Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/alexclowe/awesome-claude-cowork-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/alexclowe/awesome-claude-cowork-plugins/hr-manager)<a href="https://agentmods.dev/plugins/alexclowe/awesome-claude-cowork-plugins/hr-manager"><img src="https://agentmods.dev/badge/plugins/alexclowe/awesome-claude-cowork-plugins/hr-manager/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/alexclowe/awesome-claude-cowork-plugins/hr-manager"><img src="https://agentmods.dev/badge/plugins/alexclowe/awesome-claude-cowork-plugins/hr-manager.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
hr-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{"name":"hr-manager","description":"Write job descriptions, draft policies, run RTO and severance comms, audit reviews and JDs for bias","version":"1.1.0","author":{"name":"The AI Career Lab","email":"[email protected]"},"homepage":"https://theaicareerlab.com/professions/hr-manager","repository":"https://github.com/alexclowe/awesome-claude-cowork-plugins","license":"MIT","keywords":["hr","human-resources","hiring","policies","onboarding","rto","severance","bias-audit","reskilling"],"category":"business"}
What it installs
The manifest is a name and a version. 3 skills, 8 commands travel with it, and installing the plugin installs all of them — 150 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill reskilling-pathway-mapper A 27 tokens
- Skill talent-acquisition A 17 tokens
- Skill hr-operations A 15 tokens
- Command audit-hiring-for-bias A 10 tokens
- Command quiet-firing-detector A 16 tokens
- Command severance-negotiation A 19 tokens
- Command rto-comms A 19 tokens
- Command employee-email A 4 tokens
- Command job-description A 8 tokens
- Command onboarding-doc A 7 tokens
- Command policy-draft A 8 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago First seen · 2 lines scan A 08187443b4be
hr-manager is a plugin published in the GitHub repository alexclowe/awesome-claude-cowork-plugins (30 stars, last pushed 4d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.
Other plugins, from other repositories
eu-ai-act
EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5), Annex III high-risk use cases, provider and deployer obligations (Arts. 9–17, 26), GPAI model obligations and systemic risk (Arts. 51–55, enforcement Aug 2, 2026), conformity…
nis2
EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities — entity classification, Art. 21 risk management measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 governance obligations, supply chain security (Art. 26), gap assessments, policy drafting, ISO…
nist-ai-rmf
Expert NIST AI Risk Management Framework (AI RMF 1.0) advisor — gap assessments, organizational profiles, GOVERN/MAP/MEASURE/MANAGE function guidance, AI risk registers, trustworthiness evaluation, and cross-framework mapping to ISO 42001, EU AI Act, and NIST CSF.
swift-csp
SWIFT CSP / CSCF v2026 expert covering all 32 controls (26 mandatory + 6 advisory), including Control 2.4 now mandatory (back-office data flow security). Architecture types A1–A4/B, KYC-SA attestation (window July 1–Dec 31, 2026), independent assessment, gap analysis, fraud prevention, and cross-framework mapping.
iso27001
Expert ISO 27001 gap analysis, policy writing, Annex A control guidance, SoA generation, and risk register creation for both 2013 and 2022 versions.
tsa-compliance
TSA cybersecurity compliance advisor for critical infrastructure — pipeline, freight rail, and transit Security Directive requirements including CIP/COIP, IRP, ADR, CAP, incident reporting, and OT/ICS security.