Command
safety-review
Run an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
@jassicsView CommandSecurity
Command
/engagement
Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
Install
> /plugin marketplace add jassics/awesome-claude-securityHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/engagement
Context preview
What this command does when you run it.
Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
Command definition
engagement.mddescription: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
Read more
description: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow. argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
Ships withawesome-claude-security
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Get the whole plugin
Stats
7
Stars
0
Forks
Maintained
Maintenance
Python
Language
GPL-3.0
License
1mo ago
Last commit
3mo ago
Created
Repo: jassics/awesome-claude-security
Other commands on awesome-claude-security.
@jassicsView CommandCommand
defend
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
@jassicsView CommandCommand
board-brief
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
@jassicsView CommandCommand
tech-review
Assess technology/security risk for a strategic decision and frame the secure-by-design path.
@jassicsView CommandCommand
precommit
Run the pre-commit security gate on the current changeset and report a single pass/fail verdict.
@jassicsView CommandCommand
assessment
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
@jassicsView Command