26,946 mods in this category, of every kind an agent can take. Each one carries what it costs per session, what the scan found, and whether it is the original.
Skill Claude CodeCodex
Configure the private route as a hidden admin utility. Moves credentials to env vars; operator updates .env using .envTemplate instructions. No credentials passed to the skill.
Plugin Claude Code
Bundles 1 skill · 70 tokens together
A collection of tools and instructions for finding security weaknesses through SRC programs, public bug-bounty programs run by companies or platforms.
Agent Claude Code
Peiter "Mudge" Zatko, cybersecurity researcher and former DARPA program manager. Former Chief Security Officer at Twitter and member of the Cult of the Dead Cow hacker group. Expert in vulnerability research, security program management, and improving security practices across large organizations. Focuses on practical…
Myr-Aya/GouvernAI-claude-code-plugin
Plugin Claude Code
Bundles 1 skill, 1 command, 1 hook · 117 tokens together
Achieve flow state safely with Claude Code. Auto-approves routine work, gates risky actions, hard-blocks dangerous patterns. Dual enforcement (skill + hooks), token cap for cost governance, full audit trail. Zero dependencies.
lucasrosati/claude-security-agents
Agent Claude Code
Defensive security specialist. Use to apply vulnerability fixes, security hardening, security headers implementation, rate limiting, and automated security tests. Works on top of red-team-scanner reports.
VincentChuWaiChow/vanguard-frontier-agentic
Plugin Claude Code
Bundles 196 skills, 4 plugins · 15,080 tokens together
Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.
Skill Claude CodeCodex
Reviews code for bugs, security issues, and best practices. Suggests improvements with concrete examples.
Skill Codex
QA testing and validation of GoGatoZ features against the local GoGatoZ CTF lab. Invoke for post-change testing, live flag validation, lab infrastructure checks, payload smoke tests, enumerate/attack/search/pivot/notify validation, or any request to confirm that GoGatoZ still works.
Plugin Claude Code
Bundles 9 skills, 2 agents · 1,032 tokens together
OpenText Fortify AppSec skills. Use for SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD pipeline integration, and FCLI commands. Supports Fortify on Demand (FoD) and Software Security Center (SSC).
hesreallyhim/proton-pass-community-mcp
Skill Claude CodeCodex
Canonical protocol for model-side skill behavior when orchestrating proton-pass-community-mcp tools in chat sessions.
Skill Claude CodeCodex
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
Plugin Cursor
Bundles 1 skill · 120 tokens together
Skarn for Cursor: audit your AI coding sessions and assistant configs for leaked credentials and risky configuration, and run the pre-execution guard. Backed by the Skarn detection engine on your machine; the skarn binary is installed separately. It declares one local MCP server, named skarn, with four tools (scansess.
Skill Claude CodeCodex
Inject secrets into subprocesses via environment variables. You never see secret values — authy run injects them directly. Use for any command that needs API keys, credentials, or tokens.
Skill Codex
Coordinate full or multi-stage AuditHub OrCa fuzzing campaigns for Solidity projects. Use when a user asks to run an autonomous OrCa campaign, plan and execute setup/tuning/spec/long-run loops, resume an OrCa campaign, or coordinate target selection, deployment setup, smoke runs, callmetrics.json analysis, tuning, [V]…
ez-lbz/claude-code-security-skills
Skill Claude CodeCodex
Scans source code for security vulnerabilities — injection flaws, authentication bypasses, hardcoded secrets, XSS, and more — then filters false positives and ranks findings by severity and confidence. Supports all programming languages. Uses a three-phase audit-filter-report workflow with customizable scan categories…
Skill Claude CodeCodex
Digital Citizenship Protocol — identity, intent declaration, and audit trail for AI agents.
Plugin Claude Code
Bundles 2 skills · 153 tokens together
Comprehensive security evaluation tools for agent skills and MCP servers with integrated GitHub and Bright Data access.
caido-community/caido-plugin-skill
Plugin Claude Code
Expert Caido plugin development with comprehensive SDK documentation.
jguimera/SecurityCopilotMCPServer
Cursor rule Cursor
This project is focused on developting and testing components for Microsoft Security Copilot.
MCP server Claude CodeCodexCursor +2
MCP server "yaraflux-mcp-server" as configured in ThreatFlux/YaraFlux. Runs in Docker (yaraflux-mcp-server:latest).
Skill Claude CodeCodex
Block weak ciphers, predictable RNG, undersized keys, fast-hash password storage, nonce reuse, and non-constant-time comparison. Use when generating code that hashes, encrypts, or signs, code that compares secrets, MACs, or tokens, or config for key sizes and randomness.
Skill Claude CodeCodex
Securely deploy OpenClaw (autonomous AI agent) on a Hetzner VPS with full hardening — Tailscale VPN, firewall, non-root user, loopback-only gateway, Telegram integration, and end-to-end security verification. Use this skill whenever the user mentions OpenClaw, ClawdBot, setting up an AI agent on a VPS, deploying…
Correia-jpv/fucking-awesome-web-security
Skill Claude Code
Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.
Skill Claude CodeCodex
Analyze Ruby gem dependencies, vulnerabilities, outdated packages, maintenance health, and insecure gem sources with the gemtracker CLI. Use when asked to audit Ruby gems, check Gemfile.lock security, review dependency health, or run gemtracker.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: