Flowy lists 18 plugins that ship hooks for Security, and the most-starred are guillaumemeyer-watermarks-remover (25,426 stars), awarexone-agentic-bug-hunter (5,478 stars) and shuvonsec-claude-bug-bounty (5,478 stars). The newest push among those Security plugins with hooks, on October 28, 2026, went to awarexone-agentic-bug-hunter.
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
@guillaumemeyerInstall HookRuns recon on a target, tests it for real, reportable vulnerabilities, checks each finding against a strict validation gate, and writes a report ready to submit to bug bounty platforms. It also remembers patterns across targets and resumes unfinished sessions.
@awarexoneInstall HookA Claude Code plugin for bug bounty hunters, bundling skills for reconnaissance, vulnerability hunting such as IDOR, SSRF and XSS, black-box audits of deployed AI agents, and CI/CD pipeline security.
@shuvonsecInstall HookA bug bounty agent framework for Claude Code that automates reconnaissance, vulnerability hunting and exploit chaining, with skills for analyzing recon output, running autonomous hunt loops and correlating findings into attack chains.
@h-mmerInstall HookVestige is a fail-closed runtime firewall for AI agents. The model proposes, a deterministic gate decides, and every action leaves a receipt. When something breaks, causal_walk finds the real cause.
@samvallad33Install HookA cyber threat intelligence and OSINT analysis toolkit that runs structured investigations and produces analyst-style reports with sourced, trust-scored findings. Built for security analysts working OSINT and CTI cases in Claude Code.
@7onezInstall HookA Claude Code plugin for offensive security work, offering structured red-team engagement workflows based on the Cyber Kill Chain. It covers attacks on Active Directory, AI and LLM systems, command and control infrastructure, and browser exploitation.
@hypnguyen1209Install HookChecks the shell commands, URL fetches and file writes an AI coding assistant is about to run, and blocks dangerous ones such as reverse shells, command injection and risky credential or supply chain actions before they execute.
@gendigitalincInstall HookRemote approvals, policy checks, and execution evidence for unattended AI agents.
@ucsandmanInstall HookOffline security scanner that audits git repos, AI skills, plugins, MCP servers, and agent credentials for prompt injection, credential theft, and known vulnerabilities. Runs as a skill and as pre-tool-use hooks.
@alexgreenshInstall HookHelps security researchers find real vulnerabilities in open source packages by coordinating several agents to scan code, mine past advisories for incomplete fixes, and triage false positives. Each candidate issue comes with the evidence needed to judge whether it is a genuine CVE.
@byamb4Install HookThreat hunting command system for agentic IDEs.
@backbay-labsInstall HookStar on GitHub if Hardstop keeps you safe! Pre-execution safety validation for AI coding agents.
@frmorettoInstall HookRugproof your code before someone else does. Live site: omermaksutii.github.io/RugProof Latest: v1.0.0, 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy.
@omermaksutiiInstall HookStores your API keys in the OS keychain so Claude Code can use them without seeing the actual values. The model writes a placeholder, and the real key is substituted when the command runs.
@matterhornsoInstall HookBy GitHub stars (Flowy does not rate quality), the best Security plugin with hooks for Claude Code is guillaumemeyer-watermarks-remover (25,426 stars), ahead of awarexone-agentic-bug-hunter (5,478 stars) and shuvonsec-claude-bug-bounty (5,478 stars).
Flowy lists 18 plugins that ship hooks for Security, and this page draws all 18 Security plugins with hooks.
