23 plugins from public Claude Code marketplaces. Each one bundles skills, slash commands, agents, hooks or MCP servers that install together.
Showing 23 plugins that match these filters.
claude-code-plugins-plusjeremylongshore/tons-of-skills-marketplace2
testland-qatestland/qa2
cursor-rules-javajabrena/plinth2
fortifyfortify/skills1Submit the repo with .claude-plugin/marketplace.json and we list every plugin.
Submit marketplaceSAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
Dependency auditing, version management, and security vulnerability scanning
SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation
OpenText Fortify AppSec skills. Use for SAST/DAST/SCA scanning, vulnerability triage, audit workflows, remediation, dependency upgrades, CI/CD pipeline integration, and FCLI commands. Supports Fortify on Demand (FoD) and Software Security Center (SSC).
Comprehensive vulnerability scanning for code, dependencies, and configurations with CVE detection
Professional security tools for Claude Code: vulnerability scanning, compliance, cryptography audit, container & API security
Social media intelligence powered by Xpoz. Search, analyze, and export data from Twitter/X, Instagram, Reddit, and TikTok. Includes 13 skills: best practices reference for query syntax, pagination, field selection and all platform tools; getting started onboarding and setup; social tracking for continuous keyword/user/hashtag monitoring; sentiment analysis across platforms; Twitter data export to CSV (up to 500K rows); influencer discovery and ranking; Reddit discussion research; competitive intelligence and brand comparison; security OSINT and threat monitoring; AI answer tracing (the searches, retrieved pages, and cited sources behind Claude, ChatGPT, and Gemini answers); GEO visibility checking (where a brand appears in AI answers and who wins instead); GEO Reddit influence mapping (the subreddits and threads AI engines cite); buying-intent lead scanning across the four platforms.
Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
security-complianceGit worktrees, branch cleanup, hooks, secret scanning, config hygiene, and guardrails
Infrastructure-as-code testing: Checkov and Trivy misconfiguration scans, OPA, Conftest and Cedar policy tests, Helm chart tests, Terraform plan review. Trivy config is the tfsec successor, with the legacy tfsec workflow in references. A review agent (terraform-plan-reviewer) flags destructive and security-degrading plan changes. Cross-scanner IaC triage is handled by security-finding-triager in qa-security-scanning.
security-complianceVisionCamera v4+ - photo/video capture, QR/barcode scanning, real-time frame processors, zoom/focus/exposure, HDR, location metadata, format selection
BLE scanning/connecting/GATT operations with react-native-ble-plx, NFC tag reading/writing with react-native-nfc-manager, permissions, background mode, battery-efficient patterns
Secrets management, XSS prevention, CSRF protection, dependency scanning, DOMPurify sanitization, CSP headers, CODEOWNERS, HttpOnly cookies
Use when designing or implementing software securely: define security requirements, threat-model a feature, choose secure defaults, design authentication and authorization, handle untrusted data and secrets, evaluate dependencies, design multi-tenant trust boundaries, or review security-sensitive changes. Use for prevention during requirements, design, implementation, and review; not for post-build security assessments or scanning an existing codebase.
Security skills — OWASP audits, secret scanning, and dependency supply-chain hardening
4 security skills: agent security scanning, CodeQL/Semgrep, sandbox hardening, secret protection
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need.
Use when you need to review, improve, or build Spring Boot 4.0.x applications — including proper usage of @SpringBootApplication, component annotations (@Controller, @Service, @Repository), bean definition and scoping, configuration classes and @ConfigurationProperties (with @Validated), component scanning, conditional configuration and profiles, constructor injection, @Primary and @Qualifier for multiple beans of the same type, bean minimization, graceful shutdown, virtual threads, Jakarta EE namespace consistency, and scheduled tasks.
Audit de sécurité — secret scanning, CVE deps, contrôle d'anonymisation, analyse de patterns.
Docker image development patterns for Dockerfile, docker-compose, docker-bake.hcl, and .dockerignore. Multi-stage builds, layer optimization, CI testing patterns (entrypoint bypass, DNS mocking, compose validation), Docker Bake multi-platform, Trivy scanning, network isolation. By Netresearch.
