Security
Plugin
secopsagentkit
An assortment of security operations skills for AI coding agents. A collaborative approach to shift-left security using Claude Code skills.
Plugin Signal60/100Solid
maintained46
capable72
documented75
adopted48
Install on Claude Code
> /plugin marketplace add AgentSecOps/SecOpsAgentKit
In this plugin
- api-mitmproxy
- api-spectral
- dast-ffuf
- dast-nuclei
- dast-zap
- sast-bandit
- sast-semgrep
- sca-blackduck
- policy-opa
- container-grype
- container-hadolint
- iac-checkov
- sca-trivy
- secrets-gitleaks
- vuln-defectdojo
- detection-sigma
- forensics-osquery
- ir-velociraptor
- analysis-tshark
- crack-hashcat
- network-netcat
- ot-security-assessment
- pentest-metasploit
- privesc-linpeas
- recon-nmap
- webapp-nikto
- webapp-sqlmap
- reviewdog
- sast-horusec
- sbom-syft
- pytm
What's inside
Skills
31/api-mitmproxyInteractive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI)./api-spectralAPI specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1)/dast-ffufFast web fuzzer for DAST testing with directory enumeration, parameter fuzzing, and virtual host discovery. Written in Go for high-performance HTTP fuzzing with extensive filtering capabilities. Supports multiple fuzzing modes (clusterbomb, pitchfork, sniper) and recursive/dast-nucleiFast, template-based vulnerability scanning using ProjectDiscovery's Nuclei with extensive community templates covering CVEs, OWASP Top 10, misconfigurations, and security issues across web applications, APIs, and infrastructure. Use when: (1) Performing rapid vulnerability/dast-zapDynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection. Use when: (1) Performing runtime security testing of web applications and APIs, (2) Detecting vulnerabilities/sast-banditPython security vulnerability detection using Bandit SAST with CWE and OWASP mapping. Use when: (1) Scanning Python code for security vulnerabilities and anti-patterns, (2) Identifying hardcoded secrets, SQL injection, command injection, and insecure APIs, (3) Generating
Show all 31 skillsShow fewer
/sast-semgrepStatic application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing/sca-blackduckSoftware Composition Analysis (SCA) using Synopsys Black Duck for identifying open source vulnerabilities, license compliance risks, and supply chain security threats with CVE, CWE, and OWASP framework mapping. Use when: (1) Scanning dependencies for known vulnerabilities and/policy-opaPolicy-as-code enforcement and compliance validation using Open Policy Agent (OPA). Use when: (1) Enforcing security and compliance policies across infrastructure and applications, (2) Validating Kubernetes admission control policies, (3) Implementing policy-as-code for/container-grypeContainer vulnerability scanning and dependency risk assessment using Grype with CVSS severity ratings, EPSS exploit probability, and CISA KEV indicators. Use when: (1) Scanning container images and filesystems for known vulnerabilities, (2) Integrating vulnerability scanning/container-hadolintDockerfile security linting and best practice validation using Hadolint with 100+ built-in rules aligned to CIS Docker Benchmark. Use when: (1) Analyzing Dockerfiles for security misconfigurations and anti-patterns, (2) Enforcing container image security best practices in CI/CD/iac-checkovInfrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform, CloudFormation, Kubernetes, Dockerfile, and ARM templates. Use when: (1) Scanning IaC files for security misconfigurations and compliance violations, (2) Validating cloud/sca-trivySoftware Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for/secrets-gitleaksHardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy analysis. Use when: (1) Scanning repositories for exposed secrets and credentials,/vuln-defectdojoVulnerability management and findings aggregation using DefectDojo. Centralizes security findings from all SecOpsAgentKit scanners (Semgrep, Bandit, ZAP, Trivy, Grype, Gitleaks, Nuclei, Checkov, Horusec) into a unified platform with automatic deduplication, SLA tracking,/detection-sigmaGeneric detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules/forensics-osquerySQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence collection, threat hunting, and incident response across Linux, macOS, and Windows endpoints. Use when: (1) Investigating security/ir-velociraptorEndpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or/analysis-tsharkNetwork protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering/crack-hashcatAdvanced password recovery and hash cracking tool supporting multiple algorithms and attack modes. Use when: (1) Performing authorized password auditing and security assessments, (2) Recovering passwords from captured hashes in forensic investigations, (3) Testing password/network-netcatNetwork utility for reading and writing data across TCP/UDP connections, port scanning, file transfers, and backdoor communication channels. Use when: (1) Testing network connectivity and port availability, (2) Creating reverse shells and bind shells for authorized penetration/ot-security-assessmentOperational Technology (OT) security assessment using a two-stage methodology: (1) Identification/Discovery of OT devices and protocols, and (2) Vulnerability Assessment using online sources and Metasploit. Use when: (1) Conducting authorized OT/ICS security assessments, (2)/pentest-metasploitPenetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in authorized security assessments, (2) Demonstrating exploit impact for security research,/privesc-linpeasLinux privilege escalation enumeration and attack surface analysis using LinPEAS (Linux Privilege Escalation Awesome Script). Automates post-exploitation discovery of escalation vectors, misconfigurations, and credential exposure on Linux targets. Use when: (1) Enumerating/recon-nmapNetwork reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3)/webapp-niktoWeb server vulnerability scanner for identifying security issues, misconfigurations, and outdated software versions. Use when: (1) Conducting authorized web server security assessments, (2) Identifying common web vulnerabilities and misconfigurations, (3) Detecting outdated/webapp-sqlmapAutomated SQL injection detection and exploitation tool for web application security testing. Use when: (1) Testing web applications for SQL injection vulnerabilities in authorized assessments, (2) Exploiting SQL injection flaws to demonstrate impact, (3) Extracting database/reviewdogAutomated code review and security linting integration for CI/CD pipelines using reviewdog. Aggregates findings from multiple security and quality tools (SAST, linters, formatters) into unified code review comments on pull requests. Use when: (1) Integrating security scanning/sast-horusecMulti-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1)/sbom-syftSoftware Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives. Detects packages across 28+ ecosystems with multi-format output support (CycloneDX, SPDX, syft-json). Enables vulnerability assessment, license compliance, and supply chain/pytmPython-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with
README
1SecOpsAgentKit
An assortment of security operations skills for AI coding agents. A collaborative approach to shift-left security using Claude Code skills.
Overview
SecOpsAgentKit provides specialized Claude Code skills for security operations, covering:
- Application Security (AppSec): SAST/DAST, vulnerability analysis, secure code review
- DevSecOps: CI/CD security, infrastructure as code security, container scanning
- Secure SDLC: Threat modeling, security requirements, secure design patterns
- Compliance: Security auditing, policy enforcement, compliance frameworks
- Incident Response: Security event analysis, forensics, remediation workflows
Quick Start
/plugin marketplace add https://github.com/AgentSecOps/SecOpsAgentKit.git
Available Skills
Application Security (appsec/)
- api-mitmproxy - Interactive HTTPS proxy for API security testing with mitmproxy traffic interception and modification
- api-spectral - API specification linting and security validation using Spectral for OpenAPI and AsyncAPI
- dast-ffuf - Fast web fuzzer using ffuf for directory enumeration and parameter fuzzing
- dast-nuclei - Fast, template-based vulnerability scanning using ProjectDiscovery's Nuclei
- dast-zap - Dynamic application security testing using OWASP ZAP (Zed Attack Proxy)
- sast-bandit - Python security vulnerability detection using Bandit SAST with CWE and OWASP mappings
- sast-semgrep - Static application security testing using Semgrep for vulnerability detection
- sca-blackduck - Software Composition Analysis using Synopsys Black Duck for dependency vulnerabilities and license compliance
DevSecOps (devsecops/)
- container-grype - Container vulnerability scanning and dependency risk assessment using Grype with CVSS, EPSS, and CISA KEV prioritization
- container-hadolint - Dockerfile security linting and best practice validation using Hadolint
- iac-checkov - Infrastructure as Code security scanning using Checkov with 750+ built-in policies
- sca-trivy - Software Composition Analysis and container vulnerability scanning using Trivy for CVE detection
- secrets-gitleaks - Hardcoded secret detection and prevention in git repositories using Gitleaks
- vuln-defectdojo - Vulnerability management and findings aggregation using DefectDojo for deduplication, SLA tracking, and compliance reporting
Secure SDLC (secsdlc/)
- reviewdog - Automated code review and security linting integration for CI/CD pipelines using reviewdog
- sast-horusec - Multi-language static application security testing using Horusec (18+ languages, 20+ tools)
- sbom-syft - Software Bill of Materials (SBOM) generation using Syft for container images and filesystems
Compliance (compliance/)
- policy-opa - Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA)
Threat Modeling (threatmodel/)
Incident Response (incident-response/)
- detection-sigma - Generic detection rule creation and management using Sigma (universal SIEM rule format)
- forensics-osquery - SQL-powered forensic investigation and system interrogation using osquery for endpoint analysis
- ir-velociraptor - Endpoint visibility and digital forensics using Velociraptor for incident response at scale
Offensive Security (offsec/)
- pentest-metasploit - Penetration testing framework using Metasploit for exploit development and vulnerability validation
- recon-nmap - Network reconnaissance and security auditing using Nmap for port scanning and service detection
- network-netcat - Network utility using Netcat for reading/writing data across TCP/UDP connections and port scanning
- ot-security-assessment - Operational Technology security assessment using Nmap and Metasploit for OT/ICS device discovery and vulnerability assessment
- analysis-tshark - Network protocol analyzer and packet capture tool using tshark for traffic analysis
- webapp-sqlmap - Automated SQL injection detection and exploitation using SQLMap for web application security testing
- webapp-nikto - Web server vulnerability scanner using Nikto for identifying security issues and misconfigurations
- crack-hashcat - Advanced password recovery and hash cracking using Hashcat supporting multiple algorithms
- privesc-linpeas - Linux privilege escalation enumeration and attack surface analysis using LinPEAS for post-exploitation privesc vector discovery
Security Frameworks
Skills in this repository reference industry-standard security frameworks:
- OWASP - Open Web Application Security Project
- CWE - Common Weakness Enumeration
- MITRE ATT&CK - Adversarial Tactics, Techniques & Common Knowledge
- NIST - National Institute of Standards and Technology
- SOC2 - Service Organization Control 2
- PCI-DSS - Payment Card Industry Data Security Standard
- GDPR - General Data Protection Regulation
Contributing
We welcome contributions! Please read CONTRIBUTE.md for:
- Skill creation guidelines
- Frontmatter standards
- Quality requirements
- Submission process
Contributing a New Skill
To kickstart a new skill for this repo:
-
Initialize: Create a new skill from the template
./scripts/init_skill.sh my-skill-name appsec -
Develop: Fill in
SKILL.mdand add bundled resourcesscripts/- Executable security toolsreferences/- Security framework documentationassets/- Templates and configurations
-
Validate: Run the validation script
./scripts/validate_skill.py skills/appsec/my-skill-name -
Update Documentation:
- Add your skill to the README.md (this file) under the appropriate category
- Update
.claude-plugin/marketplace.jsonwith your skill path
-
Submit: Open a PR with the
[skill]tag
See CONTRIBUTE.md for detailed guidelines including the exact format for README.md entries.
Skill Standards
All skills follow these requirements:
Required Frontmatter
---
name: skill-name # kebab-case identifier
description: > # Comprehensive description with use cases
What the skill does and when to use it...
version: 0.1.0 # Semantic versioning
maintainer: github-username # Your GitHub username
category: appsec # Primary security domain
tags: [sast, owasp, security] # Searchable tags
frameworks: [OWASP, CWE] # Security frameworks referenced
---
Quality Standards
- Concise: Keep SKILL.md under 500 lines
- Tested: All scripts must be tested and working
- Secure: Include security considerations and safe defaults
- Documented: Clear instructions using imperative form
- Versioned: Follow semantic versioning (MAJOR.MINOR.PATCH)
Tools & Scripts
scripts/init_skill.sh- Initialize a new skill from templatescripts/validate_skill.py- Validate skill structure and frontmatterskills/_template/- Base template for all new skills
Resources
License
This project uses dual licensing:
- Documentation (skills - markdown files): Creative Commons Attribution-ShareAlike 4.0 International (CC-BY-SA 4.0)
- Code (scripts, configurations): Dual-licensed under CC-BY-SA 4.0 and Mozilla Public License 2.0 (MPL 2.0)
This means:
- You can freely use, share, and adapt all content with attribution
- Skills must be shared under the same CC-BY-SA 4.0 license
- Code should be used under MPL 2.0
See LICENSE.md for full license texts and details.
File tree
278AgentSecOps/SecOpsAgentKitView on GitHub
.claude-plugin/
marketplace.json
.githooks/
pre-commit
.github/
ISSUE_TEMPLATE/
bug_report.md
config.yml
feature_request.md
skill_submission.md
pull_request_template.md
.gitignore
CLAUDE.md
CONTRIBUTE.md
LICENSE.md
README.md
requirements.txt
scripts/
generate_marketplace.py
init_skill.sh
install_hooks.sh
validate_skill.py
SKILL_REFERENCE.md
skills/
_template/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
.claude-plugin/
marketplace.json
appsec/
.category
api-mitmproxy/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
api-spectral/
assets/
.gitkeep
ci-config-template.yml
github-actions-template.yml
rule-template.yaml
spectral-owasp.yaml
references/
custom_rules_guide.md
EXAMPLE.md
owasp_api_mappings.md
WORKFLOW_CHECKLIST.md
SKILL.md
dast-ffuf/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
dast-nuclei/
assets/
.gitkeep
ci-config-template.yml
github_actions.yml
nuclei_config.yaml
rule-template.yaml
references/
authentication_patterns.md
EXAMPLE.md
false_positive_guide.md
owasp_mapping.md
template_development.md
WORKFLOW_CHECKLIST.md
SKILL.md
dast-zap/
assets/
.gitkeep
github_action.yml
gitlab_ci.yml
zap_automation.yaml
zap_context.xml
references/
api_testing_guide.md
authentication_guide.md
EXAMPLE.md
false_positive_handling.md
owasp_mapping.md
SKILL.md
sast-bandit/
assets/
.gitkeep
bandit_config.yaml
pre-commit-config.yaml
references/
cwe_owasp_mapping.md
remediation_guide.md
SKILL.md
sast-semgrep/
assets/
ci_config_examples/
github-actions.yml
gitlab-ci.yml
jenkins.groovy
rule_template.yaml
semgrep_config.yaml
references/
owasp_cwe_mapping.md
remediation_guide.md
rule_library.md
SKILL.md
sca-blackduck/
assets/
.gitkeep
blackduck_config.yml
ci_integration/
github_actions.yml
gitlab_ci.yml
jenkins_pipeline.groovy
ci-config-template.yml
policy_templates/
security_policy.json
rule-template.yaml
references/
cve_cwe_owasp_mapping.md
EXAMPLE.md
license_risk_guide.md
remediation_strategies.md
supply_chain_threats.md
WORKFLOW_CHECKLIST.md
SKILL.md
compliance/
.category
policy-opa/
assets/
.gitkeep
ci-cd-pipeline.yaml
gdpr-compliance.rego
k8s-constraint-template.yaml
k8s-constraint.yaml
k8s-pod-security.rego
pci-dss-compliance.rego
soc2-compliance.rego
terraform-security.rego
references/
compliance-frameworks.md
EXAMPLE.md
