11 plugins from public Claude Code marketplaces. Each one bundles skills, slash commands, agents, hooks or MCP servers that install together.
Showing 11 plugins that match these filters.
avtr-antidoteAvtr99/antidote1
vibemasterliustack/vibemaster1Submit the repo with .claude-plugin/marketplace.json and we list every plugin.
Submit marketplaceAll structured thinking skills in one install: root-cause analysis, trade-offs, pre-mortems, prioritization, estimation, creative and critical thinking, plus a selector that picks the right method.
Validates security patches against the reported bug, root-cause variants, and surrounding behavior. Returns reproducible failures to repair and validation gaps, with pinned inputs and saved evidence. Bundles a validate-patch dynamic workflow for Claude Code.
Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).
securityReview a code change for correctness, security, maintainability, and test adequacy, and reach a defensible verdict. Use when reviewing a pull request, diff, patch, or AI-generated change; when scoping an oversized review into reviewable units; when writing or triaging review comments; when assigning reviewers or setting review policy; or when investigating why a defect escaped review. Covers change sizing and attention budgets, risk-tiered checklists, severity-labeled comments, verdict and residual-risk records, review metrics that resist gaming, and the measured limits of checklists and AI reviewers. Do not use for implementing the requested change, root-cause debugging of a failing test or incident (use systematic-debugging), security assessment of a whole system (use security-audit-methodology), designing new code securely (use secure-software-engineering), architecture review across systems (use software-architecture), or reverse-engineering an unfamiliar codebase (use software-arc
Analyze gaps by comparing a defined current state with a justified target state, characterizing causes and uncertainty, prioritizing actionable interventions, and producing traceable matrices, roadmaps, and decision records. Use for capability, process, compliance, readiness, maturity, operating-model, or research-evidence gaps. Do not use for a vague list of problems, a standalone root-cause analysis, a generic SWOT, or legal or audit certification advice without a governing standard and qualified owner.
Compare intended product outcomes against observed results to close the launch-to-learning loop: collect post-launch evidence, distinguish expected from observed from uncertain from inferred claims, update assumptions, assess feature health, and choose among continue/improve/harvest/pivot/pause/retire — including retirement lifecycles with deprecation, migration, customer treatment, and retained reusable learning. Do not use for incident postmortems or root-cause analysis (routes to incident-learning or site-reliability-engineering); do not use for analytics instrumentation or metric dashboard design (routes to product-analytics-and-measurement); do not use arbitrary thresholds as universal retirement rules — decisions require human judgment and context.
Design and apply QA methodology for software teams: test strategy, regression testing, CI failure triage, test automation, quality gates and metrics, risk-based testing, exploratory testing, test design techniques, AI code quality gates (independent verification, artifact provenance, spec-first oracles, AI-review-comment triage, acceptance-criteria testability for Spec-Driven Development), mutation-guided test hardening and review evidence (surviving mutants, weak assertions, diff-aware mutation testing), agentic eval design (dataset test design, judge-as-system-under-test, flaky-eval discipline), QA career levels (Senior/Staff/Principal), and SDET engineering (test infrastructure, gTAA, CI/CD integration). Do not use for root-cause debugging of production incidents, security implementation or threat modeling, or evaluation framework governance and statistical analysis — route those to systematic-debugging, secure-software-engineering, and agent-evals-and-observability respectively.
Design, automate, and operate end-to-end software releases: release process models and pipelines (trunk-based development, CD stages, release trains), progressive delivery and feature flags, versioning and artifact management (SemVer, conventional commits, changelogs, SBOM/provenance), readiness and quality gates, rollback and recovery planning, change-management and audit compliance (SOC 2, SOX, PCI), DORA metrics, and multi-team release coordination. Do not use for application feature implementation (backend-engineering/frontend-engineering), production incident root-cause debugging or on-call/SLO operations (systematic-debugging / site-reliability-engineering), security implementation or threat modeling (secure-software-engineering), or internal developer platform construction (platform-engineering).
Stop AI agents from patching symptoms. Forces structural root-cause fixes over symptom patching in any language or stack.
Root-cause digging across any domain: reproduce, falsifiable hypotheses, single-variable evidence, fix only after the cause accounts for the symptom, delivered as issue.md
Exhaustive code review and security audit checklist for any language: root-cause facets from real vulnerabilities, 46 general dimensions, 78 specialties by target type, 33 language and format tables including configuration, regex and GPU programs, execution environment checks, threat model and report format. Markdown only, read-only by default.
security
