36 tagged appsec, measured the same way as everything else here.
Browse within: devsecops 10ai-security 9claude-code-plugin 9asvs 5owasp 5
Plugin Claude Code
Bundles 11 skills, 15 commands · 2,409 tokens together
82-skill bug-hunting & external red-team bundle for Claude Code — 57 hunt- web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands in.
Plugin Claude Code
Bundles 1 skill · 109 tokens together
Security review and secure-coding skill covering OWASP Top 10:2025, ASVS 5.0, the OWASP LLM Top 10 (2026), and the OWASP Agentic Top 10 (2026).
AgriciDaniel/claude-cybersecurity
Plugin Claude Code
Bundles 1 skill · 201 tokens together
AI-powered cybersecurity code review with 8 specialist agents, OWASP Top 10:2021, CWE Top 25:2024, MITRE ATT&CK v15, and framework-aware false-positive suppression.
Plugin Claude Code
Bundles 17 skills · 717 tokens together
Skills for using the Pixee CLI: authentication, scans, workflows, repositories, findings, and API access.
Plugin Claude Code
Bundles 32 skills, 15 commands, 9 agents · 2,759 tokens together
Claude Code plugin for whitebox security review. Stable: deterministic offline quick scan, shared findings.json with stable keys and hotspot-aware findings, SARIF/Markdown/HTML/bundle reports, suppressions, CI fail-on gate, Kuzushi parity. Beta: deep profile with Joern/CodeQL/Slither/Trivy/Checkov when installed.…
Plugin Claude Code
Bundles 2 skills · 274 tokens together
CrowdSec skills: an operational skill (install/configure/operate/debug the engine, cscli, bouncers, WAF and bot detection across bare-metal/Docker/Kubernetes) and a Service API skill (drive the premium Console cloud API — blocklists, allowlists, firewall integrations, metrics, decisions).
Plugin Claude Code
Bundles 1 skill · 128 tokens together
Security audit and hardening for vibe-coded SaaS apps. Walks the 50 most common ways AI-generated apps get owned and produces a prioritized fix list.
Plugin Claude Code
Bundles 9 skills, 2 agents · 1,032 tokens together
OpenText Fortify AppSec skills. Use for SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD pipeline integration, and FCLI commands. Supports Fortify on Demand (FoD) and Software Security Center (SSC).
Plugin Claude Code
Bundles 6 skills · 641 tokens together
OWASP API Security Top 10 skills for AI coding agents: BOLA detection, auth and RBAC scaffolding, injection checks, security test generation, full API security review, and OpenAPI schema hardening.
Plugin Claude Code
AppSec Foundry plugins for application security work in Claude Code.
Plugin Claude Code
Bundles 14 skills, 5 commands · 353 tokens together
CI/CD supply chain hardening for Rust projects — Trusted Publishing, SLSA provenance, Scorecard, cargo-deny, and more.
Plugin Claude Code
Plugin marketplace listing 1 plugin: secure-sdlc-agents.
Plugin Claude Code
Bundles 1 skill · 0 tokens together
Shor — autonomous AI web pentester. Provides the /shor-setup slash-command: an interactive wizard that guides you from zero to a running scan (black-box or white-box, GCP deployment included).
NovaCode37/claude-security-skills
Plugin Claude Code
Bundles 8 skills · 690 tokens together
Security skills for Claude Code: secret scanning, Python SAST, prompt-injection testing, and HTTP, JWT, Dockerfile, CORS and dependency auditing. Runs on the standard library with no runtime dependencies.
Plugin Claude Code
Bundles 56 skills · 3,391 tokens together
753 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more.
Plugin Claude Code
Bundles 12 skills, 11 agents, 3 hooks, 1 MCP server · 1,662 tokens together
Endor Labs workflow agents and setup for Claude Code.
Plugin Claude Code
Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
Zyoffsec/airtight-secure-coding
Plugin Claude Code
Bundles 1 skill, 1 hook · 63 tokens together
Secure-coding gates for AI-written code. 70 numbered gates mapped to OWASP Top 10 and CWE, plus a pre-write guard that denies the failures it can prove: open routes, IDOR, missing CSRF tokens, interpolated queries and shell commands, raw HTML sinks, unverified webhooks, any-origin CORS with credentials, passwords…
xChechi/xche-ai-app-security-pack
Plugin Claude Code
Bundles 2 skills, 1 hook · 85 tokens together
Security guardrails for AI-built apps: OWASP/API/LLM/MCP rules applied while building, an /audit skill for full reviews, and a hook that blocks secret commits.
UnboundCompute/security-agent-skills
Plugin Claude Code
Bundles 194 skills · 32,602 tokens together
Security-testing methodology as portable agent skills, spanning white-box bug hunting, AI-agent and LLM red-teaming, cloud identity and CI/CD trust, client-app trust surfaces across browser and editor extensions and Electron, wire-protocol and token trust across gRPC, WebSocket, and JWT, enterprise identity lifecycle…
Plugin Claude Code
Bundles 1 skill, 2 MCP servers · 76 tokens together
Agentic Application Security Platform (ASPM) for Claude Code. Prevents risk before code exists by rewriting prompts into secure prompts using each repository's Software Graph and organizational security and compliance policies. Run differential SAST, SCA, and Secrets scans and AutoFix risks directly from your IDE…
tinoimammp/vantage-security-agent
Plugin Claude Code
Bundles 1 skill, 6 commands · 384 tokens together
Artifact-driven, plugin-based multi-agent SAST pipeline for web and mobile app repositories. Web agents cover the OWASP Top 10; mobile agents cover the OWASP Mobile Top 10 (2024, M1-M10). Both share global validation/PoC/reporting agents. Run /vantage:scan-web or /vantage:scan-mobile to scan, then /vantage:fix-issue…
parousia8888/web-app-security-skill
Plugin Claude Code
Bundles 1 skill · 225 tokens together
Audit and harden authorized Web projects with explainable, reproducible evidence.
Plugin Claude Code
Bundles 2 skills · 423 tokens together
Skills packaging the Gauntlet Loop — build → blind-critic → revise → repeat against a hard bar — for coding, writing, design, data, research, prompt evaluation, detection engineering, and authorized security testing.