Plugins

8 plugins

Plan a sprint by estimating capacity, selecting stories, and identifying risks.

3 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Sprint Planning Pipeline

Install this pack to plan a sprint by estimating capacity, selecting stories, and identifying risks.

3 skills · plugin

Validate Product Idea

Validate a product idea by clarifying intent, identifying risky assumptions, and designing experiments to test them.

4 skills · plugin

Secure Google Cloud Workload

Assesses security requirements, identifies risks, and provides actionable recommendations for IAM, network, and data protection.

4 skills · plugin

Sprint Planning Pack

For scrum masters and PMs planning sprints: plan sprint, run retro, and facilitate pre-mortem risk analysis.

9 skills · plugin

@alirezarezvani

14 regulatory affairs & quality management skills for HealthTech/MedTech: ISO 13485 QMS, MDR 2017/745, FDA 510(k)/PMA, GDPR/DSGVO, ISO 27001 ISMS, CAPA management, risk management, clinical evaluation, SOC 2 compliance.

10 skills · plugin

@alirezarezvani

Business Operations

Internal BizOps domain. v2.8.0 ships 7 skills: orchestrator + process-mapper (BPMN/bottleneck/cycle-time, Lean+TOC) + vendor-management (scorecard+SLA+3rd-party risk, NIST SP 800-161/ISO 27036) + capacity-planner (Erlang-C queueing math for ops teams, NOT engineering) + internal-comms (ADKAR+Kotter 8-step, NOT marketing) + knowledge-ops (SOP+runbook+KB hygiene with 5W2H, context: fork) + procureme

3 skills · plugin

Results for “risk”

134 skills

Performing GRAPHQL Depth Limit Attack

Test GraphQL APIs for depth limit vulnerabilities by sending deeply nested recursive queries to identify denial-of-service risks.

24.6k · bundle

Provides regulatory compliance assessments across data privacy, AI ethics, and localization laws, producing structured outputs with risk scores and remediation status.

srednoff888-art

Security Hardening

Use this skill for auth boundaries, input validation, secrets, RLS, injection risks, destructive-action review. Trigger when the task involves security work related to Security Hardening, production implementation, audits, debugging, strategy, or validation.

Dependency Auditor

Audit and manage dependencies across multi-language projects by scanning for vulnerabilities, license conflicts, and transitive dependency risks, with safe-upgrade planning.

20.4k · bundle

Skill Security Auditor

Scan and audit AI agent skills for security risks before installation, producing a PASS/WARN/FAIL verdict with findings and remediation guidance.

20.4k · bundle

Security Threat Model

Performs repository-grounded threat modeling by enumerating trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, then writes a concise Markdown threat model.

23.3k · bundle

construct-ai-primary

Threat Modeling

Use when designing new systems, features, or integrations to identify potential security threats and vulnerabilities before they are exploited. This skill provides a structured approach to threat identification, risk assessment, and mitigation planning.

Github Actions Hardening

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

36.2k · bundle

Performing Cve Prioritization With Kev Catalog

Integrate the CISA Known Exploited Vulnerabilities catalog with EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence.

24.6k · bundle

srednoff888-art

Supply Chain Sbom Sca

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Clawhub Security Auditor

Audit public skill or plugin bundles for ClawHub, Claude, Hermes, and GitHub release risks. Use when: checking Suspicious/upload flags, dangerous local behaviors, metadata mismatches, legacy auth surface, or non-runtime files before publishing.

Detecting Insider Threat With Ueba

Detect insider threats by modeling normal user and entity behavior with Elasticsearch, computing anomaly scores, and correlating low-confidence indicators into high-confidence alerts.

24.6k · bundle

Performing Nist Csf Maturity Assessment

Conduct a maturity assessment against the NIST Cybersecurity Framework (CSF) 2.0, using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.

24.6k · bundle

Exploiting Nosql Injection Vulnerabilities

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.

24.6k · bundle

Performing Asset Criticality Scoring For Vulns

Build a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.

24.6k · bundle

sakamoto-family-smile

Audits Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield, covering CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Testing API Security With Owasp Top 10

Systematically assess REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.

24.6k · bundle

Testing For XML Injection Vulnerabilities

Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.

24.6k · bundle

Implementing GCP Organization Policy Constraints

Enforce security guardrails across GCP resource hierarchy by configuring organization policy constraints to restrict risky configurations and ensure compliance at organization, folder, and project levels.

24.6k · bundle

Skill Drift Guard

Scans local repos and AI agent skill folders for security drift, saves trusted baselines, and compares changes after updates to highlight risky new capabilities.

Performing Service Account Credential Rotation

Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.

24.6k · bundle

Performing Threat Landscape Assessment For Sector

Conduct a sector-specific threat landscape assessment by analyzing threat actor targeting patterns, common attack vectors, and industry-specific vulnerabilities to inform organizational risk management.

24.6k · bundle

lucassantana-dev

Full dependency lifecycle composite — audit known vulnerabilities, triage by severity and breaking-change risk, upgrade targeted packages, verify tests pass, ship PR. Use monthly, before releases, or when dependency alerts are stacking. Never do a blanket upgrade; always triage first.

Clawhub Security Auditor All

Audit public skill or plugin bundles for ClawHub, Claude, Hermes, AgentSkill, AgentSkills.so, and GitHub release risks. Use when: checking Suspicious/upload flags, dangerous local behaviors, quality/security mismatches, legacy auth surface, or non-runtime files before publishing.

Assess AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, and agent tool abuse, with MITRE ATLAS mapping and guardrail recommendations.

20.4k · bundle

Data Breach Blast Radius

Quantifies the business and regulatory impact of a potential data breach by inventorying sensitive data, tracing data flows, scoring exposure vectors, and estimating regulatory fines using law-sourced figures.

36.2k · bundle

Analyzing Ransomware Leak Site Intelligence

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.

24.6k · bundle

Exploiting Smb Vulnerabilities With Metasploit

Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.

24.6k · bundle

Performing Ot Vulnerability Assessment With Claroty

Correlates OT asset inventory with ICS-CERT advisories and CVE data to identify, prioritize, and track vulnerabilities in operational technology environments using Claroty xDome.

24.6k · bundle

Generate a NullPointer Studio styled PDF penetration test report from findings.json, producing a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards, and remediation summary.

Testing For Host Header Injection

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

24.6k · bundle

Performing Ioc Enrichment Automation

Automates multi-source enrichment of IPs, domains, URLs, and file hashes using VirusTotal, AbuseIPDB, Shodan, GreyNoise, URLScan.io, and MISP to provide contextual risk scoring and disposition recommendations for SOC analysts.

24.6k · bundle

Executing Nist Rmf Authorization To Operate

Guide federal systems through the NIST Risk Management Framework (SP 800-37 Rev 2) to achieve an Authorization to Operate (ATO), covering categorization, control selection, assessment, and continuous monitoring.

24.6k · bundle

Implementing AWS Security Hub Compliance

Aggregate security findings across AWS accounts, enable compliance standards like CIS and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.

24.6k · bundle

Detecting Suspicious OAUTH Application Consent

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

24.6k · bundle

Implementing Cloud Security Posture Management

Continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

24.6k · bundle