The best plugins are on Flowy :)

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 categories. 11 security domains, 60+ secret patterns, parallel subagent analysis, professional report generation. Built by tododeia.com

A collection of security and utility hooks for Claude Code. Hooks allow you to extend Claude Code's behavior by running custom scripts at key points during execution.

The TypeScript framework for secure, MCP 2.0-native servers. MCP Fusion is a TypeScript framework that enforces security at the architectural level of every MCP server. Raw data never reaches the LLM without passing through a typed egress firewall.

AI-powered cybersecurity code review skill for Claude Code. 8 specialist agents, OWASP 2025, CWE Top 25, MITRE ATT&CK, 11 languages, zero configuration.

A Rust CLI for automating Ghidra reverse engineering tasks. Usable directly by hand or driven by an AI coding agent like Claude Code.

An assortment of security operations skills for AI coding agents. A collaborative approach to shift-left security using Claude Code skills.

Claude Code plugin providing skills for x64dbg debugger automation.

English: Multi-layer VPN system (VLESS Reality + Russian relay VPS + WebRTC) for bypassing Russian internet censorship (ТСПУ/DPI). Designed to be deployed automatically via Claude Code. See below for Russian documentation.

A comprehensive framework for analyzing and defending against attacks targeting Software Development Lifecycle infrastructure.

Advanced prompt injection defense system for AI agents. Multi-language detection, severity scoring, and security auditing.

Offline security scanner for AI-agent repos, skills, plugins, and MCP servers.

🔍 Claude Skills 安全扫描工具 - 保护你的开发环境

基于 jar-analyzer 的 Claude Code 插件，用于 Java JAR/WAR 包静态分析与安全审计。

Author: incogbyte Claude Code skill that automates Android application reverse engineering.

An agent skill that applies SAIL V2 — Pillar Security's Secure AI Lifecycle framework — to real systems.

An open source plugin for enabeling claude to gain offensive pentesting capabilities

27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.

Know your Mac's security posture, fix the gaps, and keep it locked down. One command. fort runs 15+ security checks on your Mac, fixes what it safely can, and writes an auditor-ready report. No agent, no signup, no MDM enrollment. Just a single binary.

Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,413 verification items · 136 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC

Open Source CVE Hunting Harness for Claude Code A Claude Code plugin that systematically finds real CVEs in open source packages through coordinated multi-agent security research.

A token-efficient, in-session security-triage skill for Claude Code. secscan runs a staged LLM SAST pipeline entirely inside a single Claude Code session using the agent's own Read/Grep/Glob tools — no external scanner, no per-chunk fan-out, no voting runs.

The Plugin equips Claude Code with advanced binary analysis capabilities for tasks such as incident response, malware investigation, and vulnerability assessment. It connects to the remote Dr.

Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).

**An integrity hook for Claude Code that watches the agent's own tool calls and blocks the ones that fake a check.** When Claude says it did something — ran the tests, cited a paper, committed the fix, verified the certificate — makoto holds that word against

AI-powered web application penetration testing skills with Claude Code

Threat hunting command system for agentic IDEs

👉 ⭐ Star on GitHub if Hardstop keeps you safe! Pre-execution safety validation for AI coding agents.

Agent Guard is a local-first guardrail for Claude Code, Codex, Git hooks, GitHub Actions, and direct shell use. It blocks common secret-exposure paths before a supported tool runs, redacts supported tool output, and scans changed files after mutations.

I vibe-hacked my way to Top #87 Global on Hack The Box. Hall of Fame. Built entirely on Claude Code.

AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 22 skills, 7 autonomous agents. STRIDE threat modeling, OWASP 2025 coverage, polyglot monorepo support.

Runtime guardrails for Claude Code. Auto-approve what's safe, gate what's risky, block what's dangerous. Dual enforcement, full audit trail. MIT.

Multi-plugin marketplace for Claude Code offensive security plugins

Claude-native, governed offensive-OSINT and external attack-surface platform for authorized security teams. Outrider is the governed front half of the offensive workflow.

Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any agentskills.io agent. Mapped to OWASP, MITRE ATT&CK, NIST CSF, D3FEND, ATLAS.

Security skills for Claude Code. Install them once and ask Claude, in plain language, to scan a repo for leaked secrets, review Python code, red-team an LLM for prompt injection, or audit HTTP headers, JWTs, Dockerfiles, CORS, and dependencies.

AKA Security — We secure agent harnesses at the source. AI Traffic Control (ai-tc) is an open-source control plane for coding agents.

Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy

Accepted product direction — implementation pending: EraseMe remains an independent privacy product. Browse/Operate becoming optional Brain modules and credential UI moving to Brain must not introduce a mandatory Brain dependency into privacy workflows.

A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.

Clearfront OSINT: free, open-source AI OSINT agent that maps your digital footprint across 3,400+ public data sources. REPL, CLI, web console, MCP server.

Every AI skill, independently scanned. Public, open-source trust scoring for skills, MCP servers, hooks, and plugins across every agent platform. Apache-2.0. saferskills.ai

A Claude Code skill for defensive security review of your own code. Detects security vulnerabilities, data-leakage risks, stress/performance risks, and code quality issues, then produces a severity-ranked risk report plus corrected code.

Adversarial security review for AI skills, repos, MCP servers, and packages before you install them. A read-only scanner plus a five-persona reasoning pass, ending in a GO / GO WITH MITIGATIONS / NO-GO verdict.