safety-review
CommandRun an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
@jassicsInstall CommandSecurity
Command
/engagement
Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
> /plugin marketplace add jassics/awesome-claude-security
Command definition
engagement.mddescription: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
Read more
description: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow. argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
Ships withawesome-claude-security
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
11111 skills17 agents1 MCP
Stars on GitHub
Momentum
- stars in total
- 11
Other commands on awesome-claude-security.
@jassicsInstall Commanddefend
CommandRun a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
@jassicsInstall Commandboard-brief
CommandBuild a board/executive security brief — strategy, quantified risk, and a board-ready deck.
@jassicsInstall Commandtech-review
CommandAssess technology/security risk for a strategic decision and frame the secure-by-design path.
@jassicsInstall Commandprecommit
CommandRun the pre-commit security gate on the current changeset and report a single pass/fail verdict.
@jassicsInstall Commandassessment
CommandRun a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
@jassicsInstall CommandMore commands from other plugins.
audit
CommandAudit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
@trailofbitsInstall Commandagt-check
CommandCheck text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
@microsoftInstall Commandarsenal
CommandShow which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…
@awarexoneInstall Command