Claude Code Security plugins and skills

Reverse engineer anything with agents, from app behavior down to native binaries.

@morlutoInstall Plugin

A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.

46 skills

@zhaoxuya520Install Plugin

Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.

200 skills

@mukul975Install Plugin

Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.

2 skills

@guillaumemeyerInstall Plugin

Helps users find NVIDIA NemoClaw documentation for installing, configuring, operating and troubleshooting the open source stack that runs AI agents inside OpenShell sandboxes, and can set up a documentation MCP server.

1 skill

@nvidiaInstall Plugin

Prowler is an open-source cloud security platform for scanning cloud accounts and automating security and compliance checks. It includes skills for framework compliance triage, Django REST and Vercel AI SDK patterns, and GitHub agentic workflows.

39 skills

@prowler-cloudInstall Plugin

Lets an AI assistant drive IDA Pro directly, so you can ask it to analyze a binary, read disassembly and decompiled code, and write IDAPython scripts instead of working through each step by hand.

1 skill

@mrexodiaInstall Plugin

Adds role and permission management to Laravel applications, covering middleware, policies, teams, and Blade directives. Useful for developers building access control into Laravel projects.

1 skill

@spatieInstall Plugin

IronClaw is an Agent OS focused on privacy, security and extensibility.

23 skills

@nearaiInstall Plugin

Security skills from Trail of Bits for Claude Code that audit GitHub Actions AI integrations, review smart contracts on Algorand and Cairo, and prepare codebases for security audits.

95 skills

@trailofbitsInstall Plugin

Provides policy enforcement, zero-trust identity, execution sandboxing, audit trails, and reliability engineering for autonomous AI agents, with commands and MCP servers for Claude Code users.

@microsoftInstall Plugin

Runs recon on a target, tests it for real, reportable vulnerabilities, checks each finding against a strict validation gate, and writes a report ready to submit to bug bounty platforms. It also remembers patterns across targets and resumes unfinished sessions.

25 skills

@awarexoneInstall Plugin

A Claude Code plugin for bug bounty hunters, bundling skills for reconnaissance, vulnerability hunting such as IDOR, SSRF and XSS, black-box audits of deployed AI agents, and CI/CD pipeline security.

25 skills

@shuvonsecInstall Plugin

Local, clinical AI skills for healthcare data, covering de-identification of protected health information, clinical entity extraction, FHIR bundle assembly, variant annotation, and audit trails for compliance review.

74 skills

@maziyarpanahiInstall Plugin

A self-contained bundle of Claude skills and slash commands for bug bounty hunting and external red-team work, covering recon, Android APK analysis, and vulnerability reporting for Bugcrowd and HackerOne.

83 skills

@elementalsoulsInstall Plugin

A set of Claude Code skills for open-source intelligence work, covering attack-surface discovery of cloud storage buckets, continuous exposure monitoring, email domain spoofability checks, secret detection, and risk scoring of recon findings for security teams.

10 skills

@elementalsoulsInstall Plugin

Scans AI agent skills for prompt injection, data exfiltration, and malicious code patterns. It is a static analysis tool, so it can flag risky skills before they are installed.

29 skills

@cisco-ai-defenseInstall Plugin

Gives an AI agent offensive security playbooks for authorized testing, covering web and API attacks, Active Directory abuse, privilege escalation and reverse engineering. Use it for step-by-step attack guidance during bug bounties, pentests and CTF challenges.

103 skills

@yaklangInstall Plugin

Guide for developers building Go applications with the jwx module, covering parsing and signing JWTs, working with JWS, JWE and JWK, choosing algorithms, and avoiding common pitfalls. Includes a skill for bulk operations across companion modules.

2 skills

@lestrrat-goInstall Plugin

Hands penetration testing work to specialist subagents for recon, web and network testing, exploit development and security audits, and returns structured findings you can act on without running each tool yourself.

@0xstephInstall Plugin

Reverse engineering skills for Claude Code covering DEX dumping from running Android apps, Frida hook scripts, IDAPython and IDALib scripting, data structure reconstruction, and function symbol restoration. Designed to work with decompilation exported from IDA.

7 skills

@p4nda0sInstall Plugin

A penetration testing automation CLI that uses AI agents to plan scans, run security tools, analyze findings and write reports. It is meant for security testers doing authorized assessments.

1 skill

@zakirkunInstall Plugin

A pre-execution guard that blocks destructive Git and file system commands, and common attempts to read sensitive files, before a tool call runs. Works with several AI coding agents, including Claude Code.

2 skills

@kenryu42Install Plugin

A pre-execution guard that blocks destructive Git and file system commands, plus common attempts to read sensitive files, before an AI coding agent runs a tool call. Works with Claude Code and several other agent CLIs.

2 skills

@kenryu42Install Plugin

A skill that helps Claude write secure web applications and runs security scans or audits, applying bug bounty experience to catch vulnerabilities before code reaches production.

1 skill

@behiseccInstall Plugin

Security auditor for AI agent configurations Scans Claude Code setups for hardcoded secrets, permission misconfigs, hook injection, MCP server risks, and agent prompt injection vectors. Available as CLI, GitHub Action, and GitHub App integration.

1 skill

@affaan-mInstall Plugin

Turns your coding assistant into a security scanner that checks your codebase for vulnerabilities such as business logic flaws, insecure file uploads, GraphQL injection and hardcoded secrets, without any third-party tools. Works with Claude Code, Codex, Cursor and other agent-skill assistants.

16 skills

@utkusenInstall Plugin

Security skills for auditing Solidity smart contracts, built by Pashov Audit Group. Includes tools to convert English properties into fuzz test assertions and to reconcile a fuzz harness with a changed source tree.

2 skills

@pashovInstall Plugin

A security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents. It provides drift detection to protect key files like SOUL.md, live security advisories, automated audits, and skill integrity checks.

16 skills

@prompt-securityInstall Plugin

Generates software bills of materials (SBOMs) and AI bills of materials in CycloneDX and SPDX formats, with skills to audit supply-chain risk, convert and validate BOMs, enrich them with reachability evidence, and explore them interactively.

14 skills

@cdxgenInstall Plugin

A bug bounty agent framework for Claude Code that automates reconnaissance, vulnerability hunting and exploit chaining, with skills for analyzing recon output, running autonomous hunt loops and correlating findings into attack chains.

39 skills

@h-mmerInstall Plugin

Compliance advisor skills for Claude Code covering CCPA, CIS Controls, CMMC, CSRD and UK Cyber Essentials, with guidance on scoping, gap assessments and consumer rights fulfillment.

36 skills

@sushegaadInstall Plugin

Lets an AI assistant drive Ghidra for reverse engineering: it runs analysis, triage of binaries, and CTF challenges like crackmes, exploits and crypto puzzles, so you can work through a binary by asking questions instead of clicking through every tool yourself.

6 skills

@cyberkaidaInstall Plugin

Gives Claude Code a skill for red-teaming a web application under authorization. It drives pages, captures the HTTP traffic behind them, inventories what the target exposes, and replays mutated requests with auditable evidence.

1 skill

@h5i-devInstall Plugin

Professional white-box code security audit skill with 55+ vulnerability types, dual-track audit model, and multi-agent deep analysis.

1 skill

@3stonebrotherInstall Plugin

Audits third-party AI API relays, LLM proxies and gateways locally before you trust them with coding, tool, production or wallet-sensitive traffic.

1 skill

@toby-bridgesInstall Plugin

Self-hostable YesCaptcha-compatible captcha solver built with FastAPI, Playwright, and OpenAI-compatible multimodal models.

2 skills

@shenhao-stuInstall Plugin

Sandboxes Claude Code and other AI agents so their actions run isolated, protecting data from loss or exfiltration. Includes skills for cropping and rotating images and for replacing text in fillable PDF forms.

2 skills

@instavmInstall Plugin

Claude Code skills for IoT security testing, covering Android APK decompiling and reverse engineering, UEFI/BIOS firmware analysis, embedded filesystem extraction, and IoT network traffic analysis for finding vulnerabilities.

13 skills

@brownfinesecurityInstall Plugin

Lets Claude Code validate FOFA search syntax, query and profile internet assets, and export bounded results. Scan plans are generated first and run through Nuclei only after one-time human approval of targets, templates and severity.

1 skill

@asaotomoInstall Plugin

A decentralized identity management toolkit for AI agents using iden3 protocol on Billions Network.

1 skill

@billionsnetworkInstall Plugin

Easy Authentication and Authorization with Keycloak in .NET.

3 skills

@nikiforovallInstall Plugin

A secure\* runtime for autonomous AI agents, where security policy is derived from a human-readable constitution. \*When someone writes "secure," you should immediately be skeptical. What do we mean by secure?

7 skills

@provosInstall Plugin

Vestige is a fail-closed runtime firewall for AI agents. The model proposes, a deterministic gate decides, and every action leaves a receipt. When something breaks, causal_walk finds the real cause.

@samvallad33Install Plugin

A cyber threat intelligence and OSINT analysis toolkit that runs structured investigations and produces analyst-style reports with sourced, trust-scored findings. Built for security analysts working OSINT and CTI cases in Claude Code.

1 skill

@7onezInstall Plugin

Audits an agent skill before you trust it, flagging shell commands, network calls, tool invocations and credential risks it could carry. Run it inside Claude Code with the semia scan command on a skill path.

1 skill

@berabuddiesInstall Plugin

Claude Code skills for offensive security work, covering penetration testing, bug bounty hunting, AI threat testing, API security, authentication attacks and multi-hop attack path mapping. Built for security testers working within authorized scope.

48 skills

@transilienceaiInstall Plugin

A cross-platform computer repair skill for Windows, macOS and Linux, usable from AI coding agents. It helps diagnose and clean up a full system drive, slow performance, malware, app migration and data recovery, gathering evidence first and changing things only after confirmation.

1 skill

@88linInstall Plugin

Red-teaming skills that set up an AI agent or chatbot target and run adversary attacks against it, then generate a report. Covers prompt injection and MCP server security checks.

2 skills

@keyvaluesoftwaresystemsInstall Plugin

Gives Claude Code deep, domain-specific guidance for security work, such as reconnaissance, vulnerability scanning, reverse engineering and malware analysis, so you can get expert-level help on these tasks without writing the method yourself.

22 skills

@masriyanInstall Plugin

Decompiles Android APK, XAPK, JAR and AAR files with jadx or Vineflower, instruments apps with Frida, extracts HTTP API endpoints, and traces JNI and native library code and request signing. Aimed at security researchers doing authorized analysis.

1 skill

@credittoneInstall Plugin

A multi-agent code audit plugin that scans for security vulnerabilities, logic errors, and runtime bugs, then applies minimal fixes on a separate branch. It also reviews commit diffs and maps trust boundaries for threat modeling.

10 skills

@codexstar69Install Plugin

A skill pack for security audits and code review, including a check of GitHub Actions that run AI agents for prompt injection and sandbox gaps. It also covers feature architecture design, project rules files, and frontend design guidance.

55 skills

@waybarriosInstall Plugin

Verifies the authenticity of AI-agent authorization receipts and human device signoffs, including WebAuthn and passkey approvals. Useful when a user shares a trust receipt, authorization receipt, or signoff to check whether it is genuine.

1 skill

@emiliaprotocolInstall Plugin

Security skills for Claude Code from Trail of Bits, covering web fuzzing with ffuf, headless Ghidra binary reverse engineering, and threat modeling and vulnerability scanning, plus writing and research helpers.

31 skills

@trailofbitsInstall Plugin

Audits your cloud, container, API and AI systems for misconfigurations, excessive permissions and known attack patterns, then explains each finding in plain language so you know what to fix and why.

42 skills

@briiirussellInstall Plugin

Authoring skills for Dogwood, a governance language for AI agents and their tools. Helps write Cedar action and service schemas and turn plain-English access rules into validated .dw policies, including temporal conditions over recent agent events.

4 skills

@dogwood-policyInstall Plugin

Runtime security for AI coding agents that observes, asks for approval on, or blocks risky tool calls before they run, covering secret leaks, prompt injection, and supply chain risks through a local dashboard. Works across agents such as Claude and Codex.

1 skill

@prismorsecInstall Plugin

Runs a bug bounty workflow in Claude Code, from recon and vulnerability hunting through triage to a report ready to submit to HackerOne, Bugcrowd, Intigriti or Immunefi. Covers smart contract audits and web or API security, so you spend less time on manual research and report writing.

29 skills

@gabson0xInstall Plugin

Checks an AI agent's tool calls before they run, blocking unsafe actions and scoring output against declared rules. Rules can look at what already happened, so a policy such as checking before a refund becomes one rule instead of prompt text.

2 skills

@sponsiolabsInstall Plugin

Runs shell commands and AI agents inside a limited user account on your Mac, and can clone the current repo into a sandboxed Claude session for a task.

1 skill

@webcoyoteInstall Plugin

A Claude Code skill providing the latest OWASP security best practices (2025-2026) for developers building secure applications.

1 skill

@agammInstall Plugin

Scans source code, dependencies and repositories for security weaknesses such as injection flaws and leaked secrets, then merges the findings into one prioritized report. It also captures and replays HTTP traffic through a proxy to help test running applications.

8 skills

@ghostsecurityInstall Plugin

Turns raw evidence from cloud accounts, SaaS tools and code into framework-aligned findings, gap reports and remediation steps, so compliance checks become repeatable and easier to audit.

105 skills

@grcengclubInstall Plugin

Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.

19 skills

@vigil-socInstall Plugin

Security rules and a skill that help AI coding agents write and review code with secure-by-default practices. Includes validators to test whether generated code follows the rules.

1 skill

@project-codeguardInstall Plugin

Audits decompiled WeChat mini-programs for hardcoded secrets, exposed endpoints, and weak crypto. Runs a full static security analysis from decompilation to report.

1 skill

@sssmmmwwwInstall Plugin

A Claude Code plugin for offensive security work, offering structured red-team engagement workflows based on the Cyber Kill Chain. It covers attacks on Active Directory, AI and LLM systems, command and control infrastructure, and browser exploitation.

38 skills

@hypnguyen1209Install Plugin

Gives security testers ready-made wordlists, fuzzing payloads, sensitive data patterns and LLM test prompts for authorized penetration testing, bug bounty work and CTF challenges, so the agent can reach for them without you hunting them down.

7 skills

@eyadkellehInstall Plugin

A Ghidra-powered skill that lets Claude Code perform reverse engineering on binaries: decompiling functions, tracing call graphs, renaming and annotating symbols, and diffing binary versions.

1 skill

@cellebrite-labsInstall Plugin

Compares symbols, types and syscalls of Windows binaries across OS versions and patch levels, using a web UI or an LLM skill to generate and interpret security-research diffs.

1 skill

@ergreletInstall Plugin

Gates agent actions behind configurable approval policies and writes an audit trail. Fires when the agent calls a tool, edits config, or hits a policy-flagged action.

1 skill

@pegasi-aiInstall Plugin

Gives security testers ready-made attack material for authorized work: fuzzing payloads, common password lists, sensitive-data patterns, exploit test files, and LLM safety test prompts. Pulled from SecLists and usable directly from an AI coding agent.

7 skills

@eyadkellehInstall Plugin

Gives an AI assistant packet analysis through Wireshark and TShark. Drop in a pcap or pcapng capture, ask questions in plain English, and get answers backed by real TShark data for network troubleshooting and security investigation.

2 skills

@bx33661Install Plugin

A security knowledge base for Claude Code that answers questions on business risks, evasion methods, attack tools, threat actors, and industry terms, with example cases. Useful for security teams doing risk review or red-team planning.

1 skill

@jdarmyInstall Plugin

A Claude Code skill for black-box penetration testing of web apps and APIs, running several agents in parallel to fingerprint targets, crawl, test for vulnerabilities including business logic flaws, and produce a security report with remediation advice.

1 skill

@ok-helloworldInstall Plugin

A security plugin with skills that help AI coding agents write secure code, guide migration of C and C++ code to memory-safe languages, and produce markdown security review reports for a repository.

3 skills

@cosai-oasisInstall Plugin

An MCP server to use radare2 with AI agents such as OpenCode, Mai, VSCode, Claude, CLION.

1 skill

@radareorgInstall Plugin

A threat modeling skill that runs an automated security risk assessment on your code, covering threat modeling, security audits, attack surface analysis, and penetration test preparation.

1 skill

@fr33d3m0nInstall Plugin

Skill for the KSafe Kotlin library, which persists variables, Compose State, StateFlow, and serializable objects with encryption by default across Android, iOS, macOS, Desktop, and Web. It also covers key rotation and biometrics.

1 skill

@ioannisaInstall Plugin

A Claude Code plugin for penetration testing and bug bounty work, with skills for driving Burp Suite, triaging proxy history, testing Active Directory attacks, and running responsible disclosure to a CVE.

56 skills

@encod3d-secInstall Plugin

Security skills for Claude Code covering secure coding practices, OWASP-based LLM application security, and running Semgrep static analysis scans with custom rules. Beta-level software.

3 skills

@semgrepInstall Plugin

A security scanning skill for Claude Code that reviews code for common vulnerabilities such as SQL injection and weak JWT verification, and explains how to fix each one. Triggered by requests like scan security or security audit.

1 skill

@tanviet12Install Plugin

A red team skill for authorized penetration testing that works through hypothesis-driven attack techniques, loading one focused technique file at a time. For security professionals running sanctioned offensive assessments.

1 skill

@0rangec3tInstall Plugin

Checks the shell commands, URL fetches and file writes an AI coding assistant is about to run, and blocks dangerous ones such as reverse shells, command injection and risky credential or supply chain actions before they execute.

1 skill

@gendigitalincInstall Plugin

Remote approvals, policy checks, and execution evidence for unattended AI agents.

20 skills

@ucsandmanInstall Plugin

Autonomous Web3 security auditor for Claude Code and OpenAI Codex CLI. Orchestrates 18-100 AI agents across 40+ phases to produce audit reports with verified PoC exploits, for smart contracts and L1 node-client infrastructure.

96 skills

@plamentsvInstall Plugin

Adds policy and safety controls to coding agents like Claude Code: approval gates, pretool guards that block destructive commands, quality scoring on session stop, structured work modes, and execution records with rollback.

3 skills

@0xnykInstall Plugin

A security assessment toolkit for Claude Code that combines skills, MCP servers, and agent teams to guide penetration testers through recon, initial access, and lateral movement. Its skills cover Active Directory and AD CS attack techniques.

79 skills

@blacklanternsecurityInstall Plugin

Watches what AI coding agents and the processes around them do on a developer machine, blocks actions that break your security policy, and keeps a tamper-evident signed log of every event. If a check cannot run, the action is blocked.

3 skills

@backbay-labsInstall Plugin

A security analysis skill for Claude Code that scans a local project for dependency vulnerabilities, insecure code patterns, leaked secrets and authentication flaws, then produces a report.

1 skill

@hainrixzInstall Plugin

Sign in your way. AI works on your behalf. AI agents need access to your work systems, Jira, wikis, calendars, internal APIs. But passing credentials through shell history, environment variables, and agent context windows is a security nightmare.

15 skills

@sigcliInstall Plugin

Gives Claude Code full access to Caido for web security testing. It searches HTTP history with HTTPQL, sends requests through the Caido proxy, and adds match and replace rules.

1 skill

@caidoInstall Plugin

PYA (Protect Your Ass): security audit plugin for Claude Code. 9 specialist agents, a dated threat feed, verified findings, offline by default.

1 skill

@agricidanielInstall Plugin

An autonomous, looping, multi-altitude security vulnerability hunt for a codebase, packaged as a Claude Code skill.

1 skill

@dinosnInstall Plugin

Scans Claude Code tool outputs such as files, web pages and command results for indirect prompt injection attempts, and warns when it finds one. Useful for developers who let Claude read untrusted content.

1 skill

@lasso-securityInstall Plugin

A Rust command-line tool that automates Ghidra reverse engineering tasks such as binary analysis, decompilation, function inspection, and binary patching. It can be used by hand or driven by an AI coding agent like Claude Code.

1 skill

@akiselevInstall Plugin

A TypeScript framework for building MCP servers that enforce security in the architecture, with a typed egress firewall so raw data does not reach the LLM unfiltered. Includes skills for development and deploying to Vinkius Edge.

2 skills

@vinkius-labsInstall Plugin

Lets a security engineer run web app and API security tests from the coding agent instead of switching to separate tools, covering runtime vulnerability scanning, fuzzing and API spec validation.

31 skills

@agentsecopsInstall Plugin

Giving an agent API access normally means giving it an API key. Jentic One removes that step: you store each credential once, on your own infrastructure, and the agent calls APIs through the Broker.

4 skills

@jenticInstall Plugin

Active Directory pentest methodology for Claude Code. Skills, agents and commands that give Claude the playbook for an internal Active Directory assessment: the phase order, the environment constraints that break your tooling, the telemetry each technique.

8 skills

@adscanproInstall Plugin

An open-source security playbook for AI agents. Structured, OWASP-grounded procedures that enable agents to perform security engineering tasks, from code review to AI agent security audits.

18 skills

@owaspInstall Plugin

Claude Code plugin providing skills for x64dbg debugger automation.

8 skills

@dariushouleInstall Plugin

Offline security scanner that audits git repos, AI skills, plugins, MCP servers, and agent credentials for prompt injection, credential theft, and known vulnerabilities. Runs as a skill and as pre-tool-use hooks.

5 skills

@alexgreenshInstall Plugin

Deploys and maintains a multi-layer VPN (VLESS Reality, a relay VPS and WebRTC) for bypassing Russian internet censorship, with skills for guided deployment, security audits, troubleshooting and post-deployment checks.

4 skills

@sergei-thinkerInstall Plugin

A plugin that turns your AI coding agent into a senior GRC (Governance, Risk, and Compliance) analyst. 76+ reference files covering 18 frameworks, 24 slash commands, and deep domain knowledge for federal and commercial compliance work.

1 skill

@mlunato47Install Plugin

The blazing-fast, privacy-first MCP server for deep code intelligence A Rust-powered MCP (Model Context Protocol) server providing AI assistants with deep code understanding through 90 specialized tools.

1 skill

@postrvInstall Plugin

Generates SITF-compliant attack flow JSON files from incident reports, red team or pentest findings, and attack descriptions, and proposes new techniques when attack steps have no existing mapping. Useful for security analysts documenting supply chain attacks and breaches.

3 skills

@wiz-sec-publicInstall Plugin

Security skills for Claude Code that encode the judgment professionals bring, not another wrapper around a scanner. Offense, defense, and the reverse-engineering and code-audit core both sides share. Every skill is fact-checked against primary sources.

94 skills

@trilwuInstall Plugin

A security skill that defends AI agents against prompt injection, supply chain injection, memory poisoning, and unicode steganography. It also offers multi-language detection, severity scoring, and output data-loss prevention.

1 skill

@seojoonkimInstall Plugin

A Claude Code plugin for scanning Claude Skills for security issues and protecting your development environment. It includes a log analyzer skill that helps locate application errors and performance bottlenecks.

1 skill

@huiferInstall Plugin

Searchable, application-level encryption for building privacy-first apps.

16 skills

@cipherstashInstall Plugin

A curated collection of plugins for AI-assisted development at Bitwarden. Enables discovery and distribution of quality-controlled plugins for use with Claude Code.

83 skills

@bitwardenInstall Plugin

Your agents have access. You deserve visibility. AEGIS puts local AI-agent activity in one desktop dashboard.

@antropos17Install Plugin

Documentation map · Developer Workflow · CLI 1.0 workflow · Security advisories · Topic registry Evaluate technology: Technology Contribution Profile · Evidence Assurance Level · Collect evidence.

2 skills

@cyberstrategyinstituteInstall Plugin

PII anonymization (MCP + Skill for Claude and CLI for the rest)

1 skill

@gregmosInstall Plugin

Portable, evidence-bound security skills for authorized defensive assessment, penetration testing, red teaming, detection engineering, purple teaming, and engagement operations. The collection contains 56 skills in 10 installable plugins from zero-lab.ai.

57 skills

@zero-lab-aiInstall Plugin