26,946 mods in this category, of every kind an agent can take. Each one carries what it costs per session, what the scan found, and whether it is the original.
Agent Claude Code
Use when reviewing changes that touch the sandbox boundary or credential handling — pathguard.rs, workspacepermissions.rs, securestorage.rs, fsutils.rs, gitops.rs, sidecar.rs, src-tauri/capabilities/.json, tauri.conf.json — or when adding any Tauri command that takes a caller-supplied path, spawns a process, or reads…
Agent Claude Code
Vulnerability-hunting strategist. The main agent spawns six concurrent instances of this subagent when stuck, hitting walls, showing quit semantics, or about to ask the user "what next" during hunting. Each instance carries one of six thinking perspectives (Chainer / Skeptic / Lateral / DevPsych / Scope-Expander /…
Skill Claude CodeCodex
AES-256-GCM encrypted persistent memory layer for Hermes Agent. Provides encrypted cross-session memory, Trust Quotient (TQ) scoring, and automatic recall across ALL channels (Telegram, WhatsApp, CLI, Discord).
brighton-labs/railguard-cursor-coding
Cursor rule Cursor
Enforces secure database access in C# applications using the full RAILGUARD framework. Covers safe use of ADO.NET, Entity Framework Core, parameterized queries, credential management, and logging hygiene.
MCP server Claude CodeCodexCursor +2
MCP server "sb-siem-mcp" as configured in Sbharadwaj05/sb-siem-mcp. Runs locally from the sb-siem-mcp Python package.
Cursor rule Cursor
Security best practices for LLM/AI applications - prompt injection defense, rate limiting, PII protection.
Plugin Claude Code
Bundles 1 skill · 61 tokens together
Design multi-event behavioral detection rules using CrowdStrike NG-SIEM correlate() function for attack chain detections across AWS, EntraID, and CrowdStrike data sources.
Plugin Claude Code
Bundles 1 skill · 116 tokens together
AI-driven intercepting proxy + rootless execution sandbox for web pentesting. Installs the burpwn skill, which teaches the agent to create a session and route target-facing network commands through burpwn exec so their traffic is captured, MITM-decrypted, searchable, replayable, and live-interceptable. Requires the.
one3qualsone/elastic-security-agent-mesh
Cursor rule Cursor
Project context and conventions for the Elastic Security Agent Mesh — autonomous SOC platform.
Threat-Vector-Security/guardian-agent
Skill Claude CodeCodex
Attack patterns and real-world examples sourced from the HackerBot Claw campaign analysis by StepSecurity (2025): https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation -->.
Skill Claude CodeCodex
Use when user provides a WeChat Mini Program AppID and asks about mini program security, vulnerabilities, source code audit, data leakage risks, wxapkg analysis, or whether a mini program stores sensitive data in plaintext. Also use when user wants to check a mini program for hardcoded keys, client-side logic bypass…
MCP server Claude CodeCodexCursor +2
SQLite MCP server with OAuth 2.1, HTTP/SSE, 122 tools, and smart tool filtering. Runs locally from the db-mcp npm package.
MCP server Claude CodeCodexCursor +2
One of 2 in server.json
Classifies prompt injection, jailbreaks, and out-of-scope user input before agents act on it. Runs locally from the koma-gate-mcp npm package. Needs 6 environment variables to run.
Skill Claude CodeCodex
Use when writing or running Google Security Operations (SecOps/Chronicle) SIEM queries or investigations — UDM filter queries, stats/aggregation, event-event joins, raw log search, reference list lookups, entity investigations (users, hosts, IPs, files, domains), enriched data queries (geolocation, VirusTotal), entity…
Plugin Claude Code
Bundles 1 skill · 27 tokens together
Intelligent Linux system assistant for Cinnamon-based desktops. Directive-based workflows for security hardening, system updates, GPU management, desktop customization, performance tuning, and troubleshooting.
Keeper-Security/keeper-agent-kit
Plugin Claude Code
Bundles 1 skill · 158 tokens together
Manage Keeper Vault, enterprise administration, PAM, and privileged access using Keeper Commander CLI (keeper).
Skill Claude CodeCodex
Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…
Skill Claude CodeCodex
Security audit agent skills for vulnerabilities and malicious patterns. Use when asked to "scan a skill", "check if a skill is safe", "audit a skill for security", "review skill security", "is this skill malicious", or when installing/reviewing any third-party agent skill. Accepts local SKILL.md files, skill…
MCP server Claude CodeCodexCursor +2
MCP server for FOFA, Quake, Hunter, and DayDayMap cyberspace mapping platforms. Runs locally from the fofa-quake-hunter-mcp Python package.
kevinmhorvath/threat-intel-toolkit
Plugin Claude Code
Bundles 2 skills, 1 agent · 609 tokens together
Defensive IOC + vulnerability triage on free/open-source intel: a subagent plus two skills — threat-intel-lookup (aggregates 10 key-free feeds and looks up IPs, domains, URLs, CVEs) and exploit-availability-check (rates a CVE's exploit/PoC maturity via KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and PoC aggregators).…
Skill Claude CodeCodex needs its repo
Comprehensive cybersecurity tabletop exercise design and facilitation framework. USE WHEN designing incident response scenarios, creating executive or technical tabletops, generating atomics for exercise runners, identifying missing SOPs/playbooks, or evaluating organizational preparedness. Includes threat model…
codefrog7426-gzkos/responsible-disclosure
Skill Claude CodeCodex
Draft a responsible vulnerability disclosure policy for SaaS/devtools: scope, safe harbor posture, channels, timelines, and what not to do — no exploit detail. Triggers: responsible disclosure policy, vulnerability disclosure policy VDP, security.txt companion policy, report vulnerability page, coordinated disclosure.…
NovaCode37/claude-security-skills
Plugin Claude Code
Bundles 8 skills · 690 tokens together
Security skills for Claude Code: secret scanning, Python SAST, prompt-injection testing, and HTTP, JWT, Dockerfile, CORS and dependency auditing. Runs on the standard library with no runtime dependencies.
Plugin Claude Code
Bundles 4 skills · 338 tokens together
Protects the npm and PyPI supply chains — hardens npm/pnpm/Yarn v2+ and uv/pip/Poetry/pdm projects locally and in GitHub Actions CI.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: