rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoSecurity
Plugin
awesome-claude-security
A Claude Code plugin marketplace of security skills, agents, commands and MCP servers. It covers AI agent, multi-agent and MCP security reviews, plus autonomy-boundary and harness testing for authorized assessments.
Plugin Signal67/100Solid
maintained53
capable100
documented75
adopted23
Claude Code
> /plugin marketplace add jassics/awesome-claude-security
Codex
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a codex
Cursor
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a cursor
Gemini CLI
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a gemini-cli
GitHub Copilot
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a github-copilot
OpenCode
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a opencode
Windsurf
$ npx skills add jassics/awesome-claude-security --skill a2a-security-review agent-harness-review agent-security-review autonomy-boundary-test mcp-security-review tool-permission-audit evals-ci-gate safety-case bias-fairness-assessment guardrail-review harm-modeling responsible-ai-assessment safety-evaluation safety-red-team api-authz-test owasp-api-top10 purple-team-exercise board-deck cyber-risk-quantification security-strategy agent-safety-lint config-security-scan cloud-iam-review cloud-misconfig-scan cloud-posture-review secure-by-design-program tech-risk-assessment detection-coverage-review detection-rule-development threat-hunting pre-commit-gate forensic-triage incident-response ioc-development compliance-assessment policy-management risk-assessment host-hardening-review iac-security-review secrets-management-review k8s-cluster-review k8s-rbac-review k8s-workload-hardening ai-threat-model owasp-llm-top10 prompt-injection-test ml-pipeline-security-review ml-supply-chain-review model-serving-security masvs-review mobile-pentest multimodal-injection-test multimodal-security-review network-pentest network-segmentation-review protocol-security-review exposure-discovery osint-footprinting people-osint recon rag-security-review retrieval-poisoning-test vector-store-isolation-test adversary-emulation ai-use-case-intake sast-review sca-review secure-review safe-function-lint secret-guard security-investigation prd-security-injection secure-architecture-maturity security-design-review architecture-diagram attack-tree infographic mindmap threat-model-dfd secure-pipeline export-to-drive publish-finding-to-jira publish-report-to-confluence asvs-reference attack-lookup framework-mapping owasp-reference secure-coding-kb cvss executive-summary finding pentest-report alert-triage artifact-provenance-verification dependency-supply-chain-review pipeline-integrity-review pipeline-timeout-lint cti-analysis ioc-enrichment threat-actor-profiling maestro pasta risk-rank stride remediation-tracking vulnerability-prioritization vulnerability-scan-triage access-control-test injection-test owasp-web-top10 example-skill -a windsurf
In this plugin
- skills
- a2a-security-review
- agent-harness-review
- agent-security-review
- autonomy-boundary-test
- mcp-security-review
- tool-permission-audit
- evals-ci-gate
- safety-case
- bias-fairness-assessment
- guardrail-review
- harm-modeling
- responsible-ai-assessment
- safety-evaluation
- safety-red-team
- api-authz-test
- owasp-api-top10
- purple-team-exercise
- board-deck
- cyber-risk-quantification
- security-strategy
- agent-safety-lint
- config-security-scan
- cloud-iam-review
- cloud-misconfig-scan
- cloud-posture-review
- secure-by-design-program
- tech-risk-assessment
- detection-coverage-review
- detection-rule-development
- threat-hunting
- pre-commit-gate
- forensic-triage
- incident-response
- ioc-development
- compliance-assessment
- policy-management
- risk-assessment
- host-hardening-review
- iac-security-review
- secrets-management-review
- k8s-cluster-review
- k8s-rbac-review
- k8s-workload-hardening
- ai-threat-model
- owasp-llm-top10
- prompt-injection-test
- ml-pipeline-security-review
- ml-supply-chain-review
- model-serving-security
- masvs-review
- mobile-pentest
- multimodal-injection-test
- multimodal-security-review
- network-pentest
- network-segmentation-review
- protocol-security-review
- exposure-discovery
- osint-footprinting
- people-osint
- recon
- rag-security-review
- retrieval-poisoning-test
- vector-store-isolation-test
- adversary-emulation
- ai-use-case-intake
- sast-review
- sca-review
- secure-review
- safe-function-lint
- secret-guard
- security-investigation
- prd-security-injection
- secure-architecture-maturity
- security-design-review
- architecture-diagram
- attack-tree
- infographic
- mindmap
- threat-model-dfd
- secure-pipeline
- export-to-drive
- publish-finding-to-jira
- publish-report-to-confluence
- asvs-reference
- attack-lookup
- framework-mapping
- owasp-reference
- secure-coding-kb
- cvss
- executive-summary
- finding
- pentest-report
- alert-triage
- artifact-provenance-verification
- dependency-supply-chain-review
- pipeline-integrity-review
- pipeline-timeout-lint
- cti-analysis
- ioc-enrichment
- threat-actor-profiling
- maestro
- pasta
- risk-rank
- stride
- remediation-tracking
- vulnerability-prioritization
- vulnerability-scan-triage
- access-control-test
- injection-test
- owasp-web-top10
- example-skill
- agents
- commands
- MCP
What's inside
111 Skills
/a2a-security-reviewReview agent-to-agent (A2A) / multi-agent-system trust: peer identity and authentication, message integrity, capability-negotiation trust, and delegation-chain privilege narrowing. Use when an orchestrator dispatches to sub-agents or peer agents (same or different trust domain)/agent-harness-reviewTest the agent execution harness/runtime itself — LangChain/LangGraph, AutoGen, CrewAI, custom ReAct-style loops, or computer-use/browser-use agents — for intermediate-state poisoning, unscoped action spaces, and missing resource limits. Use when the agent isn't built on Claude/agent-security-reviewAssess an autonomous / tool-using AI agent for security end-to-end: tool privileges, autonomy and approval boundaries, excessive agency, memory/state poisoning, and multi-agent trust. Use when reviewing the security of an AI agent or agentic workflow.
- /autonomy-boundary-test
- /mcp-security-review
- /tool-permission-audit
- /evals-ci-gate
- /safety-case
- /bias-fairness-assessment
- /guardrail-review
- /harm-modeling
- /responsible-ai-assessment
- /safety-evaluation
- /safety-red-team
- /api-authz-test
- /owasp-api-top10
- /purple-team-exercise
- /board-deck
- /cyber-risk-quantification
- /security-strategy
- /agent-safety-lint
- /config-security-scan
- /cloud-iam-review
- /cloud-misconfig-scan
- /cloud-posture-review
- /secure-by-design-program
- /tech-risk-assessment
- /detection-coverage-review
- /detection-rule-development
- /threat-hunting
- /pre-commit-gate
- /forensic-triage
- /incident-response
- /ioc-development
- /compliance-assessment
- /policy-management
- /risk-assessment
- /host-hardening-review
- /iac-security-review
- /secrets-management-review
- /k8s-cluster-review
- /k8s-rbac-review
- /k8s-workload-hardening
- /ai-threat-model
- /owasp-llm-top10
- /prompt-injection-test
- /ml-pipeline-security-review
- /ml-supply-chain-review
- /model-serving-security
- /masvs-review
- /mobile-pentest
- /multimodal-injection-test
- /multimodal-security-review
- /network-pentest
- /network-segmentation-review
- /protocol-security-review
- /exposure-discovery
- /osint-footprinting
- /people-osint
- /recon
- /rag-security-review
- /retrieval-poisoning-test
- /vector-store-isolation-test
- /adversary-emulation
- /ai-use-case-intake
- /sast-review
- /sca-review
- /secure-review
- /safe-function-lint
- /secret-guard
- /security-investigation
- /prd-security-injection
- /secure-architecture-maturity
- /security-design-review
- /architecture-diagram
- /attack-tree
- /infographic
- /mindmap
- /threat-model-dfd
- /secure-pipeline
- /export-to-drive
- /publish-finding-to-jira
- /publish-report-to-confluence
- /asvs-reference
- /attack-lookup
- /framework-mapping
- /owasp-reference
- /secure-coding-kb
- /cvss
- /executive-summary
- /finding
- /pentest-report
- /alert-triage
- /artifact-provenance-verification
- /dependency-supply-chain-review
- /pipeline-integrity-review
- /pipeline-timeout-lint
- /cti-analysis
- /ioc-enrichment
- /threat-actor-profiling
- /maestro
- /pasta
- /risk-rank
- /stride
- /remediation-tracking
- /vulnerability-prioritization
- /vulnerability-scan-triage
- /access-control-test
- /injection-test
- /owasp-web-top10
- /example-skill
17 Agents
ai-safety-engineerBuilds and operationalizes AI safety — turning safety assessments into shipped safeguards: safety evals in CI/CD, guardrail integration, monitoring and drift detection, AI-incident response, safety cases, and responsible-AI governance. Use to design or stand up the safetyai-safety-reviewerSenior AI safety reviewer for an end-to-end SAFETY assessment of a model or feature — harm modeling, safety evaluation, responsible red-teaming, bias/ fairness, guardrails, and responsible-AI governance. Use for a full safety review (about harm to people/society), distinct fromblue-team-defenderCoordinates defensive operations end to end — detection engineering, incident response, threat hunting, and threat intelligence — using threat-informed defense. Use to run or plan blue-team work spanning multiple defensive disciplines, not a single check.
13 Commands
/safety-reviewRun an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case./defendRun a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation./board-briefBuild a board/executive security brief — strategy, quantified risk, and a board-ready deck./tech-reviewAssess technology/security risk for a strategic decision and frame the secure-by-design path./precommitRun the pre-commit security gate on the current changeset and report a single pass/fail verdict./assessmentRun a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
README
awesome-claude-security
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy.
Docs site · Quick install · Getting started · What's inside · Taxonomy · Roadmap · Recipes · Contributing
A pentester knows which OWASP test bends a broken-access-control endpoint. An analyst knows which Sigma rule catches Kerberoasting. A red-teamer knows which payload coaxes an LLM past its guardrails, and a CISO knows how to turn that finding into board-ready risk. Your Claude Code doesn't — until you install the plugins that teach it.
Everything installs à la carte — one repo, but you install only the plugins you want, never "the whole thing." Want only LLM red-teaming? Install llm-security. Only threat modeling? Install threat-modeling.
Prefer a ready-made stack? Install a bundle and it auto-pulls its parts: a role bundle like pentester, or a domain suite like genai-suite. Granular and bundled both come from the same catalog — see docs/BUNDLES.md.
Stable:
v1.1.0. The marketplace, taxonomy, templates, and a full first wave of 45 plugins (110 skills) are shipped and installable — see the roadmap for what's next. This is a community project; it is not affiliated with or endorsed by Anthropic. Contributions welcome — see CONTRIBUTING.
Quick install
In any Claude Code session:
/plugin marketplace add jassics/awesome-claude-security
/plugin install llm-security@awesome-claude-security
Then invoke a skill, e.g. /llm-security:owasp-llm-top10, or just describe your task and let Claude pick the right skill/agent. Full instructions: docs/INSTALL.md.
New here? docs/RECIPES.md shows end-to-end workflows — web pentest, incident response, vuln triage, design review, securing a GenAI feature — each chaining the right skills (and role bundles ship a one-shot command, e.g. /pentester:engagement).
What's inside
Plugins are grouped into four buckets (see the full taxonomy):
| Bucket | What it is | Examples |
|---|---|---|
| Core | Cross-cutting capabilities every security task reuses | security-diagramming, security-reporting, integrations (Jira/Confluence/Drive) |
| Domain | Deep skillsets per security discipline | threat-modeling, web/mobile/cloud/k8s/network/infra security, SAST-SCA, OSINT, DFIR, detection engineering |
| GenAI security | Protecting AI/LLM systems from attackers | llm-security, RAG security, agentic-AI security, multimodal security |
| AI safety | Preventing AI systems from causing harm (a distinct discipline — see why) | ai-safety, ai-safety-engineer |
| Role | Persona bundles that combine domains + workflow | pentester, ai-safety-engineer, security analyst, engineer, architect, GRC, blue team, SOC/SIEM, CISO/CTO |
Shipped today (45 plugins, 110 skills)
Core
security-diagramming(attack trees, DFDs, architecture diagrams, mindmaps, infographics)security-reporting(findings, pentest reports, exec summaries, CVSS)security-integrations(publish to Jira/Confluence/Drive)security-knowledge(ATT&CK / OWASP / framework reference packs).
Domain
threat-modeling(STRIDE/PASTA)web-app-security(OWASP Web Top 10, access control, injection)api-security(OWASP API Top 10, BOLA/BFLA)mobile-security(MASVS/MASTG)sast-sca(static analysis + dependency/SBOM)network-security(network pentest, segmentation, protocols)osint(footprinting, exposure discovery, recon)cloud-security(AWS/Azure/GCP posture, IAM, misconfig)k8s-security(CIS/4Cs, RBAC, pod hardening)infrastructure-security(IaC review, host hardening, secrets)detection-engineering(Sigma/YARA, ATT&CK coverage, threat hunting)dfir(incident response, forensic triage, IOCs)threat-intelligence(CTI lifecycle, IOC enrichment, actor profiling)vulnerability-management(triage, CVSS/EPSS/KEV prioritization, remediation SLAs)supply-chain-security(dependency trust, SLSA/Sigstore provenance, CI/CD integrity)claude-config-security(audit the Claude Code config itself — hooks/MCP/permissions/skills — via theagentscannerCLI).secure-coding(Python/React outdated-function + secret/credential enforcement, git-hook blocking)
GenAI security
llm-security(OWASP LLM Top 10, prompt injection)rag-security(retrieval poisoning, isolation)agentic-ai-security(tool-permission audit, autonomy boundaries, MCP/agent-harness/A2A security)multimodal-security(cross-modal injection)mlops-security(ML supply chain, pipeline security, model serving).
AI safety (≠ security — see why)
ai-safety(harm modeling, safety evals, responsible red-team, bias/fairness, guardrails, RAI governance).
Roles (auto-install their stack)
pentesterred-team(adversary emulation, ATT&CK)blue-team(threat-informed defense + purple teaming)soc-siem(alert triage, monitoring)security-analyst(investigation & analysis, T2/T3)security-architect(secure-by-design, design review)security-engineer(DevSecOps, harden, secure pipelines)ai-safety-engineerresponsible-ai-officer(AI governance, EU AI Act risk-tiering).grc(governance, risk & compliance — framework gap assessments, control mapping)developer(secure-by-default coding companion, PRD/prompt security injection, pre-commit gate).
Executive (strategic tier)
ciso-toolkit(security strategy, cyber-risk quantification, board decks)cto-security(secure-by-design at scale, tech-risk assessment).
Suites (one-shot bundles)
genai-suite(all GenAI security)appsec-suite(web+api+mobile+SAST/SCA)cloud-suite(cloud+k8s+infrastructure)blueops-suite(detection+dfir+threat-intel)ai-safety-suite(safety + GenAI security together).
The roadmap is fully shipped — see it for how the buckets fit together and where the project goes next.
Security vs. safety: the GenAI plugins protect AI systems from attackers;
ai-safetyprevents AI systems from causing harm even absent an attacker. They're complementary — most AI features need both.
Built-in capabilities
Several features are designed to be shared across every plugin:
- Diagrams & visuals — Excalidraw diagrams, mindmaps, attack trees, and infographics via
security-diagramming. - Reporting — repeatable report generation via
security-reporting, from a single finding to a board deck. - Integrations — push findings, reports, and diagrams to Jira, Confluence, and Google Drive (roadmap:
security-integrations, leveraging the matching MCP servers).
Repository layout
.
├── .claude-plugin/marketplace.json # the marketplace catalog
├── plugins/<plugin-name>/ # one installable plugin per directory
│ ├── .claude-plugin/plugin.json
│ ├── skills/<skill>/SKILL.md
│ ├── agents/<agent>.md
│ └── README.md
├── templates/ # copy-to-start scaffolds for new plugins
└── docs/ # taxonomy, roadmap, install, authoring guides
Contributing
This is meant to be a community resource. New domains, roles, skills, and agents are very welcome — start from templates/ and read CONTRIBUTING.md and docs/AUTHORING.md.
Scope & ethics
These assets are for authorized security testing, defensive security, detection, GRC, education, and CTF use. Skills assume you have permission to test the systems involved. See CONTRIBUTING.md.
License
Stars on GitHub
Momentum
- stars in total
- 11
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills45k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about awesome-claude-security.
Install it with the command on its page. It includes a2a-security-review, agent-harness-review, agent-security-review. Its skills do not fire on their own yet. Free and open source.
- What is awesome-claude-security?
- jassics/awesome-claude-security is a Claude Code plugin marketplace for security work across the lifecycle, from threat modeling to detection engineering and governance. It ships skills and agents, such as agent-security-review and mcp-security-review, for reviewing AI agents and MCP servers.
- How do I install awesome-claude-security?
- Run these in Claude Code: /plugin marketplace add jassics/awesome-claude-security. Then prompt normally.
- Does awesome-claude-security auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is awesome-claude-security free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use awesome-claude-security's skills?
- awesome-claude-security installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it