A Claude Code plugin marketplace of security skills, agents, commands and MCP servers. It covers AI agent, multi-agent and MCP security reviews, plus autonomy-boundary and harness testing for authorized assessments.
@jassicsReview agent-to-agent (A2A) / multi-agent-system trust: peer identity and authentication, message integrity,…
@jassicsTest a web app's authorization: IDOR/BOLA, missing function-level access control, privilege escalation (horizontal and vertical),…
@jassicsPlan and run an objectives-based adversary-emulation engagement: select a relevant threat actor, build an ATT&CK-mapped emulation…
@jassicsTest the agent execution harness/runtime itself — LangChain/LangGraph, AutoGen, CrewAI, custom ReAct-style loops, or…
@jassicsCheck a Claude Code agent's runaway-risk controls — a missing or invalid `maxTurns` (unbounded turns/cost), an unattended…
@jassicsAssess an autonomous / tool-using AI agent for security end-to-end: tool privileges, autonomy and approval boundaries, excessive…
@jassicsThreat model an LLM / RAG / agentic AI system: map prompts, data sources, tools, identities, and trust boundaries, then enumerate…
@jassicsIntake a proposed AI use case and risk-classify it (EU AI Act tier / NIST AI RMF context), then gate it with the controls and…
@jassicsTriage a SIEM/EDR alert end-to-end — validate it's real, enrich and scope it, reach a consistent verdict, and decide escalate vs.…
@jassicsTest an API's authorization — BOLA (object-level), BFLA (function-level), and BOPLA (property-level / mass assignment) — to…
@jassicsProduce a security architecture, network, or trust-boundary diagram of a system, highlighting components, zones, controls, and…
@jassicsAssess and establish build artifact provenance and integrity — SLSA provenance level, signing/attestation (Sigstore/cosign,…
@jassicsBuilds and operationalizes AI safety — turning safety assessments into shipped safeguards: safety evals in CI/CD, guardrail…
@jassicsSenior AI safety reviewer for an end-to-end SAFETY assessment of a model or feature — harm modeling, safety evaluation,…
@jassicsCoordinates defensive operations end to end — detection engineering, incident response, threat hunting, and threat intelligence —…
@jassicsActs as a security executive: sets strategy, quantifies and communicates cyber risk in business terms, prioritizes the program by…
@jassicsAdvises technology leadership on security at strategic scale — secure-by-design programs (paved roads, guardrails, enablement)…
@jassicsA secure-by-default coding companion for developers and engineers — including AI-assisted/agentic ("vibe coding") workflows. Use…
@jassicsWhen Claude should delegate to this agent. Describe the end-to-end task it owns (e.g. "Run a full LLM security assessment of a…
@jassicsRuns governance, risk & compliance work — framework gap-assessments (SOC 2 / ISO 27001 / PCI / HIPAA / GDPR / NIST), security…
@jassicsSenior AI security reviewer for an end-to-end assessment of an LLM / RAG / agentic feature — from threat model through OWASP LLM…
@jassicsDrives an authorized penetration test end-to-end using a recognized methodology (PTES / OWASP WSTG / NIST 800-115): scoping,…
@jassicsRuns full-scope, objectives-based red-team engagements that emulate a real threat actor's TTPs (ATT&CK) to reach an objective and…
@jassicsStands up and runs an AI governance program: use-case intake and risk-tiering, oversight and accountability, documentation…
@jassicsRun a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
@jassicsBuild a board/executive security brief — strategy, quantified risk, and a board-ready deck.
@jassicsRun a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
@jassicsRun a secure-by-design architecture review — threat model, trust boundaries, control selection, and a documented verdict.
@jassicsRun an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
@jassicsRun a build-and-harden pass across code, pipeline, cloud, and infra, then track remediation.
@jassicsIntake and risk-tier an AI use case, then produce the governance/oversight record (NIST AI RMF / EU AI Act / ISO 42001).
@jassicsRun a T2/T3 security investigation — correlate telemetry, enrich, reconstruct the timeline, reach an evidence-backed verdict.
@jassicsRun an objectives-based adversary-emulation operation aligned to real threat-actor TTPs, recon to impact.
@jassicsRun the pre-commit security gate on the current changeset and report a single pass/fail verdict.
@jassicsRun an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
@jassicsAssess technology/security risk for a strategic decision and frame the secure-by-design path.
@jassicsReaches Jira and Confluence for issues, pages and project metadata.
@jassicsIs this you? Claim your profilePut a plugin at the top of Plugins, from $9
