaustion depth, file-upload and content handling, defensive detection and logging, supply-chain and dependency risk, business-logic and access-control depth, the classic web-attack classes across XSS, template and command injecti
securityAssess security and compliance posture, query audit logs, and manage CloudTrail for Volcengine accounts and resources.
securityApply the SAIL V2 (Secure AI Lifecycle) framework to secure AI applications and agents — gap analyses, security roadmaps, maturity assessments, compliance checklists (ISO/IEC 42001, EU AI Act, OWASP, DASF, AIUC-1), control prioritization, and vendor RFPs. Grounded in the full 91-risk SAIL catalog.
securityTwo Keycloak skills, split by what the work targets. `keycloak` routes realm-administration requests to the right guidance: passwordless login by magic link, email OTP, passkey-only WebAuthn, or a combined passkey-or-magic-link "0 password required" flow, corporate/enterprise SSO by email domain, social login and enterprise identity-provider federation (Entra ID, Okta, Auth0, and more), organization-membership login restriction for both local and federated logins, credential enrollment for existing users (passkey/TOTP via required actions or an emailed link), and Phase Two cluster/deployment provisioning. `securing-apps` covers the other direction — wiring Keycloak login into your own React, Angular, Vue, Next.js, mobile or backend application, validating its bearer tokens, and registering the OIDC client it needs.
securityPre-launch audit for AI-written code: secrets, auth, payments, store rules and each stack's chronic bugs. Say "vibe check" or "quick vibe check".
securitySet up a secure npm package release process — Trusted Publishing with staged publishes from GitHub Actions — and walk the user through the required npmjs.com and GitHub settings
securityAchieve flow state safely with Claude Code. Auto-approves ~60% of actions, gates risky operations, hard-blocks dangerous patterns. Dual enforcement: skill layer + deterministic hooks. Token cap for cost governance. 120+ unit tests.
securityJailbreak regression benchmark for LLM endpoints with repeatable known-pattern attacks and deterministic scoring
securityGoCortexIO skill bundles for the Palo Alto Networks Cortex Platform.
securitySecure-coding gates for AI-written code: 70 numbered gates mapped to OWASP Top 10 and CWE, plus a pre-write guard that stops the write when it can prove the failure.
securityPre-launch security audit for web apps. Runs OWASP checks via shell scripts, then AI analyzes findings.
security
