26,960 mods in this category, of every kind an agent can take. Each one carries what it costs per session, what the scan found, and whether it is the original.
Skill Claude CodeCodex
Expert guide for the Osmedeus security automation workflow engine. Use when: (1) writing or editing YAML workflows (modules and flows), (2) running osmedeus CLI commands (scan, workflow management, installation, server), (3) configuring steps, runners, triggers, or template variables, (4) debugging workflow execution…
microsoft/agent-governance-toolkit
Plugin Claude Code ✓ vendor
Bundles 2 commands, 1 MCP server · 32 tokens together
AGT governance hooks and MCP tools for Claude Code sessions.
Skill Claude Code
Endpoint defense bypass — AMSI/ETW patching, ScareCrow framework, custom loaders, direct/indirect syscalls, LOLBAS execution, process injection.
Plugin Claude Code
Bundles 74 skills · 11,398 tokens together
De-identify PHI, run clinical NER, export FHIR, evaluate with leakage gates, and the healthcare workflows around them.
Plugin Claude Code
Bundles 16 skills, 37 commands, 9 agents, 3 hooks · 3,261 tokens together
AI-powered bug bounty toolkit — recon, vulnerability hunting, validation gates, and submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
elementalsouls/Claude-BugHunter
Plugin Claude Code
Bundles 11 skills, 15 commands · 3,173 tokens together
83-skill bug-hunting & external red-team bundle for Claude Code — 58 hunt- web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands in.
Skill Claude CodeCodex
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to…
Skill Claude CodeCodex needs its repo
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminal, logs, or LLM context. Provides guidance around integrating varlock into a project, reading/editing .env.schema and other .env files…
Skill Claude CodeCodex
A task-specific instruction for submitting a flag during a tsec CTF or penetration-testing competition. A CTF is a security contest where participants solve challenges and submit proof strings called flags.
Skill Claude CodeCodex needs its repo ✓ vendor
Run Tika's OSS-Fuzz Jazzer targets locally against a working-tree checkout — build the image, build fuzzers from local source, fuzz a target, run a corpus as a regression pass, reproduce a crash, and add seeds. Use for "fuzz the OneNote parser", "run OneNoteParserFuzzer against these files", "reproduce an OSS-Fuzz…
Skill Claude Code
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since…
Skill Claude CodeCodex
Turns a threat report, a malware analysis, vendor tool documentation, or a raw log sample into draft Sigma detection rules, validated against sigma-cli where a shell exists and labelled "not machine-validated" where not, each paired with a validation note covering assumptions, false positives, evasion gaps, and a test…
Skill Claude CodeCodex
HackerOne bounty program scope-guard workflow — reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow.
Skill Claude CodeCodex
A collection of methods for analyzing websites, browser code, API behavior, and encryption or signing processes. It is intended for authorized investigation and produces findings and reports rather than launching attacks.
Skill Claude Code
Analyze PCIe DMA threats, host-mediated memory acquisition, FPGA behavior, and IOMMU defenses. Use when the memory initiator or device boundary matters; use kernel security for host-only mechanisms.
Cursor rule Cursor
The three most important security patterns in Payload CMS.
Skill Claude Code
Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.
Skill Claude CodeCodex
Ensure that RDS instances are not publicly accessible.
Cursor rule Cursor
Amarok is a lightweight Android app that quickly hides files and applications — ideal for casual privacy needs. Instead of encryption, it manages file and app visibility using various techniques.
Plugin Claude Code
Bundles 6 skills, 1 MCP server · 572 tokens together
Cross-harness memory from Beacon traces: recall reviewed project lessons, distill agent sessions into approved memory, promote memory to Agent Skills, build dashboard lenses, and share sessions to beacon.sh.
Skill Claude CodeCodex
Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must be updated together. A MERGE missing the tenant key silently merges one project's data into another's. Trigger: editing…
Skill Claude CodeCodex
LLM & VLM evaluation suite for home security AI applications.
visa/visa-vulnerability-agentic-harness
Skill Claude CodeCodex
Find weaknesses that consist of an ABSENT control — no rate limit, no session invalidation, no cookie flags, debug left on, secrets or PII stored in cleartext — by enumerating every site the control belongs and checking each.
Skill Claude CodeCodex needs its repo
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: