Flowy lists 103 plugins in the Security category for Claude Code. auth, secrets, vulnerability scanning, threat modelling, compliance, audits Every listing shows what is inside before you install, who built it, and whether it is Auto-invoked, meaning a FLOW.md router fires the right skill as you prompt instead of leaving them dormant.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
@mukul975View PluginProwler is the world’s most widely used Open-Source Cloud Security Platform that automates security and compliance across any cloud environment.
@prowler-cloudView PluginA Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
@trailofbitsView PluginAI-powered bug bounty hunting toolkit that works with or without subscription.
@shuvonsecView PluginA self-contained Claude skill bundle for bug hunting and external red-team work · 83 skills · 15 slash commands · 681 disclosed-report patterns (433 now individually cited & auditable) across 24 core vulnerability classes · enterprise identity +
@elementalsoulsView Plugin8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · ~10,000 lines of structured tradecraft.
@elementalsoulsView PluginA best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns.
@cisco-ai-defenseView PluginMaster Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.
@yaklangView PluginA pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
@kenryu42View PluginA pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
@kenryu42View PluginA collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills.
@utkusenView PluginStop vibe coding vulnerabilities into production. An AI skill that brings 5+ years of bug bounty hunting experience directly into your AI coding workflow - so LLM models write secure code from the start.
@behiseccView PluginSecurity auditor for AI agent configurations Scans Claude Code setups for hardcoded secrets, permission misconfigs, hook injection, MCP server risks, and agent prompt injection vectors. Available as CLI, GitHub Action, and GitHub App integration.
@affaan-mView PluginAI-powered Solidity security skills — built by Pashov Audit Group. Supported AI Platforms:
@pashovView PluginA complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.
@prompt-securityView PluginBug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
@h-mmerView PluginProfessional white-box code security audit skill with 55+ vulnerability types, dual-track audit model, and multi-agent deep analysis.
@3stonebrotherView PluginLocal security audit for AI API relays and LLM proxies. DSH Plugin
@toby-bridgesView PluginOpen-source IoT security testing toolkit with integrated Claude Code skills for automated vulnerability discovery.
@brownfinesecurityView PluginA Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra's powerful reverse engineering
@cyberkaidaView PluginA decentralized identity management toolkit for AI agents using iden3 protocol on Billions Network.
@billionsnetworkView Plugin🔐 Easy Authentication and Authorization with Keycloak in .NET.
@nikiforovallView PluginSecurity audit for AI agent skills. Know what a skill can do before you trust it. Agent skills are markdown files with embedded shell commands, network calls, and tool invocations. They run with **your credentials, on your machine, with your data**.
@berabuddiesView PluginCTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
@7onezView PluginAdversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.
@codexstar69View PluginAndroid 逆向分析全家桶 — 从 APK 反编译到 Frida 动态插桩、从 HTTP 接口提取到 JNI/SO 原生层逆向，覆盖静态分析→动态分析→流量解密→签名追踪的完整链路。支持 Claude Code / Codex 双平台，兼容 macOS、Linux、Windows（PowerShell），一套技能打通 Android 安全研究与授权渗透测试的绝大部分需求。
@credittoneView Plugin22 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, threat intelligence, purple team / adversary emulation, CSOC automation, AI/LLM security,
@masriyanView PluginProject CodeGuard is an AI model-agnostic security framework and ruleset that embeds secure-by-default practices into AI coding workflows (generation and review). It ships core security rules, translators for popular coding agents, and validators to test rule compliance.
@project-codeguardView PluginSandVault (sv) manages a limited user account to sandbox shell commands and AI agents, providing a lightweight alternative to application isolation using virtual machines.
@webcoyoteView PluginPlugin marketplace repository for Ghost Security's AI-native application security skills for Claude Code.
@ghostsecurityView PluginOpen-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
@grcengclubView PluginDogwood is a governance language designed for AI agents and their tools. It supports Cedar policies and adds temporal conditions (since, formerly, once, aggregations) to look back over an agent's recent events.
@dogwood-policyView PluginTool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI and/or LLMs.
@ergreletView PluginA curated collection of security testing resources packaged as agent skills, available on skills.sh Repository: Eyadkelleh/awesome-skills-security · skills.sh: Eyadkelleh/awesome-skills-security
@eyadkellehView PluginA curated collection of security testing resources packaged as agent skills, available on skills.sh Repository: Eyadkelleh/awesome-skills-security · skills.sh: Eyadkelleh/awesome-skills-security
@eyadkellehView PluginA spec-driven offensive security framework for Claude Code — structured engagement workflows based on the Cyber Kill Chain, 32 kill-chain skills (multi-file progressive-disclosure) plus a discipline layer (a SessionStart dispatcher + 6 process/discipline
@hypnguyen1209View PluginSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
@prismorsecView PluginA Claude Code skill providing the latest OWASP security best practices (2025-2026) for developers building secure applications.
@agammView PluginAI-native automated software risk analysis skill. LLM-driven, Code-First approach for comprehensive security risk assessment, threat modeling, security analysis, security audit, and penetration testing.
@fr33d3m0nView PluginThis repository is for the work of the Coalition for Secure AI (CoSAI). CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry-leading organizations.
@cosai-oasisView PluginEncrypted by default. Plain (unencrypted) when needed. Persist variables, Compose State, StateFlow, and serializable objects across Android, iOS, macOS, Desktop, and Web Easy to use by design — plus key rotation, cross-platform biometrics, and an encryption
@ioannisaView PluginSafety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions.
@gendigitalincView PluginRemote approvals, policy checks, and execution evidence for unattended AI agents.
@ucsandmanView Plugin
