Security

XAGI-Lab/melra

MCP server Claude CodeCodexCursor +2

Local MCP runtime for policy-governed, verified agent actions with durable receipts. Runs locally from the @melra/cli npm package.

xiaowu89/skill-function

Skill Claude Code

An image-safety review skill that compresses local images and sends them to an API to check for sexual, political, and violent content.

h315uk3/symbiosis

Agent Claude Code

Reviews pull requests for security vulnerabilities, logic bugs, data loss risks, and API misuse. Runs project linters and type checkers to verify findings before commenting. Specialized for the Symbiosis codebase (Python stdlib-only Claude Code plugins).

33Audits/cca-audit-agent

Cursor rule Cursor

Scan Solidity contracts for Uniswap CCA vulnerabilities — core bugs and integration footguns. Invoke by asking "scan for CCA vulnerabilities" or "run CCA audit".

pi-sloane/claude-plugin

Plugin Claude Code

Bundles 6 skills, 1 MCP server · 228 tokens together

Pi Security workflows for Claude Code and Cowork: investigate findings, review security posture, fetch remediation guidance, start design reviews, submit Markdown reports, and query secure-development playbooks through Pi's hosted MCP server.

ensingm2/AI-threat-modeling-rulesets

Skill Claude Code

Adversarial validation for all stages. Detects fabrications, identifies analytical flaws, challenges assumptions, makes approval decisions. Seeks problems rather than confirming quality. Does NOT complete deliverables or fix issues.

HumanSecurity/human-mcp-server

MCP server Claude CodeCodexCursor +2

Model Context Protocol (MCP) server providing comprehensive cybersecurity intelligence from HUMAN Security. Offers real-time attack monitoring, threat detection, fraud prevention, PCI DSS compliance validation, and supply chain security for AI-powered app. Runs locally from the @humansecurity/human-mcp-server npm…

adamsjack711-ux/pkgxray

Skill Claude CodeCodex

Audit supplied evidence for AI coding-agent extensions, Codex plugins, Claude Code extensions, and MCP servers using concrete supply-chain security indicators.

DouglasRao/Claude-Pentest-Skills

Plugin Claude Code

Bundles 8 skills · 902 tokens together

Professional penetration testing skills for Claude Code — structured offensive workflows covering two independent tracks: (1) Web track: web-recon, web-exploitation, web-postexploitation, web-report; (2) AD track: ad-recon, ad-exploitation, ad-postexploitation, ad-report. All skills include automatic evidence capture.

victorsodre/remotion-agent-catalog

Cursor rule Cursor

Never leak private chat, home paths, or personal data into this public repo. Comments explain code only.

fullstackcrew-alpha/privacy-mask

Plugin Claude Code

Bundles 1 skill · 113 tokens together

Auto-mask sensitive info in images before AI upload. 100% local.

Mikaru0Mystic/sectinel

Cursor rule Cursor

Sectinel - 784-skill cybersecurity arsenal. Select the right security playbook on demand.

harshith-vaddiparthy/outskill-owasp-security-review

Skill Claude CodeCodex

Launch-gate security review for the Vibe CRM Security Lab (NorthStar CRM) — a Next.js 16 App Router + Supabase + OpenAI app. Audits the codebase against the OWASP Top 10 2025, reports each issue in plain language with the exact file, severity, and the concrete fix (using the repo's own /api/fixed/ routes and…

guelfoweb/malware-analysis-static

Skill Claude CodeCodex

Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization…

brolag/neural-claude-code

Plugin Claude Code

Bundles 8 skills, 3 hooks · 551 tokens together

Lightweight Claude Code harness: 5 security hooks + a discover -> spec -> craft -> vet/exercise pipeline. Zero dependencies; runs on vanilla Claude Code.

Seldaek/zizmorify

Skill Claude CodeCodex

Add zizmor (GitHub Actions security analysis) CI to a repository and fix every finding it surfaces. Use when asked to "add zizmor", harden a repo's GitHub Actions workflows, pin actions to SHAs, or make workflows pass a security audit. Adds a zizmor workflow + a dependabot config (on the default branch; other branches…

altic-dev/envault

Plugin Claude Code

Bundles 1 skill · 35 tokens together

Use when managing environment variables across projects, working with .env files, setting up project secrets, or using the envault CLI tool for centralized env var management.

XiangXtreme/yakit-hotpatch-skill

Skill Codex

Use when creating, fixing, or reviewing Yakit Web Fuzzer hotload or Yakit MITM hotpatch scripts in Yaklang. Covers custom fuzztag functions, beforeRequest/afterRequest hooks, mirrorHTTPFlow extraction, retry/failure/mock handlers, encrypted mini-program traffic decrypt-edit-reencrypt, bizContent-style JSON wrappers…

QYmag1c/ida-pro-mcp-multi

MCP server Claude CodeCodexCursor +2

Vibe reversing with IDA Pro. Runs locally from the ida-pro-mcp Python package.

joesecurity/joesandboxMCP

MCP server Claude CodeCodexCursor +2

MCP server "joesandboxmcp" as configured in joesecurity/joesandboxMCP. Runs locally from the joesandboxMCP Python package.

bawbel/scanner

MCP server Claude CodeCodexCursor +2

Security linter and scanner for MCP servers and AI skill files. Detects toxic flows, prompt injection, tool poisoning, and supply chain attacks. Runs locally from the bawbel-scanner Python package.

animaresearch/skills

Skill Claude CodeCodex

Pre-share leak scanner for Claude Code skills (or any folder). Scans BEFORE you publish for secrets (API keys, tokens, private keys, .env values, high-entropy strings), PII (emails/phones), local machine paths (C:\Users\ , /home/ , /Users/ , UNC, internal hostnames), and client/proper-noun names from a LOCAL private…

RewritingTheCode/workshop

Command Claude Code

Full security pass - verify, validate and harden this repo against its real threat model.

taoq-ai/ziran

Skill Claude CodeCodex

ZIRAN is an open-source security testing framework for AI agents. It discovers dangerous tool chain compositions via knowledge graph analysis, detects execution-level side effects (not just text output), and runs multi-phase trust exploitation campaigns that model real attacker behavior.