24,943 mods in this category, of every kind an agent can take. Each one carries what it costs per session, what the scan found, and whether it is the original.
Plugin Claude Code
Bundles 1 skill · 103 tokens together
Defensive, read-only security assessment of a local project (Semgrep + osv-scanner + gitleaks) with a reproducible reliability grade (0-100, A-F).
Plugin Claude Code
Bundles 6 skills, 1 MCP server · 162 tokens together
DNS, IP intelligence, AS routing, domain reputation, Bitcoin blockchain, Lightning Network, and threat intelligence. 50+ tools for network analysis, crypto investigation, and security research.
Plugin Claude Code
Bundles 60 skills, 25 commands, 22 agents, 4 hooks · 6,768 tokens together
Senior-engineer toolkit: principled design (Clean Arch, DDD, SOLID, TDD, patterns, observability, concurrency), security review, language expertise (Bash, C#, Dart, Go, Java, Kotlin, Python, Ruby, Rust, SQL, Swift, TypeScript), and pragmatic workflows.
Plugin Claude Code
Bundles 2 skills, 1 agent · 215 tokens together
OWASP Top 10:2025 rules for writing and reviewing backend/API code in any language, plus /api-secure-report — a full security inventory of every HTTP route in a project.
Plugin Claude Code
Bundles 2 commands · 0 tokens together
Claude Code plugin for Terraform development with terraform-ls LSP integration, 17 automated hooks for security scanning (trivy, checkov), linting (tflint), formatting, and Terragrunt support.
runverdict/sf-security-review-toolkit
Plugin Claude Code
Bundles 14 skills, 1 hook · 1,677 tokens together
Skills that prepare an ISV partner for the AppExchange/AgentExchange security review end to end — autonomous multi-agent codebase audit, submission-artifact generation, scan orchestration, test-environment runbooks, and an honest readiness verdict.
davidmoneil/aifred-document-guard
Plugin Claude Code
Bundles 1 command, 1 hook · 14 tokens together
Prevents Claude from accidentally damaging important files. Intercepts Edit/Write operations and validates them against configurable protection rules including credential scanning, structural preservation, and semantic checks.
Command Claude Code
Brutal pre-submission audit of a Claude Code plugin marketplace — vulnerabilities, wiring integrity, standards compliance, skill gaps.
Skill Claude CodeCodex
Audit third-party agent skills for prompt injection, unsafe commands, downloads, permissions, and persistence before installation.
Plugin Claude Code
Bundles 8 commands · 177 tokens together
Adversarial audit suite: whole-repo codebase/docs/process/security audits, a diff-scoped change audit, an orchestrator that synthesizes one fixes backlog, and a human-gated fixing agent. Evidence labels, stable finding IDs, acceptance checks.
salingnh/android-reverse-engineering-mcp
Plugin Claude Code
Bundles 1 skill, 1 command, 1 MCP server · 56 tokens together
Sandboxed Android reverse engineering with semantic program indexing, XREF/CFG queries and structured network evidence through MCP.
waleedkhanbaloch/claude-code-safety-net
Plugin Claude Code
Bundles 2 commands, 1 hook · 12 tokens together
Block destructive git and filesystem commands before execution.
Cursor rule Cursor
Core mcpnuke development standards and superpowers workflow integration.
Skill Claude Code
Cryptographic delegation for AI agents. Scope-confines what Claude Code can do in this session using Ed25519 delegation tokens. Every action is verified before execution and signed for the audit trail. Use when asked to "delegate", "restrict scope", "authorize", or "sudo mode".
MCP server Claude CodeCodexCursor +2
One of 3 in claude_desktop_config.json
Lets the agent work with GitHub: search code, read and create issues and pull requests, and manage repositories through the GitHub API. Runs locally from the @modelcontextprotocol/server-github npm package. Needs 1 environment variable to run.
Plugin Claude Code
Bundles 3 skills, 1 MCP server · 93 tokens together
A2A Mesh workflows for endpoint validation, approved task operations, and security-bounded MCP consumption.
Command Claude Code
Draft and validate one disabled Synapsor Safe Action for an existing application.
Skill Claude CodeCodex
Apply security guidelines when designing, building, or reviewing AI chatbots, LLM-powered apps, autonomous/tool-using agents, and mobile apps (React Native/Expo, Flutter) — covering agent controls (authorization checks, plan validation, execution limits, audit logging), LLM/prompt security (prompt injection, RAG…
Skill Claude Code
Govern consequential Codex tool calls with Custodian before execution, including writes, network access, credentials, destructive commands, production changes, and money movement.
Skill Claude CodeCodex
Comprehensive security audit for web applications and APIs. Performs a full-stack security review covering authentication, authorization, rate limiting, input validation, secrets management, security headers, cost controls (AI/API spend), email abuse prevention, dependency vulnerabilities, and data exposure risks.…
Skill Claude CodeCodex
Use when asked to check, audit, or review a web application's security, authentication, permissions, access control, error handling, API/endpoint surface, or database management — including "is my app secure", "check my auth", "review my permissions", "find vulnerabilities", or a pre-launch/pre-handover review.
Skill Claude CodeCodex
Classify AI system risk under EU AI Act (Reg 2024/1689), generate Article 50 disclosures, and design conformity audit trails.
dacuma-labs/agent-security-audit
Skill Claude CodeCodex
Audits AI agent projects for security risks in prompts, tools, memory, RAG, and permissions. Use when: the user asks to review agent security, harden an agentic system, check for prompt injection risks, audit tool permissions, or secure an AI assistant before deployment. Do NOT use for: projects with no agentic…
ASER-ho/coding-agent-safety-gate
Skill Claude CodeCodex
A set of safety rules for keeping an AI coding assistant within an approved workspace, task, file scope, and security boundary.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: