Security auditor & guard-builder for vibecoded apps (web, AI/LLM, mobile, desktop, backend, CI/CD). Claude Code plugin + claude.ai skill. Community project, not an official Anthropic product.
Skill Claude CodeCodex
Part of claudeguard-il
Run four active (Tier 2) GET probes against a target the user owns and is authorized in writing to test — a reflected-markup check, a quote in an id parameter, an open-redirect check and a CSP check. This is a smoke test, NOT a scanner - no crawling, no authenticated flows, no parameter discovery, no IDOR, no fuzzing…
Skill Claude CodeCodex
Part of claudeguard-il
Apply ClaudeGuardIL guards to the codebase (opt-in auto-fix) for findings the grader marked confirmed and autofixable, dry-run diff first and review before writing. Use when the user types /cg-fix or asks to automatically fix, patch, or apply the security fixes. Only touches the codebase, never a live target.
Skill Claude CodeCodex
Part of claudeguard-il
Generate paste-ready hardening code (guards) for ClaudeGuardIL findings and for the coverage rows the rules could not decide, without modifying files. Use when the user types /cg-harden or asks for the fix, the guard, RLS policy, validation, headers, or middleware for a finding.
Skill Claude CodeCodex
Part of claudeguard-il
Interview the user in plain Hebrew and English about who may see and change each kind of record in their app, then write the claudeguard.intent.yml that the business-logic checks run against. Use when the user types /cg-intent, when a scan reports businessLogic.status as assumed, or when they ask why the…
Skill Claude CodeCodex
Part of claudeguard-il
Run passive (Tier 1) live checks against a URL the user owns — read-only TLS, security headers, cookie flags, exposed files/routes, and public Supabase/Firebase reads. The probe records observations; grader.mjs turns them into findings. Use when the user types /cg-live or asks to check a running site they own.…
Skill Claude CodeCodex
Part of claudeguard-il
Run a static (Tier 0) ClaudeGuardIL security scan of the current project — the engine computes facts, the grader assigns every severity, the domain auditors review only what the rules could not decide. Use when the user types /cg-scan or asks to scan, audit, or security-check the codebase without touching a live…
Skill Claude CodeCodex
Part of claudeguard-il
Audit vibecoded apps for security vulnerabilities and generate paste-ready guards. Use this skill whenever the user asks to "check my app for security", "is my app safe", "security review", "audit my code", "find vulnerabilities", "harden my app", mentions leaked API keys, exposed secrets, Supabase or Firebase RLS…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: