31 plugins from public Claude Code marketplaces. Each one bundles skills, slash commands, agents, hooks or MCP servers that install together.
Showing 31 plugins that match these filters.
claude-code-plugins-plusjeremylongshore/tons-of-skills-marketplace3
trailofbitstrailofbits/skills2
lawve-ailawve-ai/awesome-legal-skills2
agents-incagents-inc/skills2Submit the repo with .claude-plugin/marketplace.json and we list every plugin.
Submit marketplace45 advanced engineering skills: agent designer, agent workflow designer, RAG architect, database designer + schema designer + SQL assistant, migration architect, observability designer, dependency auditor, changelog generator, API design reviewer, API test suite builder, CI/CD pipeline builder, MCP server builder, skill security auditor, skill tester, performance profiler, focused-fix, browser-automation, full-page-screenshot, git-worktree-manager, monorepo-navigator, codebase-onboarding, interview-system-designer, runbook-generator, spec-driven-workflow, secrets-vault-manager, env-secrets-manager, pr-review-expert, self-eval, tc-tracker, feature-flags-architect, kubernetes-operator, chaos-engineering, ship-gate, slo-architect (error-budget + multi-window burn-rate alerts per Google SRE Workbook), tech-debt-tracker, agent-regression-evals, coding-agent-rollout, commit-craft, agent-run-forensics and i18n-localization. Agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, Op
Answer questions about past agent runs from the recording, not from memory. Three read-only stdlib scripts over the session transcripts Claude Code and Codex already write: a finder that locates the run by repo, time window, touched file or command text; a timeline that numbers every step with its exit code, lists every file changed (flagging changes the agent never mentioned) and walks back from any step with each causal edge labelled recorded or inferred by a named rule; and a claim checker that tests a summary's claims (ran, passed, edited, not-edited, read) against the run and catches tests that passed before a later edit and exit codes that belong to the last command of a pipe. Secrets are always redacted. A UserPromptSubmit hook gives the agent this session's transcript path when a prompt asks about past work. Ships cs-run-forensics agent, /cs-run-forensics and /cs-check-claims commands and 3 cited references.
Turn a tangled working tree into a clean, reviewable commit series. Three deterministic stdlib scripts over git: a series planner that groups changes into commits in build-safe order (manifest with lockfile, pure moves, formatting, each module's change with its tests, docs, CI), holds back .env and key files, and flags mixed formatting and moves whose callers would break; a secret gate that scans staged or pushed lines for provider tokens, high-entropy secrets, sensitive files and conflict markers and blocks before the commit exists, with redacted output and reasoned waivers; and a message linter that blocks vague subjects, missing why on large changes and pending fixup commits, matching the repo's own convention. Ships pre-commit, commit-msg and pre-push hooks, cs-commit-craft agent, /cs-commit-craft and /cs-commit-check commands and 3 cited references.
Roll Claude Code out to a team with guardrails you can check. Four deterministic stdlib scripts: a settings linter that reads shared, local, user and managed settings together (array merge, deny-ask-allow order) and blocks blanket shell allows, pre-approved destructive commands and committed credentials; an MCP and plugin inventory that blocks anything missing from your approved list or holding a literal secret, and flags unpinned or plain-http servers; a CLAUDE.md layering audit that resolves every layer and @import and flags broken imports, contradictions, secrets and resident size; and a privacy-safe adoption tracker that turns local session files into counts only and classifies the rollout as PILOT, SPREADING, EMBEDDED or STALLED. Ships cs-claude-code-rollout agent, /cs-claude-rollout and /cs-claude-settings-lint commands, 3 references, a baseline managed-settings policy and a four-phase rollout plan.
SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation
GABBE security skills (21): security, privacy and AI safety: access control, secrets, cryptography, prompt-injection defence, red teaming, compliance and legal review.
Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production
Prepares a repository for public open-source release: secrets-history hygiene, license selection, documentation and CI readiness checks, and language-specific packaging and release guidance.
Manage environment configurations and secrets across deployments
Scan codebase for exposed secrets, API keys, passwords, and sensitive credentials
Integrate with secrets managers (Vault, AWS Secrets Manager, etc)
Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
security-complianceAudit an AI agent skill before installing it. Use proactively whenever the user is about to add, install, enable, or evaluate an unfamiliar skill — including phrases like "audit this skill", "is this skill safe", "scan skill before install", "check skill for malicious code", "review this plugin", or any pre-install gate on an untrusted, third-party, or community-distributed skill bundle. Runs ten categories of static checks (code execution, network exfiltration, credential harvesting, persistence, prompt injection, supply-chain hooks, obfuscation, destructive filesystem ops, secrets, Trojan Source / homoglyphs) and emits a PASS / WARN / FAIL verdict.
Practitioner skill for EU Regulation 2023/2854 (Data Act). Covers Chapters II-VII (IoT data access, mandatory B2B sharing, unfair contract terms, public-sector exceptional need, cloud switching, third-country governmental access) and Chapter VIII (interoperability and smart contracts, gate-only). Use when the user asks about Data Act rights or obligations, drafts a Data Act notice or letter, reviews a data-sharing or cloud-switching contract under the Data Act, runs a Data Act gap analysis, or asks how the Data Act interacts with GDPR, the DMA, the Trade Secrets Directive, or sectoral law. Triggers include "Data Act", "Datengesetz", "Regulation (EU) 2023/2854", "Art. 4(1) request", "Art. 5(1) third-party request", "trade-secret handbrake", "cloud switching obligations", "Chapter VI", "Ch V exceptional need", and references to specific Data Act articles or recitals.
AWS SDK v3 for TypeScript — modular clients, command pattern, S3, DynamoDB, SQS, Lambda, SNS, Secrets Manager
Secrets management, XSS prevention, CSRF protection, dependency scanning, DOMPurify sanitization, CSP headers, CODEOWNERS, HttpOnly cookies
Use Docker Compose to define, run, debug, and harden multi-container applications. Load for compose.yaml design, networking, volumes, secrets, profiles, overrides, watch mode, lifecycle operations, or troubleshooting. Do not use this skill for unrelated requests; route to the nearest named specialist.
Use this skill when building or operating internal developer platforms: infrastructure as code, CI/CD, container orchestration, service networking, secrets, and observability, or when shaping platform products, self-service interfaces, adoption evidence, and policy guardrails. Do not use it to define release process, promotion, rollout, or rollback policy; use release-engineering for that delivery model. Route named-tool configuration and troubleshooting to the corresponding operational skill, such as kubernetes or traefik for ingress-controller configuration.
Use when designing or implementing software securely: define security requirements, threat-model a feature, choose secure defaults, design authentication and authorization, handle untrusted data and secrets, evaluate dependencies, design multi-tenant trust boundaries, or review security-sensitive changes. Use for prevention during requirements, design, implementation, and review; not for post-build security assessments or scanning an existing codebase.
Operate Woodpecker CI from installation through production troubleshooting: configure servers and agents, connect Forgejo/Gitea or another forge, write and validate pipelines, manage secrets and plugins, use Docker or Kubernetes backends, run the CLI, and diagnose failed builds. Use when setting up, administering, or debugging Woodpecker CI. Do not use this skill for unrelated requests; route to the nearest named specialist.
