Security Plugins
105 security Claude plugins for Claude Code and AI agents, ranked by real installs from npm, PyPI and skills.sh.
#Type
- 1anthropic-cybersecurity-skills817 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more.Jun 2026
- 2android-reverse-engineering-skillClaude Code skill to support Android app's reverse engineeringJun 2026
- 3skillsTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflowsJul 2026
- 4agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.Jul 2026
- 5agent-skillsThe secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.Jul 2026
- 6claude-bughunter82-skill bug-hunting & external red-team bundle for Claude Code — 57 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration.Jul 2026
- 7pentest-ai-agents50 specialist subagents for authorized penetration testing and red team engagements — recon, web/API, Active Directory, cloud, mobile, wireless, exploitation, post-exploitation, detection, forensics, and reporting.Jun 2026
- 8clawsecA complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.Jul 2026
- 9mcp-scannerScan MCP servers for potential threats & security findings.Jul 2026
- 10semiaSemia, security audit for AI agent skills.Jul 2026
- 11audit-harness审计执行保障框架：为 AI Agent 提供三层审计防线、Context 恢复、审计驱动日报和自我修正闭环。Jun 2026
- 12skills-curatedCurated, community-vetted Claude Code plugin marketplaceJul 2026
- 13agentguardGoPlus AgentGuard — AI agent security guard. Blocks dangerous commands, prevents data leaks, protects secrets. 20 detection rules, runtime action evaluation, trust registry.Jun 2026
- 14adrianOpen-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.Jul 2026
- 15communitytoolsClaude Code skills and agents for authorized security testing, bug bounty hunting, and pentesting workflowsJul 2026
- 16hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.Jul 2026
- 17rulesSecurity code review skill based on Project CodeGuard's comprehensive security rules. Helps AI coding agents write secure code and prevent common vulnerabilities.Jan 2026
- 18reinsSecurity controls for AI agents — deterministic policy enforcement, OWASP ASI10 scanning, and audit trails.May 2026
- 19marketplaceSecurity-audited skills for Claude, Codex & Claude Code. One-click install, quality verified.Jul 2026
- 20skillsGhost Security's collection of AppSec skills for AI coding agentsMar 2026
- 21offensive-claudeSpec-driven offensive-security framework for Claude Code: 31 kill-chain skills, executable safety controls (scope/finding/OPSEC discipline), pattern-learning memory, and a bounded engagement engine — with a SessionStart dispatcher that enforces skill-invocation discipline.Jul 2026
- 22cybersecurity-skillsCybersecurity skills for AI agents — code audit, cloud, recon, IR, AI security, and moreMay 2026
- 23android-reverse-engineering-skill这是一套专为 Codex 适配的 Android 逆向分析 skill，支持在 Codex 会话中反编译 APK、XAPK、JAR、AAR，并结合 jadx、Fernflower/Vineflower 梳理 Manifest、包结构、网络层和调用链。它可辅助提取接口、URL、鉴权头、token 与签名逻辑，并提供 Frida、抓包、JNI/SO 分析前的静态侦察方法，适合接口分 析、安全研究和授权测试。May 2026
- 24project-codeguardSecurity code review skill based on Project CodeGuard's comprehensive security rules. Helps AI coding agents write secure code and prevent common vulnerabilities.Jul 2026
- 25sageSafety for Agents - Agent Detection & Response (ADR) for AI agentsJun 2026
- 26code-abyss26 domain skills + 5 verification tools for security-first full-stack engineering. Covers security, architecture, DevOps, AI, mobile, office docs, frontend design, and multi-agent coordination.Jul 2026
- 27skillcompassLocal-only skill quality and security evaluator for Claude Code/OpenClaw. Scores six dimensions, runs local validators, and stores reports and snapshots under .skill-compass/.Apr 2026
- 28cyber-neoOpen-source cybersecurity analysis agent. Scans any local project for vulnerabilities: code security (SAST), dependency CVEs (SCA), secret leaks, authentication/authorization flaws, cryptographic weaknesses, misconfigurations, supply chain risks, and CI/CD security.Jul 2026
