Security plugins

fb0sh/pentester

Plugin Claude CodeCodex

A collection of tools and instructions for finding security weaknesses through SRC programs, public bug-bounty programs run by companies or platforms.

humaidhahm/opencode-pentester

Plugin Claude Code

Full penetration testing framework - 69 attack categories across 16 domains covering OWASP, injection, authentication, cloud, and more.

sonnysangha/Vibe-Code-the-Right-Way-Ep-1-Indeed-Clone-Multi-Tenant-Clerk-Convex-MCP

Plugin Claude CodeCodex

Build custom sign-in/sign-up flows and customize component appearance. Use for custom auth flows, appearance styling, non-standard patterns.

coo-quack/sensitive-canary

Plugin Claude Code

Blocks secrets and PII before they reach the Anthropic API.

ZealynxSecurity/krait

Plugin Claude Code

Smart contract security analysis powered by 4,500+ real audit findings from Solodit. Quick scans, full framework assessments, and integration with audit-readiness.zealynx.io.

Myr-Aya/GouvernAI-claude-code-plugin

Plugin Claude Code

Achieve flow state safely with Claude Code. Auto-approves routine work, gates risky actions, hard-blocks dangerous patterns. Dual enforcement (skill + hooks), token cap for cost governance, full audit trail. Zero dependencies.

airblackbox/airblackbox

Plugin Claude Code

EU AI Act compliance scanner and trust infrastructure for Python AI projects.

Correia-jpv/fucking-awesome-web-security

Plugin Claude Code

Curated, always-fresh web security learning resources for AI agents and security researchers.

kirich1409/krozov-ai-tools

Plugin Claude Code

Maven dependency intelligence — dependency updates, vulnerability and license scanning, transitive dependency graphs, version compatibility checks, artifact search, and version-catalog management, exposed as skills and an MCP server. Works in Claude Code and Grok Build without any NPM setup.

kalpmodi/akira

Plugin Claude Code

The AI pentest co-pilot that actually finds bugs. Phase-chained, evidence-gated offensive security skills for bug bounty and authorized pentesting.

MaxwellCalkin/sentinel-ai

Plugin Claude Code

Real-time safety scanning for LLM interactions. Detects prompt injection, PII leaks, harmful content, toxicity, obfuscation, secrets, and dangerous tool calls — 600-case benchmark at 100% accuracy with sub-millisecond latency.

VincentChuWaiChow/vanguard-frontier-agentic

Plugin Claude Code

Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.

mohdhaji87/payloadsallthethings-skills

Plugin Claude Code

Plugin marketplace listing 1 plugin: payloadsallthethings.

roboco-io/plugins

Plugin Claude Code

A security review and vulnerability analysis skill based on the OWASP Top 10 2025, a list of common and serious web application security risks.

jsegov/shipspec-claude-code-plugin

Plugin Claude Code

Spec-driven development for big features. When features get too big, plan mode gets too vague—leading to hallucinations during implementation. ShipSpec replaces vague plans with structured PRDs, technical designs, and ordered tasks that keep Claude grounded.

ogrodev/fsociety

Plugin Claude Code

Plugin marketplace listing 5 plugins: elliot, romero, trenton, tyrell, fsociety.

pstuart/pstuart

Plugin Claude Code

Universal developer safety guardrails — blocks dangerous commands, verifies builds, provides session context, and scans repo health.

whchoi98/aws-skills-for-claude-code

Plugin Claude Code

36 on-demand AWS and cloud skills, slash commands, agents, and security hooks for Claude Code.

whchoi98/aws-skills-for-claude-code

Plugin Claude Code

36 on-demand AWS and cloud skills, slash commands, agents, and security hooks for Claude Code.

thejefflarson/soundcheck

Plugin Claude Code

Plugin marketplace listing 1 plugin: soundcheck.

thejefflarson/soundcheck

Plugin Claude Code

Automated OWASP security checks — Web Top 10:2025, LLM Top 10:2025, API Security Top 10:2023.

yurukusa/claude-code-hooks

Plugin Claude Code

Production safety hooks for autonomous Claude Code operation. Context monitoring, syntax checking, branch protection, activity logging, and more.

Ares960826/luffy-arm

Plugin Claude Code

Give a local AI agent a remote hand over SSH: read, run, diagnose and pull data from a remote Linux server behind a tiered, unprivileged, ACL-read-only safety model.

anthony-chaudhary/dos-kernel

Plugin Claude Code

The kernel is the part that doesn't believe the agents. Bundles the DOS hooks (verify-on-stop, deny-a-refused-call, re-surface-a-stalled-stream), the DOS MCP server (verify / arbitrate / refuse-with-a-reason as tools), and the generic skill pack — one install. Requires the dos-kernel Python package: pip install 'dos.