iac-policies.md
kubernetes-security.md
rego-patterns.md
SKILL.md
devsecops/
.category
container-grype/
assets/
.gitkeep
ci-config-template.yml
grype-ci-config.yml
grype-config.yaml
rule-template.yaml
references/
cisa_kev.md
cvss_guide.md
EXAMPLE.md
vulnerability_remediation.md
WORKFLOW_CHECKLIST.md
SKILL.md
container-hadolint/
assets/
.gitkeep
github-actions.yml
gitlab-ci.yml
hadolint-balanced.yaml
hadolint-permissive.yaml
hadolint-strict.yaml
references/
EXAMPLE.md
security_rules.md
SKILL.md
iac-checkov/
assets/
.gitkeep
checkov_config.yaml
github_actions.yml
gitlab_ci.yml
pre_commit_config.yaml
references/
compliance_mapping.md
custom_policies.md
EXAMPLE.md
suppression_guide.md
SKILL.md
sca-trivy/
SKILL.md
secrets-gitleaks/
assets/
.gitkeep
config-balanced.toml
config-custom.toml
config-strict.toml
github-action.yml
gitlab-ci.yml
precommit-config.yaml
references/
compliance_mapping.md
detection_rules.md
EXAMPLE.md
false_positives.md
remediation_guide.md
SKILL.md
vuln-defectdojo/
assets/
defectdojo-engagement-template.json
references/
tool-parser-map.md
scripts/
import_findings.py
SKILL.md
incident-response/
.category
detection-sigma/
assets/
.gitkeep
compliance-rules/
iso27001-logging.yml
nist-800-53-audit.yml
pci-dss-monitoring.yml
rule-templates/
credential-access.yml
lateral-movement.yml
persistence.yml
privilege-escalation.yml
references/
backend-support.md
compliance-mappings.md
field-modifiers.md
log-source-guide.md
mitre-attack-mapping.md
SKILL.md
forensics-osquery/
assets/
.gitkeep
forensic-packs/
credential-access.conf
ir-triage.conf
lateral-movement.conf
persistence-hunt.conf
osquery.conf
references/
mitre-attack-queries.md
osqueryd-deployment.md
platform-differences.md
table-guide.md
SKILL.md
ir-velociraptor/
assets/
.gitkeep
artifact-template.yaml
ci-config-template.yml
hunt-template.yaml
offline-collector-config.yaml
rule-template.yaml
references/
artifact-development.md
deployment-guide.md
EXAMPLE.md
mitre-attack-mapping.md
vql-patterns.md
WORKFLOW_CHECKLIST.md
SKILL.md
offsec/
.category
analysis-tshark/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
crack-hashcat/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
network-netcat/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
ot-security-assessment/
SKILL.md
pentest-metasploit/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
privesc-linpeas/
assets/
linpeas_report_template.md
references/
mitre_mapping.md
privesc_vectors.md
scripts/
linpeas_runner.py
SKILL.md
recon-nmap/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
webapp-nikto/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
webapp-sqlmap/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
secsdlc/
.category
reviewdog/
assets/
.gitkeep
.reviewdog.yml
github_actions_template.yml
gitlab_ci_template.yml
pre_commit_config.yaml
references/
cwe_mapping.md
reporter_formats.md
supported_tools.md
SKILL.md
sast-horusec/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
sbom-syft/
assets/
.gitkeep
ci-config-template.yml
rule-template.yaml
references/
EXAMPLE.md
WORKFLOW_CHECKLIST.md
SKILL.md
threatmodel/
.category
pytm/
SKILL.mdFAQ
secopsagentkit is a Claude Code plugin with 31 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes api-mitmproxy, api-spectral, dast-ffuf. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is secopsagentkit?
- An assortment of security operations skills for AI coding agents. A collaborative approach to shift-left security using Claude Code skills.
- How do I install secopsagentkit?
- Run these in Claude Code: /plugin marketplace add AgentSecOps/SecOpsAgentKit. Then prompt normally.
- Does secopsagentkit auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is secopsagentkit free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.