- 29open-ontologiesA Terraforming MCP for Knowledge Graphs: validate, classify, and govern AI-generated ontologies.Jul 2026
- 30claude-code-cybersecurity-skillCybersecurity skills marketplace for Claude Code — offensive, defensive, and operational security domains.Jul 2026
- 31openzeppelin-skillsSkills for secure smart contract development with OpenZeppelin Contracts librariesJul 2026
- 32claude-cybersecurityAI-powered cybersecurity code review with 8 specialist agents, OWASP Top 10:2021, CWE Top 25:2024, MITRE ATT&CK v15, and framework-aware false-positive suppressionApr 2026
- 33repo-forensicsOffline security scanner for AI-agent repos, skills, plugins, and MCP serversJul 2026
- 34jar-analyzer-claudeClaude Code plugin for Java JAR security audit — 基于 jar-analyzer 的 Claude Code 安全审计插件，构建数据库，AI 深入分析Mar 2026
- 35sail-skillSAIL V2 (Secure AI Lifecycle) as an agent skill — the full 91-risk catalog for AI/agent gap assessments, security roadmaps, and compliance checklists. Installs on Claude Code, Codex, ChatGPT, Antigravity, and any SKILL.md-compatible agent.Jul 2026
- 36quillshield_skillsStructured skills for smart contract security audits. Infers state invariants, detects semantic guard gaps, models flash loan + oracle attack chains, simulates adversarial exploits, and scores findings.Mar 2026
- 37skills-janitorAudit, clean, secure and swipe-triage your Claude Code + Codex skills. Honest token costs, prompt-injection scan, usage tracking — and it actually deletes.Jul 2026
- 38skillsHacktron Claude Code skills for security research, finding triage, and offensive/defensive workflows.Jun 2026
- 39android-reverse-engineering-claude-skillClaude Code skill that automates Android application reverse engineeringJun 2026
- 40skill-injectSkill-Inject: Measuring Agent Vulnerability to Skill File AttacksJul 2026
- 41claude-code-project-boundaryBlocks destructive commands outside the project directory. Allows file operations within the project (refactoring, cleanup) but prevents accidental damage outside it.May 2026
- 42claude-pentestAn open source plugin for enabeling claude to gain offensive pentesting capabilitiesJun 2026
- 43fortAudit and fix your Mac's security in one command. No agent, no signup, open source.Jul 2026
- 44authsomeLocal OAuth2 and API-key credential broker for AI agents.Jul 2026
- 45threatswarm27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.Apr 2026
- 46skillsSysdig agentic AI skills and pluginsJul 2026
- 47supabase-pentest-skillsAI agent skills for security auditing Supabase applications - internal self-assessment toolkitJan 2026
- 48vigiloAn AI hacker for Web3 Smart Contract. for bug bounties, Audit contest, offensive security research, and real-world exploit thinking.Feb 2026
- 49security-skillsA collection of Claude Code skills that help security teams stay secureApr 2026
- 50auditor-skillSolana + full-stack security auditor: 20 checklists / 1,346 items / 131 known-vectors, severity 1-10, scope-gated loading.Jul 2026
- 51huntkitInvestigation toolkit for Claude Code. Case management, OSINT, structured analytic techniques (Heuer / CIA tradecraft primer), chain-of-custody evidence capture, and bundled MCP servers for infrastructure recon and threat intel.Jul 2026
- 52claude-pluginsThis project equips Claude Code with advanced binary analysis capabilities for tasks such as incident response, malware investigation, and vulnerability assessmentJul 2026
- 53zscaler-mcp-serverManage Zscaler cloud security platform including ZPA (private access), ZIA (internet access), ZDX (digital experience), ZCC (client connector), EASM (attack surface), and Z-Insights (analytics).Jul 2026
- 54agent-skillsAuth0 Agent SkillsJul 2026
- 55find-cve-agentCVE hunting harness for open source security research. A 5-agent team that systematically finds, validates, and reports real vulnerabilities in open source packages.Mar 2026
- 56auth-specAuth skills for Claude Code — scaffold auth endpoints, review auth code for security issues, and add conformance testsJul 2026
- 57railguardA secure runtime for Claude Code. Intercepts every tool call with policy-based allow/block/ask decisions, evasion detection, path fencing, file snapshots, and audit logging.Mar 2026
- 58kernel-vuln-analyzerAnalyze Linux kernel vulnerabilities from KASAN/UBSAN/BUG crash logs or CVE descriptions. Full root cause analysis, exploitability assessment, patch development, and QEMU verification.Jul 2026
- 59signetProof layer for AI agents. Cryptographically verify every action.May 2026
- 60bridgewardSkeptical-reading and prompt-injection defense for AI coding agents. Trust nothing. Ship safely.Apr 2026
- 61slopornotAgentic AI Humanizer Skill for Codex, Claude and OpenClaw: Bypass AI DetectorsJul 2026
- 62cybersecurity-skills-zh734+ 网络安全技能，涵盖 Web 安全、渗透测试、DFIR、威胁情报、云安全、恶意软件分析等领域。中文版本。Apr 2026
- 63nyxidBrokers credentials for downstream services (OpenAI, Anthropic, GitHub, Lark, custom APIs, SSH, MCP) so the agent never sees raw API keys or OAuth tokens. Thin wrapper over the nyxid CLI.Jul 2026
- 64cybersec-toolkit872 on-demand security skills for CTF, pentest, bug bounty, DFIR, detection engineering, cloud, identity, and red/blue team work. Skills are plain Markdown and activate by task without permanently consuming context.Jul 2026
- 65orca🚦 Stop AI agents from deleting data, leaking secrets, or taking irreversible actions without approval. One ⭐ takes us a long way :))Jul 2026
- 66hardstopPre-execution safety layer that blocks dangerous shell commands and credential file reads using pattern matching + LLM analysis. Fail-closed design.Apr 2026
- 67security-audit-skillSecurity audit patterns (OWASP Top 10, CWE Top 25 2025, CVSS v4.0) and GitHub project security checks for any project. Deep automated PHP/TYPO3 scanning with 80+ checkpoints, 19 reference guides, PreToolUse warnings. By Netresearch.Jul 2026
- 68varlock-claude-skillSecure environment variable management with Varlock for secrets, API keys, credentials, and sensitive configuration.Mar 2026
- 69swift-security-skillExpert guidance for Apple Keychain Services, biometric authentication, CryptoKit cryptography, credential lifecycle management, certificate trust, and OWASP compliance mapping.Jun 2026
- 70healthclawguardrailsFHIR AI agent guardrails with 14 MCP tools. PHI redaction on every read, step-up authorization for writes, immutable audit trails, tenant isolation, Curatr data quality evaluation and correction, Fasten Connect EHR ingestion, and HealthEx portable health record export.Jul 2026
- 71rigourThe immune system for AI coding agentsApr 2026
- 72pentester基于 AI Agent 的渗透测试自动化框架，严格遵循 PTES（Penetration Testing Execution Standard）标准，覆盖渗透测试全生命周期。| An automated penetration testing framework based on AI agents strictly adheres to the PTES (Penetration Testing Execution Standard) standards and covers the entire life cycle of penetration…Jul 2026
- 73fsocietyMarketplace for red team and offensive security plugins developed by ogrodev.Mar 2026
- 74gouvernai-claude-code-pluginRuntime guardrails for Claude Code. Auto-approve what's safe, gate what's risky, block what's dangerous. Dual enforcement, full audit trail. MIT.Jul 2026
- 75skillsOpenText Fortify AppSec skills. Use for SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD pipeline integration, and FCLI commands. Supports Fortify on Demand (FoD) and Software Security Center (SSC).Jul 2026
- 76skillsAgent skills for VulHuntMar 2026
- 77agent-guardReal-time secret-leak guardrails for AI coding agents (Claude Code, Codex), Git hooks, and CI.Jul 2026
- 78claddingFor an organization to trust AI with its code, three things must hold — trust, traceability, and stability at scale. cladding wraps your AI coding agent: your intent goes in before it writes, and the result is verified against your spec after, so those three are earned, not…Jul 2026
- 79lictor-aiFree security skills for AI-built apps — run /lictor-security-check in Claude Code before you ship. Plain English, read-only, no telemetry.Jul 2026
- 80secure-claude-codeRuntime security plugin for Claude Code with balanced default hooks plus the Stallion inline MCP gateway for shell, git, MCP, secret, and exfiltration risks.May 2026
- 81pluginsHumanbound plugin marketplace for Claude Code and Cursor — adversarial security testing for local AI agents.Jul 2026
- 82chaingpt-claude-skillThe Web3 toolkit for Claude Code. AI-powered (ChainGPT chat / NFT / Solidity generator + auditor / crypto news / Solidity LLM) PLUS broad Web3: multi-chain wallet portfolios, token research, risk scanning, on-chain analytics, AI-enriched intel, MAINNET contract deployment with…Jul 2026
- 83aikido-claude-pluginAikido Security for Claude Code: scan code (SAST, secrets, IaC) and list all issues from your Aikido feed powered by the Aikido MCP server.Jul 2026
- 84privacy-maskAuto-mask sensitive info in images before AI upload. 100% local.Mar 2026
- 85claude-pluginPi Security workflows for Claude Code and Cowork: investigate findings, review security posture, fetch remediation guidance, start design reviews, submit Markdown reports, and query secure-development playbooks through Pi's hosted MCP server.Jul 2026
- 86claude-superchargerShell-level guardrails for Claude Code. Command blocking, code security scanner, self-teaching, token economy, agent routing, MCP profiles, and session memory.Jul 2026
- 87rugproofSmart contract security auditor for Claude Code. Rugproof your code before someone else does.Jul 2026
- 88claude-pluginsOfficial Chainguard plugins and skills for Claude Code - documentation access and secure container image migrationMay 2026
- 89claude-code-marketplaceA Claude Code marketplace of security and code-quality skills, maintained by Logique.Jun 2026
- 90attestralOpen-source security scanner for MCP servers and AI agents: finds prompt injection, tool poisoning, and excessive agency, and models the cloud your agents can reach. pip install attestral.Jul 2026
- 91preflight-security-auditFor vibe coders who ship fast and don't want to get hacked. Preflight Security Audit plugin checks your app before its launch. One command finds the security, privacy, and payment vulnerabilities in your code and fixes them. 50+ security checks in 6 categories.Jul 2026
- 92outrider-reconClaude-native authorized external recon and ASM methodology bundle with 90 documented capabilities across 11 skills, deterministic Python controls, an optional loopback-only limited-control web plane, explicit human-reviewed finding promotion, and optional fixed policy-gated MCP…Jul 2026
- 93claude-code-security-pluginsAutomated security scanning (Bandit, Semgrep, Trivy, TruffleHog) and comprehensive static security review agent for Claude CodeMar 2026
- 94claude-smart-approvalAuto-approve safe Bash commands in Claude Code using prefix matching and AI evaluation. Requires: shfmt, jq (brew install shfmt jq).Apr 2026
- 95mcp-fortressSecurity scanner and install and runtime protection suite for Model Context Protocol (MCP) serversApr 2026
- 96file-safety-guardPrevents accidental file deletion, overwrites, and destructive operations. Adds automatic backups, dry-run planning, activity logging, and bulk operation approval to every session.Mar 2026
- 97claude-pluginsHarness SAST and SCA plugins for Claude CodeMay 2026
- 98agentic-baseClaude Code için disiplin katmanı — append-only log, deterministik güvenlik gate'leri, confidence eşikleri ve insan onay kuyruğu (plugin marketplace)Jul 2026
- 99claude-pluginsIntercept security for Claude Code — deep AI security scans that supplement your scanners and write findings back to the Intercept platform. OAuth 2.1, no API key.Jul 2026
- 100sf-security-review-toolkitSkills that prepare an ISV partner for the AppExchange/AgentExchange security review end to end — autonomous multi-agent codebase audit, submission-artifact generation, scan orchestration, test-environment runbooks, and an honest readiness verdict.Jul 2026
