blue-team plugins

15 tagged blue-team, measured the same way as everything else here.

Browse within: ai-security 13penetration-testing 11

agent-security

01

zero-lab-ai/skills

Plugin Claude Code

Bundles 4 skills · 205 tokens together

Reviews agent and MCP surfaces, tests prompt-injection and runtime controls, and maps identity and authority across agent handoffs.

not rated 283 +1 12d ago A tokens not measured original Apache-2.0

code-abyss

02

telagod/code-abyss

Plugin Claude Code

Bundles 39 skills · 3,051 tokens together

26 domain skills + 5 verification tools for security-first full-stack engineering. Covers security, architecture, DevOps, AI, mobile, office docs, frontend design, and multi-agent coordination.

not rated 244 +2 3mo ago A tokens not measured original MIT

cybersec-toolkit

03

26zl/cybersec-toolkit

Plugin Claude Code

Bundles 197 skills, 2 hooks, 1 MCP server · 12,682 tokens together

872 on-demand security skills for CTF, pentest, bug bounty, DFIR, detection engineering, cloud, identity, and red/blue team work. Skills are plain Markdown and activate by task without permanently consuming context. Bundles vendored skills under mixed licenses (MIT, Apache-2.0, CC-BY-SA-4.0) — see per-source…

not rated 84 +7 changed 12d ago A tokens not measured original MIT

malware-analysis

04

gl0bal01/malware-analysis-claude-skills

Plugin Claude Code

Bundles 6 skills · 453 tokens together

Agentic malware analysis: Claude runs the static tooling, parses exported VM evidence, writes and tests detection rules, and drafts the report across triage, dynamic analysis, specialized file analysis, detection engineering, and reporting.

not rated 54 1mo ago A tokens not measured original MIT

usap-skills

05

jaskaranhundal/usap-skills

Plugin Claude Code

Bundles 87 skills, 7 commands, 1 plugin · 568 tokens together

Unified Security Agent Platform — 81 cybersecurity skills + 13 cs- agents that emit a typed 11-field JSON output contract, mapped to MITRE ATT&CK and NIST CSF 2.0. Runs in any LLM. Bundles 7 slash commands (usap:run, usap:fortigate, usap:orchestrate, usap:challenge, usap:compare, usap:test, usap:README) and 6 user-inv.

not rated 5 +1 changed 1mo ago A tokens not measured original Apache-2.0

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: